Metasploit › Module 3 › Lesson 2
Payload Encoder
Payloads are what runs; encoders reshape bytes — read docs, do not spray encoders at strangers.
Visual · msf_payload_encoder
payload/ and encoder/ types. Original Cyberlium.
Opening
Payload is the job; encoder is packaging — neither grants target permission.
Payload modules (`windows/x64/meterpreter/reverse_tcp`, etc.) define what executes after success. Encoders (`x86/shikata_ga_nai`, etc.) mutate encoding to evade bad signatures — a defender topic as much as an attacker one. Cyberlium stays at naming and docs; generation against $LAB comes in later modules. Next: Post and Nop.
1. Payload families
Single vs staged, bind vs reverse, platform tags — literacy prevents picking a Linux payload for a Windows lab by mistake.
Handlers listen for callbacks — only on lab networks you control.
Command guide
Try these commands — Payload families
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Payload docs — https://docs.rapid7.com/metasploit/working-with-payloads/ Encoder overview — https://docs.rapid7.com/metasploit/msf-overview/#module-types
═══ INSTALL ═══
Linux (Debian/Ubuntu): Kali: preinstalled, or: sudo apt install metasploit-framework
macOS: Prefer Kali/Linux VM — brew install metasploit (heavy)
Windows: Use Kali VM or WSL with metasploit-framework — not raw Windows host
═══ LINUX / macOS ═══
Command — copy this
msfconsole -q -x 'search type:encoder; search type:payload name:reverse; exit' 2>/dev/null || echo 'Encoders obfuscate — not auth bypass'
Primary tools to practice this lesson: msfconsole. Reference sites: Payload docs (https://docs.rapid7.com/metasploit/working-with-payloads/); Encoder overview (https://docs.rapid7.com/metasploit/msf-overview/#module-types). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Encoders
Encoders trade size and compatibility for evasion. AV vendors study them; defenders write YARA and behavior rules.
Using encoders against unauthorized targets is still unauthorized — evasion is not consent.
3. Ethics
No msfvenom spam to classmates. No 'FUD' bragging on real networks. Lab-only generation later under RoE.
4. What you ship: payload vs encoder one-liners
Payload = executes. Encoder = transforms bytes. RoE required. chmod 600.
5. What you record before the next lesson
Date. One-liners. File t14-m03-l02-payload-encoder.txt chmod 600.
6. Wrong vs right: stranger hosts vs YOUR lab VM
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Generate encoded payloads and email them to 'test friends.'
Right
Define terms. Next: Post and Nop.
Mission: define payload and encoder
1) Write payload definition. 2) Write encoder definition. 3) Note defender detection angle. No msfvenom execution yet.
Stuck? Ask Cyberlium AI Mentor
Encoders change bytes, not authorization.
Knowledge Check
APPLY: Payload modules define:
Multiple choice
Knowledge Check
APPLY: True or False: Encoders remove the need for written RoE.
True or False
Knowledge Check
APPLY: Defenders study encoders to:
Multiple choice