When I'm setting the options for the reverse_https handler in metasploit why would I set ExitOnSession to false and SessionCommunicationTimeout to 0, and don't [fully] understand the purpose.
If SessionCommunicationTimeout
is 0:
setting this to 0 will result in a session that will never timeout, which has some interesting uses
It will keep connecting back using the connection to the HTTPS endpoint.
And why when ExitOnSession is false I can only use exploit -j and not exploit?
Because you need the handler to runcan continue running as a job, otherwise it would have to exit wheneven in the case of a closed, or failed meterpreter session had existed. It only applies to jobs(-j) as these are the only ones that run in normal foreground modethe background.
For more info, see here.