Metasploitable 3 is a "vulnerable by design" virtual machine maintained by Rapid7. It was built to address the limitations of earlier versions by offering:

If you have been searching for a reliable , you have landed on the right page. However, there is a catch: unlike Metasploitable 2, Metasploitable 3 is not distributed as a simple OVA file by the developers. This article will explain why and show you exactly how to get a fully functional OVA equivalent.

Always verify the SHA256 checksum of any OVA file you download from a third-party source to ensure it hasn't been tampered with. How to Install the OVA in VirtualBox or VMware