Does the metasploit module: exploit/multi/handler

  • sends payloads to stagers?
  • Or does it just listens for an incoming connection like a netcat listener?
  • Or does it do both, as needed?

1 Answer 1


It depends. The exploit/multi/handler is more of a stub for whatever payload handler you need to run. So whichever payload you select (with set payload ...) is responsible for doing whatever it needs, just like if you were running it from a regular exploit module.

So yes, from a multi-handler, any of the following could happen:

  • A simple socket listener/connection, like netcat (for plain shell payloads)

  • A handler for stager payloads that uploads Meterpreter (for meterpreter/* payloads)

  • A handler for single-stage (stageless?) Meterpreter (for meterpreter_* payloads)

  • Thank you! Very simply explained and informative!
    – 0x5929
    Nov 14, 2019 at 22:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.