> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/crto/cobalt-strike/beacon-payloads/staged-vs-stageless-payloads/payload-security.md).

# Payload Security

When first started, a Cobalt Strike team server will generate a new unique public/private keypair, and every stageless payload generated by that server will have the server's public key embedded into it. Beacon uses this key to encrypt its metadata when talking to the team server, ensuring that it can only communicate with the team server that it was generated from. In addition, every session key itself is transmitted inside the encrypted metadata, so that only the correct team server can encrypt and decrypt C2 traffic for a Beacon. The upshot of this is that you cannot easily man-in-the-middle a stageless payload to hijack control of it. However, due to their small size, stagers do not carry the same security. When executed, the stager will reach out to the host/port that it was configured with to receive the rest of the payload stage. There is no validation by the stager to ensure that it's talking to legitimate team server, which does make them susceptible to hijacking when first executed.