Which statement describes the 'reverse_http' payload?

• A. Carries a session using outbound HTTP from the exploited system back to the attacker through the network & firewall.
• B. Creates an HTTPS tunnel.
• C. Uploads a shell via HTTP POST.
• D. Embeds the payload in HTTP headers.

Answer: (A)

This payload is about the compromised machine reaching back to the attacker over HTTP to maintain a live session. A reverseHTTP approach works by the infected host initiating outbound HTTP traffic to the attacker’s system, which lets the attacker send commands and receive responses through that same channel. This setup helps get around firewall rules that block incoming connections because the connection originates from inside the network.

That’s why the described action—carrying a session via outbound HTTP from the exploited system back to the attacker through the network—and through the firewall—is the correct match for reverse_http. It emphasizes the direction of the connection (outbound from the target) and the use of HTTP as the transport for the session.

The other options describe different techniques: creating an HTTPS tunnel implies a TLS-secured channel, which isn’t specific to the reverse_http behavior; uploading a shell via HTTP POST is about placing a shell on the server rather than maintaining a two-way control session; embedding the payload in HTTP headers is a method of concealment or delivery, not the ongoing bidirectional control that defines a reverse HTTP payload.