Where Does Metasploit Store Loot, Logs and History?
Metasploit .msf4 directory on Linux with loot, logs, history and module cache.
Last updated
Metasploit writes everything operational into .msf4 in your home directory: command history, session logs, harvested loot and credentials, plus the module cache. The PostgreSQL database holds hosts and vulnerabilities separately.
Loot is the directory auditors ask about first. Back up .msf4 after an engagement and the evidence trail travels with the report.
Where Metasploit stores this, by platform
~/.msf4
Holds history for console recall, loot for captured files and credentials, logs per session, and modules metadata. Database config sits at database.yml inside. The system database itself lives in PostgreSQL, so dump it separately for full coverage.
Frequently asked questions
Where does Metasploit save cracked credentials?
In the loot folder under .msf4, with creds also queryable from the database. Export both for the engagement archive.
How do I clear Metasploit history?
Truncate the history file inside .msf4 with msfconsole closed. The database keeps its own records, so clear those with db_nmap-style workspace deletion if needed.
Notice an outdated path? Let us know.