Targets

R4t maintains a list of target hosts in its SQLite database. A single target can be set as the default (“active target”) so you don’t have to specify --ldap-server or a target hostname on every command.

The `targets` Command

r4t targets <subcommand> [flags]

Subcommands

`targets add`

Add a target to the database.

# Add by IP address
r4t targets add 10.10.10.10

# Add by hostname
r4t targets add dc01.corp.example.com

# Both can be stored on the same record
r4t targets add 10.10.10.10 dc01.corp.example.com

Targets are stored in the targets table in SQLite with an auto-incremented ID, IP address, DNS hostname, and optional notes.

`targets list`

List all stored targets.

r4t targets list

Output includes: ID, IP, DNS Hostname, Notes, and whether the target is the currently active default.

`targets set`

Set a target as the default (active) target. The active target is stored in the Badger KV store (cfg:target) and used automatically by commands that need a target server.

r4t targets set 1

Takes the numeric ID from targets list.

`targets remove`

Remove a target from the database.

r4t targets remove 1

How Targets Are Used

When a command needs to connect to a server (LDAP, SMB, RPC, etc.), it resolves the target in this order:

--ldap-server / explicit server flag — inline override takes highest priority
--target-id flag — use a specific stored target by ID
Active target — the target set via targets set (retrieved from Badger)
Domain-based DNS resolution — if no target is stored, resolve the domain’s DC via DNS SRV records

This means once you run r4t targets set 1, you can run subsequent commands without specifying a server:

# Set target once
r4t targets add 10.10.10.10
r4t targets set 1

# Now all commands use 10.10.10.10 automatically
r4t ldap get users
r4t adcs find
r4t bloodhound collect

Target Data Model

type Target struct {
    ID          uint      // Auto-incremented primary key
    IP          string    // IPv4 address
    DNSHostname string    // DNS hostname (e.g., dc01.corp.example.com)
    Notes       string    // Operator notes
    CreatedAt   time.Time
    UpdatedAt   time.Time
    DeletedAt   *time.Time // Soft delete
}

Targets support soft deletion — removing a target marks it as deleted without erasing the database row.

Using a Specific Target Inline

You can bypass the stored default and use a specific target by ID or by flag:

# Use target ID 3 for this command
r4t ldap get users --target-id 3

# Specify server directly
r4t ldap get users --ldap-server 10.10.10.20

Per-Engagement Isolation

If you use local DB mode, each engagement directory maintains its own target list. This prevents target lists from different engagements from mixing:

cd ~/engagements/client-a
r4t set --local-db true
r4t targets add 192.168.1.10

cd ~/engagements/client-b
r4t set --local-db true
r4t targets add 10.0.0.5

​Targets

​The targets Command

​Subcommands

​targets add

​targets list

​targets set

​targets remove

​How Targets Are Used

​Target Data Model

​Using a Specific Target Inline

​Per-Engagement Isolation