RFC: Make Metasploit Accessible via a flag

[bee-san]

Summary

Metasploit through a screen reader is horrible, because of all the ascii art.

I am suggesting we add a flag --accessible which gets rid of this ascii art to make it possible to use metasploit if you are disabled.

Basic example

Here's how Metasploit looks:

Call trans opt: received. 2-19-98 13:24:18 REC:Loc

     Trace program: running

           wake up, Neo...
        the matrix has you
      follow the white rabbit.

          knock, knock, Neo.

                        (`.         ,-,
                        ` `.    ,;' /
                         `.  ,'/ .'
                          `. X /.'
                .-;--''--.._` ` (
              .'            /   `
             ,           ` '   Q '
             ,         ,   `._    \
          ,.|         '     `-.;_'
          :  . `  ;    `  ` --,.._;
           ' `    ,   )   .'
              `._ ,  '   /_
                 ; ,''-,;' ``-
                  ``-..__``--`

                             https://metasploit.com


       =[ metasploit v5.0.88-dev                          ]
+ -- --=[ 2014 exploits - 1097 auxiliary - 343 post       ]
+ -- --=[ 562 payloads - 45 encoders - 10 nops            ]
+ -- --=[ 7 evasion                                       ]

Metasploit tip: You can upgrade a shell to a Meterpreter session on many platforms using sessions -u <session_id>

msf5 >   

Turning off the title with quiet mode, we still see ascii art throughout the program:

Matching Modules
================

   #   Name                                                        Disclosure Date  Rank       Check  Description
   -   ----                                                        ---------------  ----       -----  -----------
   0   auxiliary/admin/smb/ms17_010_command                        2017-03-14       normal     No     MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Command ExecutionMatching Modules
================

   #   Name                                                        Disclosure Date  Rank       Check  Description
   -   ----                                                        ---------------  ----       -----  -----------
   0   auxiliary/admin/smb/ms17_010_command                        2017-03-14       normal     No     MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Command Execution

Note: This is copied from quiet mode enabled. Quiet mode does not make the program accessible.

I am suggesting a feature which disables all forms of ascii art such as lines, cute drawings, and more.

This feature can be called --accessible and is used via that flag.

Motivation

Accessibility is a basic human right. Metasploit is the greatest pentesting tool to ever exist. It powers thousands of pentesters every hour. But it is not accessible.

Metasploit not being accessible means the vast majority of those that are disabled cannot get into information security because of this.

I wrote a blog post about this here:
https://bees.substack.com/p/making-hacking-accessible.

Please consider making Metasploit accessible. 💖

[h00die]

At the very minimum, the -q flag disables the startup banner.

[bee-san]

At the very minimum, the -q flag disables the startup banner.

It is really good it does that (some apps don't!), there is still ASCII art throughout the program with the quiet flag enabled, hence this issue.

This comment ^^ is intended for anyone that didn't read my issue and messaged me calling me an idiot because the quiet flag exists (despite the original issue talking about why this isn't sufficient) 😂

[adfoster-r7]

What You Can Do as a Tool Creator

• Run your terminal app through a screenreader. Use Google Translate if you want.

Out of curiosity, which screen reader would you recommend to use with terminal applications?

I've ran it through some of the examples through another link you provided - https://www.naturalreaders.com/online/, and it does a great job of ignoring a lot of the miscellaneous characters, so I'd love to use whatever software you're using on a day-to-day basis within your terminal so that I can incorporate it into my workflow and see what pain points there are

The only issues that haven’t been fixed are typical ASCII art. Such as the search command.

What would the best search output be for an optimised accessibility experience? It should be possible to configure this globally within Metasploit Framework, so it would be great to know what's preferred here.

@bee-san Thanks for raising an issue and providing a blog post 👍

[pbarry-r7]

I've been meaning to chime in here. I'm a fan of inclusion efforts, and I had done a bit of investigation and work as part of a hackathon in early 2020 to do exactly this sort of thing. I created a draft PR here with my code changes and video clips I had recorded at that time to demonstrate before and after changes to see+hear the difference, focusing on the built-in macOS VoiceOver screen reader (watching some of those clips now, I feel an even better change for certain table output, like hosts, may be to ensure the column header is read everytime prior to the value instead of expecting the user to remember the column header values and order from just one reading at the beginning, but maybe it's okay this way...). We'd absolutely need to include blind and visually impaired users in this endeavor (I am a fully sighted individual).

[adfoster-r7]

@bee-san Did you have a chance to see the above comment asking for more information on the screen readers you would typically use, as well as @pbarry-r7's proof of concept? #15026 :)