Where Does Metasploit Store Config and Loot?
Metasploit ~/.msf4 directory with database config, logs, loot and module cache.
Last updated
Metasploit roots user state in a .msf4 directory in your home: database.yml with Postgres credentials, logs of every session, loot from successful runs, history, and cached module metadata. Framework code lives wherever it was installed, cleanly apart from this working state.
That separation makes the directory both backup worthy and disposable. Copy it to migrate an assessment setup wholesale, or delete it to reset a tangled install back to first run behavior. Logs and loot deserve care in client work, since they hold the actual findings rather than mere preferences.
Where Metasploit stores this, by platform
~/.msf4
Key children include database.yml, logs, loot, history and modules cache. Copy with msfconsole stopped. Framework installs under /opt or /usr/share stay out of this tree by design.
~/.msf4
Same layout as Linux for Homebrew and installer based setups. Database credentials and loot copy between platforms untouched, since paths inside stay relative.
Frequently asked questions
how do i back up metasploit data
Back up database.yml for credentials plus the loot and logs subfolders for results. Module customizations in modules/ travel too. The whole tree copies cleanly with msfconsole stopped, since nothing inside is machine locked.
can metasploit use a remote database
Yes. database.yml in the config root points msfconsole at any reachable Postgres, local or remote. Edit it with the console stopped, then verify with db_status on next launch before assuming the switch worked.
Notice an outdated path? Let us know.