Skip to main content

​
query

Query and export data from the R4t SQLite database. Supports table-based queries with column filtering, WHERE clauses, and export to multiple file formats.
Note: The CLI command is r4t query (not r4t dbquery).

​
Usage

r4t query [flags]

​
Flags

FlagShortTypeDescription
--list—boolList all available tables and their columns
--table-tstringTable to query
--columns-cstringComma-delimited list of columns to display
--query-qstringWHERE clause (e.g., "sam LIKE '%admin%'")
--not-null-nstringComma-delimited columns that must be non-null/non-empty
--limit-LintMax number of results (default: 100, use 0 for no limit)
--raw-rstringRaw SQL query to execute
--out-ostringOutput file (extension controls format)
--max-width—uint32Max column width in table output (default: 50)

​
Output Formats

The output format is determined by the file extension given to --out:
ExtensionFormat
.jsonJSON array
.yamlYAML
.xmlXML
.csvCSV with header row
.txtPlain text table
.grepGrep-friendly key=value lines
If --out is not specified, results are printed as a table to stdout.

​
Examples

# List all tables and their columns
r4t query --list

# Query all credential records
r4t query --table credentials

# Show only specific columns
r4t query --table users --columns sam,dn,enabled,last_logon

# Filter with a WHERE clause
r4t query --table users --query "sam LIKE '%admin%'"

# Filter for non-null passwords
r4t query --table credentials --not-null password

# Combine filters
r4t query --table credentials --not-null password,hash --limit 20

# Export to JSON
r4t query --table adcs_vulnerabilities --out vulns.json

# Export credentials to CSV
r4t query --table credentials --columns sam,domain,password,hash --out creds.csv

# Raw SQL query
r4t query --raw "SELECT sam, dn FROM users WHERE enabled = 1 AND admin_count = 1"

# Raw SQL with export
r4t query --raw "SELECT * FROM adcs_vulnerabilities WHERE esc_type = 'ESC1'" --out esc1.csv

# No row limit
r4t query --table users --limit 0 --out all-users.csv

​
Available Tables

Run r4t query --list for the current schema. Key tables include:
TableContents
credentialsStored credentials (passwords, hashes, certs)
targetsStored target hosts
usersEnumerated AD users
computersEnumerated AD computers
groupsEnumerated AD groups
domainsDomain information
domain_controllersEnumerated DCs
adcs_vulnerabilitiesADCS ESC findings
certificate_authoritiesEnumerated CAs
certificate_templatesCertificate templates
kerberoast_hashesKerberoastable TGS hashes
asrep_hashesAS-REP roastable hashes
coercablesCoercible hosts
spraysSpray operation records
smb_sharesEnumerated SMB shares
dns_recordsADIDNS records
gposGroup Policy Objects
trustsDomain trust relationships
See Database for the full schema.