Skip to main content
1 of 2
SilverlightFox
  • 34.4k
  • 6
  • 73
  • 192

When I'm setting the options for the reverse_https handler in metasploit why would I set ExitOnSession to false and SessionCommunicationTimeout to 0, and don't [fully] understand the purpose.

If SessionCommunicationTimeout is 0:

setting this to 0 will result in a session that will never timeout, which has some interesting uses

It will keep connecting back using the connection to the HTTPS endpoint.

And why when ExitOnSession is false I can only use exploit -j and not exploit?

Because you need the handler to run as a job, otherwise it would have to exit when the session had existed in normal foreground mode.

For more info, see here.

SilverlightFox
  • 34.4k
  • 6
  • 73
  • 192