When working with Metasploit in a test or learning environment, there are moments when you don’t need to launch a full exploit — you just need to be listening.
That’s where a handler comes in.
A handler is essentially Metasploit sitting patiently in the background, waiting for a connection from a payload that’s already been executed elsewhere. This is especially useful in labs when you’re testing reverse connections or experimenting with payload behavior.
Let’s break down what a handler does and how it’s typically started.
What Is a Metasploit Handler?
A Metasploit handler is a listener that waits for incoming connections from payloads — most commonly reverse shells or Meterpreter sessions.
In simple terms:
-
The payload runs on the target system
-
The handler runs on your machine
-
When the payload executes, it “calls home”
-
The handler catches that connection and opens a session
Handlers are commonly used in:
-
Home labs
-
Training environments
-
Penetration testing practice setups
Launching Metasploit
The first step is to start the Metasploit console:
This loads the Metasploit Framework and gives you access to its modules, payloads, and handlers.
Using the Multi/Handler Module
Metasploit includes a built-in module specifically designed for this purpose: multi/handler.
Once inside msfconsole, the typical flow looks like this:
This tells Metasploit that you want to start a listener rather than fire off an exploit.
Matching the Payload
The handler must be configured to match the payload that will connect back to it. For example, if you’re expecting a Windows Meterpreter reverse TCP connection, you’d set:
This step is critical — if the payload type doesn’t match, the connection won’t work.
Setting the Listening Address
Next, you define where Metasploit should listen:
-
LHOST — the IP address of your machine
-
LPORT — the port number the payload will connect to
For example:
These values must match exactly what was used when the payload or backdoor was created.
Starting the Handler
Once everything is set, launching the handler is as simple as:
At this point, Metasploit begins listening and you’ll see output confirming that the reverse handler is running.
From here, Metasploit waits — as soon as the payload executes and connects back, a session is opened automatically.
A Quick Reality Check
Handlers don’t magically create access on their own. They simply wait for connections. If nothing ever connects back, nothing happens — which makes them perfect for controlled testing and learning scenarios.
As always, tools like Metasploit should only be used in:
-
Environments you own
-
Labs you control
-
Explicitly authorised test systems
Wrapping Up
Starting a handler in Metasploit is one of those foundational skills that makes everything else click. Once you understand that Metasploit can just listen — not always attack — a lot of workflows suddenly make more sense.
Clean, simple, and incredibly useful for lab work.