We explore how Metasploit is used at different stages of penetration testing in a controlled training environment, including scanning, exploitation, and post-exploitation.