It will probe websites (and local networks) to find out the OS/server information (IIS, apache, etc), database info (mysql, mssql) and language (asp, php).
It then uses a database of known exploits and scripts (all types XSS, SQL injections, etc).
If it's a good tool, why would he release it so soon without giving people much time to update?
If it's malicious, why is he telling people about it?
But anyway, in the end, it doesn't matter, it exists. Authorial intent is so 20th century.
> The Metasploit Project is also well known for anti-forensic and evasion tools, some of which are built into the Metasploit Framework.
If so, how are such functions valuable for a pentest/audit?
Now a blackhat would be able to do this without BT or Metasploit. The tools are out there, and well known. So the fact that these tools are in BT and Metasploit doesn't change that. But it does make it easier for a pentester to prove a system is vulnerable, and to help a company address their vulnerabilities through remediation.
Well, they can do that without MSF. It's just harder.
Where MSF helps is with pentesters and other security professionals. When they perform a pentest or audit, tools like MSF/SET/Nexpose allow them to rapidly and accurately determine if a network or system is vulnerable, and prove it (within the bounds of the engagement's scope). Without these tools, a pentest would require far more tedious work.
See http://en.wikipedia.org/wiki/Full_disclosure it's a debate that has been going on a long time. Consider that right now the only people scanning IP blocks for vulnerable apps are bad guys.
Because the impact of warning people is almost surely greater than someone new and malicious stumbling onto metasploit at exactly this time when such a large vulnerability is at play. Especially given that metasploit has been around for some time and will continue to long after this exploit is a smudge on RoR's history.