How to get it right the first time – generating payloads

We've probably all seen some people who get their hands on Metasploit and start pulling the trigger. If you're in your lab at home and are just watching what happens, that's fine; do that on a professional assessment and you're likely to get caught, setting off alarms without even getting anywhere. After all, pen testing isn't about hacking a sitting duck—your client will have defenses that, for the most part, will be good. If your client isn't good at prevention, they'll probably be good at detection, and poorly-crafted payloads hitting random IPs is a no-brainer for a defender. With this in mind, we need to learn how to craft our payloads according to the task at hand to maximize our success. The more successful we are, the more value we can bring to our client.

...