As we conduct testing of our target systems, we are collecting data.
In the Metasploit framework, we have a database of information that
we collect as we test. We need to understand what data we have and
how it can be used. Metasploit utilizes a database to collect data
during this testing.
When we first started the Metasploit console in Kali,
it initialized that database.
The database connection is reestablished each time we
start Metasploit. Metasploit automatically captures data
from testing into that database.
It could also import data from other tools and export data
for reporting, archiving, or backups.
Workspaces allow you to group related data together. You could
use workspaces based on specific projects,
networks, or subnets where the targets exist,
or a physical locations such as an office location,
hosting provider, or data center.
Metasploit can import data from other tools.
This is useful when working in teams gathering data and relying on tools
outside of Metasploit for scanning the environment.
Metasploit has a specific command to execute an Nmap scan and pull
that data into the Metasploit database in real time.
You can also import scan data from a past Nmap scan or import various
reports, XML data, and CSV exports from other tools as well.
Metasploit can also export data.
You may want to store backup of your work so nothing is lost, archive the
data after completion of a project, or transfer the data in a project to
another instance of Metasploit for another tester.
As you collect information through discovery and testing,
it can be difficult to remember details about each of the targets.
You could record some of these details outside of Metasploit, but it
would be more helpful to have a method of recording useful details
about each of the targets. Thankfully, Metasploit has tagging,
which allows you to select a unique,
memorable tag and apply that tag to specific hosts or across a range of hosts.
Once you have a set of tags applied,
you can search your collected host information based on a specific tag.
Once you complete your work or if you need to change the aspects of your data,
you can remove tags from a host.
Now, I'd like to demonstrate some of the commands needed for the
Metasploit functionality we just discussed.
We'll start with workspaces and then import some scan data from
Nmap. We'll export the data in the database out to an archive,
and finally, we'll tag some hosts.
Let's get started. Here we are inside the Metasploit console. Remember,
you can always find help information available.
There are database‑specific commands that we will see with the help command.
Let's start with the workspaces. Here we can see the options
for creating a workspace with the ‑a option.
So let's do that.
We'll call this workspace iot. Running the workspace command by itself,
we can see our current workspace, which is the one we just created.
Now, let's import some scan data that I took from an earlier Nmap
scan. The db_import command is very simple.
Just specify the file to import.
Now let's see what hosts are in the database and the
services with the services command.
Okay, before we go too far with this data,
let's export it out to an archive in the XML format.
Now let's apply some tags to some of the hosts we have.
We need the ‑t option.
Let's call this one google and this one irobot since it's a
Roomba. Now, we can see those tags are applied when we specify
just the columns we're interested in seeing.
So that's a quick demo of managing data inside the Metasploit Framework console.