Which of the following tools uses exploits to break into remote operating systems?

Nessus is a vulnerability scanner that identifies and reports weaknesses in systems but does not execute exploits or establish sessions on remote hosts.

Metasploit Framework contains a large library of exploit modules, payloads, and auxiliary modules specifically engineered to compromise vulnerabilities in remote operating systems and services. Unlike passive scanners, Metasploit actively executes exploit code against targets to deliver payloads such as reverse shells or Meterpreter sessions, giving a tester or attacker interactive control over the compromised system.

Nmap is a network reconnaissance and port scanning tool used to discover hosts and open services; it does not include exploit functionality.

John the Ripper is an offline password hash cracking tool and does not contain exploit modules for compromising remote operating systems.