Exploitation

If a Penetration Tester invests the proper time and resources during the Reconnaissance of a target, the Penetration Tester should end up with a list of targets with possible vulnerabilities. The next step is prioritizing each target's value to your mission, approximating the level of effort required to exploit potential vulnerabilities, and judging the associated risk with performing the attack. The vulnerability and exploitation available in Kali are ideal for identifying and exploiting vulnerabilities found during the Reconnaissance of web application servers.

Metasploit

The Metasploit framework is one of the most popular tools for exploiting server-side attacks. It is considered one of the most useful tools for Penetration Testers. HD Moore created it in 2003. It is used as a legitimate Penetration Testing tool, as well as a tool used by attackers to conduct unauthorized exploitation of systems.

There are a plenty of sources dedicated to teaching how to use the Metasploit framework...