When I'm setting the options for the reverse_https handler in metasploit why would I set ExitOnSession to false and SessionCommunicationTimeout to 0, and don't [fully] understand the purpose.
If SessionCommunicationTimeout
is 0:
setting this to 0 will result in a session that will never timeout, which has some interesting uses
It will keep connecting back using the connection to the HTTPS endpoint.
And why when ExitOnSession is false I can only use exploit -j and not exploit?
Because you need the handler to run as a job, otherwise it would have to exit when the session had existed in normal foreground mode.
For more info, see here.