Option B: msfvenom; Option C: Write Your Own
- msfvenom (Metasploit): generates payloads for many platforms with built-in encoders and bad-char avoidance.
- Example concept: choose a payload, set
-bfor bad bytes, pick an output format. - Widely fingerprinted — easy for defenders to signature.
- Write your own: maximum control and stealth; smallest size; best learning value.
- Write assembly, assemble, extract
.textbytes, test in a tiny harness.
Key Takeaway
Generators are convenient but noisy; hand-written shellcode is smaller and less detectable — which is exactly why defenders study both.