register_options

register_options defines the input fields shown by show options in msfconsole. The registered values can be read in code as datastore['NAME'].

Basic form

register_options(
  [
    Opt::RPORT(80),
    OptString.new('TARGETURI', [true, 'The base path', '/app/']),
    OptString.new('USERNAME', [true, 'Username', 'admin']),
    OptString.new('PASSWORD', [false, 'Password', '']),
  ]
)

register_advanced_options(
  [
    OptFloat.new('HttpClientTimeout', [false, 'HTTP timeout', 20.0]),
    OptBool.new('ForceExploit', [false, 'Override check result', false])
  ]
)

Write this in initialize after super(update_info(...)) (or after a mixin adds its options).

Opt syntax

OptSomething.new(name, [required, description, default], aliases: ..., conditions: ...)

Element	Meaning
name	Datastore key; uppercase is conventional
required	If true, appears in show missing
description	Description in show options
default	Initial value; may be omitted if unnecessary

Common types

Class	Purpose	Example
OptString	String	TARGETURI, USERNAME
OptInt	Integer	Custom port or count
OptBool	true/false	SSL, STOP_ON_SUCCESS
OptPort	1–65535	Additional port
OptAddress	IP	Single address
OptAddressRange	CIDR / range	If the module needs its own
OptPath	File path	Wordlist or key
OptEnum	Choice	%w[GET POST]
Opt::RHOST / Opt::RPORT	Standard connection target	Often already added by a mixin
Opt::RHOSTS	Multiple hosts	Added by Scanner
Opt::LHOST / Opt::LPORT	Callback address	For exploit payloads

OptEnum.new('METHOD', [true, 'HTTP method', 'GET', %w[GET POST]])
OptPath.new('KEY_FILE', [false, 'SSH private key path', nil])
OptBool.new('CREATESESSION', [false, 'Create a session on success', true])

Reading from datastore

uri = datastore['TARGETURI']
user = datastore['USERNAME']
timeout = datastore['HttpClientTimeout']

A value set with set TARGETURI /x/ appears here. A setg value is visible from the framework if the module has no option with the same name. See the bundled wiki How-to-use-datastore-options.md for details.

Options already registered by mixins

When including HttpClient or Scanner, you should generally avoid registering these options again.

Mixin	Examples already present
HttpClient	RHOST, RPORT, VHOST, SSL, Proxies, UserAgent
Scanner	RHOSTS, THREADS
AuthBrute	USERNAME, PASSWORD, USER_FILE, PASS_FILE, STOP_ON_SUCCESS, etc.
Post	SESSION

Duplicates can cause warnings or unexpected overrides. Add only what is missing.

Advanced / evasion

Registration function	Where it appears
register_options	show options
register_advanced_options	show advanced
register_evasion_options	show evasion (HttpClient, etc.)

Moving rarely used timeouts or ForceExploit to advanced options keeps basic options readable.

Conditional options

New Opt classes can use conditions: to show an option based on another option. A simple required/default declaration is often enough to start.

Display at runtime

use exploit/linux/http/myapp_rce
show options
show missing
set RHOSTS 10.10.11.123
set TARGETURI /app/
set LHOST 10.10.16.10
run

Next, write the actual processing logic in Entry Methods.