Running Metasploit on Android without root
You do not need to root a phone to run the Metasploit Framework, Nmap or Nuclei on it. You do need to know which handful of capabilities root actually buys, because the guides that say "root required" and the ones that say "no root needed" are both describing a real thing — just different parts of it.
Why root is not needed for most of it
Metasploit, Nmap and Nuclei are ordinary userspace programs. Android is Linux, and an app can ship a userspace environment and run them inside it as a normal user. Nothing in exploiting a remote host, generating a payload, catching a session or querying a workspace database requires elevated privileges on your own phone — the privileges that matter are the ones you obtain on the target.
So on stock, unrooted Android the following work normally: the full Metasploit module tree, msfvenom payload generation, handlers and Meterpreter sessions, the workspace database, Nuclei template scanning, and the recon and web arsenal — sqlmap, ffuf, httpx, subfinder, katana and the rest.
The specific things root changes
Two categories, and they are narrow:
- Raw sockets. Nmap's SYN scan (
-sS), UDP scan (-sU) and OS detection (-O) craft packets directly and need elevated privileges. Without root, Nmap falls back to a TCP connect scan (-sT), which completes the three-way handshake instead of half-opening it. It finds the same open ports; it is slower and noisier in the target's logs. - Privileged ports. Binding below port 1024 needs privilege. This is what stops tools like Responder, which has to answer on LLMNR/NBT-NS and stand up listeners on low ports, from working unrooted.
That is the honest extent of it. Everything else is unaffected.
How Lupus handles it
Lupus runs on stock unrooted Android and never roots your device or runs itself as root. On a device that already has root, an Execute as root toggle runs the Metasploit engine elevated, which turns on the privileged Nmap scan types and the tools that need low ports. Leave it off and everything else works exactly the same.
If you need SYN scans and Responder but do not want to root your phone, there is a third option that is usually the better one: run the engine on a Linux box you control and drive it from the phone. That is covered in local and remote mode.
What "no root" does not mean
It does not mean unlimited. Android still applies its own limits to a userspace environment — background execution, battery management and per-app storage all apply, and a long scan can be interrupted by the system if the app is backgrounded aggressively. Those are platform constraints, not licensing ones, and they apply to any tool of this kind including a manual Termux install.
As always: for lawful, authorized testing only — systems you own or have written permission to assess.