Choose a Module Type and Location

First decide the module type and where to put it. The entry method and required options depend on the type you choose.

Questions to answer

1. Will it open a new session (shell / Meterpreter)?
2. Does it assume a session already exists?
3. Will it connect remotely or run in an existing session?

Decision flow

Does the task already have a session?
  YES → post
        (except local privilege escalation that returns another session: exploit/*/local)
  NO  → Will it execute a payload to open a session?
          YES → exploit
          NO  → auxiliary

Result	Meaning	Example location
exploit	Deliver a payload and open a session	~/.msf4/modules/exploits/<platform>/<proto>/name.rb
auxiliary	Enumeration, login, administration, DoS, etc.; does not open a session	~/.msf4/modules/auxiliary/<category>/<proto>/name.rb
post	Enumeration, administration, or collection through an existing session	~/.msf4/modules/post/<platform>/<category>/name.rb

Choose by example

Scenario	Type to choose	Reason
Return a Meterpreter session through a web RCE	exploit	The goal is a payload session
Log in to a web app and save settings as loot	auxiliary	Does not open a session
Grab banners across a range on 22/tcp	auxiliary (scanner)	Scans multiple hosts
Run id once over SSH and finish	auxiliary is possible; use exploit if you want a persistent shell	Depends on whether there is a payload
Read /etc/passwd from a shell you already have	post	Existing session
Use local privilege escalation from Meterpreter to get a new root session	exploit (local)	New session = exploit
Upgrade a shell to Meterpreter	Use an existing post module or write a post module	Converts an existing session
Listen with a handler	Use the existing exploit/multi/handler	No need to write one

Naming directories

Separate by protocol and purpose.

exploits/linux/http/myapp_rce.rb
exploits/windows/smb/my_vuln.rb
exploits/linux/local/my_priv_esc.rb
auxiliary/scanner/http/myapp_version.rb
auxiliary/gather/myapp_config.rb
auxiliary/admin/myapp_add_user.rb
post/linux/gather/myapp_tokens.rb
post/windows/manage/myapp_migrate.rb

File names are usually lowercase with underscores. In msfconsole, the path appears as a command such as use exploit/linux/http/myapp_rce.

Outcome of this step

• The module type is chosen.
• The destination file path is chosen.
• You can say whether the entry method is exploit, run, or run_host.

Next, Base Class and Mixins helps you choose a class and communication method for that type.