Handlers Lab-Only
Handlers listen for staged/reverse traffic — bind to YOUR lab listener only.
Visual · msf_handlers_lab
Handler pairs with payload. $LAB LHOST only. Original Cyberlium.
A handler without written scope is a trap for you and others.
exploit/multi/handler catches reverse connections from payloads you legitimately test on $LAB. set LHOST to your lab attacker VM address on host-only — never 0.0.0.0 on a laptop at a café. Multi-handler can catch several lab sessions; still not a pivot license.
1. Handler role
Payload executes → connects → handler completes session setup.
show options on handler: LHOST, LPORT, payload matching.
Command guide
Try these commands — Handler role
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Handlers — https://docs.rapid7.com/metasploit/working-with-payloads/ multi/handler — https://docs.rapid7.com/metasploit/running-metasploit-exploits/
═══ INSTALL ═══
Linux (Debian/Ubuntu): Kali: preinstalled, or: sudo apt install metasploit-framework
macOS: Prefer Kali/Linux VM — brew install metasploit (heavy)
Windows: Use Kali VM or WSL with metasploit-framework — not raw Windows host
═══ LINUX / macOS ═══
Handler config literacy — do NOT fire at strangers
Command — copy this
msfconsole -q -x 'use exploit/multi/handler; show options; back; exit' 2>/dev/null || echo 'Review LHOST/LPORT on loopback lab only'
Primary tools to practice this lesson: msfconsole. Reference sites: Handlers (https://docs.rapid7.com/metasploit/working-with-payloads/); multi/handler (https://docs.rapid7.com/metasploit/running-metasploit-exploits/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Lab-only bind rules
LHOST = your lab interface toward $LAB, not the internet.
Stop handler when lab ends. No overnight listeners on shared networks.
3. Defender view
Unexpected outbound to odd ports = alert material.
Document handler start/stop in lab notes for capstone.
4. What you ship: handler literacy
Handler purpose + LHOST lab bind + stop rule.
5. What you record before the next lesson
show options screenshot/note from handler on lab.
6. Wrong vs right: stranger hosts vs YOUR lab VM
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Run handler on 0.0.0.0 hoping someone connects.
- Right: Lab handler rules written. Next: payload lab.
Mission: handler options review
1) use exploit/multi/handler on lab. 2) show options — explain LHOST/LPORT. 3) Write stop-when-done rule.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Handler vs payload module?”
APPLY: Handler LHOST should be:
APPLY: True or False: 0.0.0.0 handler on café Wi-Fi is OK.
APPLY: Handler catches: