Mastering Metasploit - Third Edition

Determining bad characters

Sometimes it may happen that after setting up everything correctly for exploitation, we may never get to exploit the system. Alternatively, it might happen that our exploit executed successfully, but the payload fails to run. This can happen in cases where the data supplied in the exploit is either truncated or improperly parsed by the target system, causing unexpected behavior. This will make the entire exploit unusable, and we will struggle to get the shell or Meterpreter onto the system. In this case, we need to determine the bad characters that are preventing the execution. We can avoid such situations by finding matching similar exploit modules and use the bad characters from them in our exploit module.

We ...