In the context of the Metasploit Framework, RHOSTS (often referred to in its singular form RHOST) is one of the most fundamental variables a penetration tester must configure. It stands forRemote Hostand represents the target IP address or hostname that the exploit or auxiliary module will attempt to interact with. Metasploit is designed around a modular architecture where users select an exploit, configure the necessary payloads, and then set the specific variables required for the module to execute successfully.
When a tester identifies a vulnerability on a target machine, they use the command set RHOSTS [Target_IP] within the msfconsole to direct the attack. This variable can take a single IP address (e.g., 192.168.1.10), a range of IP addresses (e.g., 192.168.1.1-192.168.1.50), or a CIDR notation (e.g., 192.168.1.0/24). Unlike LHOST (Local Host), which identifies the attacker's machine for receiving incoming connections, RHOSTS defines the destination.
Understanding these variables is critical for the "Exploitation" phase of a penetration test. If RHOSTS is set incorrectly, the exploit will be sent to the wrong machine, potentially causing unintended system crashes or alerts on non-target systems. Furthermore, modern versions of Metasploit use the plural RHOSTS even for single targets to maintain consistency across modules that support scanning entire networks. Mastering the configuration of these parameters ensures that an ethical hacker can efficiently deploy modules against specific vulnerabilities while maintaining precise control over the scope of the engagement.
