# rapid7/metasploit-framework architecture

> Architecture diagram of the GitHub repository rapid7/metasploit-framework, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-10-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/rapid7/metasploit-framework
- Repository: https://github.com/rapid7/metasploit-framework

## Overview

Metasploit Framework is a security testing platform whose README identifies msfconsole as its primary interface. A typical user selects a module to probe or exploit a target, then uses payload and post-exploitation capabilities. The tree also shows auxiliary scanners, encoders, protocol services, session management, and persistent storage. The available excerpts do not expose the framework’s module-dispatch path, so those runtime connections are shown as unverified; this is a product-level map, not a traced call graph.

Main entry points: [`modules`](https://github.com/rapid7/metasploit-framework/tree/master/modules) (Module catalog), [`modules/exploits/windows/http/manageengine_adaudit_plus_authenticated_rce.rb`](https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manageengine_adaudit_plus_authenticated_rce.rb) (Exploit modules), [`modules/auxiliary/admin/http/manageengine_pmp_privesc.rb`](https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/manageengine_pmp_privesc.rb) (Auxiliary modules), [`modules/post/windows/gather/enum_services.rb`](https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/gather/enum_services.rb) (Post modules)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_interface["User interface"]
  node_console["msfconsole"]
end

subgraph group_modules["Security modules"]
  node_module_catalog["Module catalog"]
  node_exploits["Exploit modules"]
  node_auxiliary["Auxiliary modules"]
  node_post_modules["Post modules<br/>[enum_services.rb]"]
end

subgraph group_execution["Payloads and sessions"]
  node_payloads["Payload modules"]
  node_encoders["Encoders<br/>[service.rb]"]
  node_exploit_data["Exploit resources"]
  node_session_manager["Session manager<br/>[session_manager.rb]"]
  node_common_engine["Common engine<br/>[common_engine.rb]"]
end

subgraph group_services["Framework services"]
  node_service_manager["Service manager<br/>[service_manager.rb]"]
  node_data_services["Data services"]
  node_persistent_storage["Persistent storage"]
  node_anemone_storage["Crawler storage<br/>[storage.rb]"]
  node_network_servers["Protocol servers"]
end

node_operator(("Operator"))

node_operator -->|"uses"| node_console
node_console -.->|"selects from"| node_module_catalog
node_module_catalog -.->|"dispatches"| node_exploits
node_module_catalog -.->|"dispatches"| node_auxiliary
node_module_catalog -.->|"dispatches"| node_post_modules
node_exploits -.->|"uses"| node_payloads
node_payloads -.->|"encodes with"| node_encoders
node_exploits -.->|"uses resources"| node_exploit_data
node_post_modules -.->|"acts on"| node_session_manager
node_console -.->|"manages"| node_service_manager
node_service_manager -.->|"starts"| node_network_servers
node_common_engine -.->|"supports"| node_session_manager
node_console -.->|"accesses"| node_data_services
node_data_services -.->|"persists data"| node_persistent_storage
node_auxiliary -.->|"may use"| node_anemone_storage

click node_module_catalog "https://github.com/rapid7/metasploit-framework/tree/master/modules"
click node_exploits "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manageengine_adaudit_plus_authenticated_rce.rb"
click node_auxiliary "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/manageengine_pmp_privesc.rb"
click node_post_modules "https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/gather/enum_services.rb"
click node_payloads "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/singles/windows/dns_txt_query_exec.rb"
click node_encoders "https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/service.rb"
click node_exploit_data "https://github.com/rapid7/metasploit-framework/tree/master/data/exploits"
click node_session_manager "https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/core/session_manager.rb"
click node_common_engine "https://github.com/rapid7/metasploit-framework/blob/master/lib/metasploit/framework/common_engine.rb"
click node_service_manager "https://github.com/rapid7/metasploit-framework/blob/master/lib/rex/service_manager.rb"
click node_data_services "https://github.com/rapid7/metasploit-framework/tree/master/lib/metasploit/framework/data_service"
click node_persistent_storage "https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/base/persistent_storage.rb"
click node_anemone_storage "https://github.com/rapid7/metasploit-framework/blob/master/lib/anemone/storage.rb"
click node_network_servers "https://github.com/rapid7/metasploit-framework/tree/master/lib/rex/proto"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_console toneBlue
class node_module_catalog,node_exploits,node_auxiliary,node_post_modules toneAmber
class node_payloads,node_encoders,node_exploit_data,node_session_manager,node_common_engine toneMint
class node_service_manager,node_data_services,node_persistent_storage,node_anemone_storage,node_network_servers toneRose
class node_operator toneIndigo
```

## Components

### User interface

- **msfconsole**

### Security modules

- [Module catalog](https://github.com/rapid7/metasploit-framework/tree/master/modules): `modules`
- [Exploit modules](https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manageengine_adaudit_plus_authenticated_rce.rb): `modules/exploits/windows/http/manageengine_adaudit_plus_authenticated_rce.rb`
- [Auxiliary modules](https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/manageengine_pmp_privesc.rb): `modules/auxiliary/admin/http/manageengine_pmp_privesc.rb`
- [Post modules](https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/gather/enum_services.rb): `modules/post/windows/gather/enum_services.rb`

### Payloads and sessions

- [Payload modules](https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/singles/windows/dns_txt_query_exec.rb): `modules/payloads/singles/windows/dns_txt_query_exec.rb`
- [Encoders](https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/service.rb): `modules/encoders/x86/service.rb`
- [Exploit resources](https://github.com/rapid7/metasploit-framework/tree/master/data/exploits): `data/exploits`
- [Session manager](https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/core/session_manager.rb): `lib/msf/core/session_manager.rb`
- [Common engine](https://github.com/rapid7/metasploit-framework/blob/master/lib/metasploit/framework/common_engine.rb): `lib/metasploit/framework/common_engine.rb`

### Framework services

- [Service manager](https://github.com/rapid7/metasploit-framework/blob/master/lib/rex/service_manager.rb): `lib/rex/service_manager.rb`
- [Data services](https://github.com/rapid7/metasploit-framework/tree/master/lib/metasploit/framework/data_service): `lib/metasploit/framework/data_service`
- [Persistent storage](https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/base/persistent_storage.rb): `lib/msf/base/persistent_storage.rb`
- [Crawler storage](https://github.com/rapid7/metasploit-framework/blob/master/lib/anemone/storage.rb): `lib/anemone/storage.rb`
- [Protocol servers](https://github.com/rapid7/metasploit-framework/tree/master/lib/rex/proto): `lib/rex/proto`

### Other components

- **Operator**

## Connections

- Operator → msfconsole: uses
- msfconsole → Module catalog: selects from
- Module catalog → Exploit modules: dispatches
- Module catalog → Auxiliary modules: dispatches
- Module catalog → Post modules: dispatches
- Exploit modules → Payload modules: uses
- Payload modules → Encoders: encodes with
- Exploit modules → Exploit resources: uses resources
- Post modules → Session manager: acts on
- msfconsole → Service manager: manages
- Service manager → Protocol servers: starts
- Common engine → Session manager: supports
- msfconsole → Data services: accesses
- Data services → Persistent storage: persists data
- Auxiliary modules → Crawler storage: may use