Payload
A payload is the component of a cyberattack that performs the malicious action after a vulnerability has been exploited, such as executing commands, installing malware, or exfiltrating data.
In cybersecurity, a payload refers to the part of an attack that carries out the intended malicious action once an exploit has successfully compromised a target system. While the exploit is the mechanism used to breach security controls, the payload is what the attacker delivers through that breach. The payload determines what ultimately happens on the compromised system.
Payloads come in many forms depending on the attacker's objectives. A reverse shell payload establishes a command-line connection back to the attacker, providing interactive access to the compromised system. A bind shell opens a listening port on the target for the attacker to connect to. Meterpreter, a widely used payload in the Metasploit framework, provides an advanced interactive shell with capabilities for file system access, network pivoting, privilege escalation, and post-exploitation activities.
In the context of malware, the payload is the malicious code that performs the primary function of the malware. For ransomware, the payload is the encryption routine that locks files. For a banking trojan, the payload might be form-grabbing code that steals credentials. For a botnet agent, the payload establishes command-and-control communication and awaits instructions.
Understanding payloads is essential for both offensive security professionals conducting penetration tests and defensive teams building detection capabilities. Security tools like web application firewalls (WAFs), intrusion detection systems (IDS), and endpoint protection platforms use signature-based and behavioral analysis to detect known payload patterns and block malicious activity before it executes.