What does the multi-handler do in Metasploit?

• A. Scans the network for vulnerable hosts.
• B. Listens for a connection from the target system and delivers back a payload for that exploit to run.
• C. Logs the exploitation session to disk.
• D. Generates payloads on demand.

Answer: (B)

The multi-handler functions as a listener that waits for the target to connect back after a payload has been executed. When the payload on the target opens its reverse connection, the multi-handler accepts that connection and establishes an interactive session (such as Meterpreter or a shell) on your machine. It’s designed to handle different payloads and transports, acting as the rendezvous point for the reverse connection so you can interact with the compromised system.

It isn’t about scanning networks, logging exploitation events, or generating payloads on demand. Scanning is done by separate modules, logging can be handled by other features or tools, and payload generation is done by tools like msfvenom or the payload modules themselves, not by the handler.