Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.
Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.
Path: blob/master/docs/metasploit-framework.wiki/Common-Metasploit-Module-Coding-Mistakes.md
Views: 11766
Deprecation notice!
Please see CONTRIBUTING.md for an authoritative coding guide. This document has fallen out of date. We don't write bad code any more! Hooray!
This is a collection of all the bad code we often see in Metasploit modules. You should avoid them, too.
Note: Some of these examples use puts() for demo purposes, but you should always use print_status / print_error when writing a module.
Bad Examples You Should NOT Follow:
Not checking the return value of a Metasploit API
Ruby 1.9.3 vs 1.8.7... gotcha!
Not checking the return value when using match()
Not checking nil before accessing a method
Using exception handling to shut an error up
Not taking advantage of the 'ensure' block
Adding the 'VERBOSE' option
Neglecting to use 'vars_post' for send_request_cgi() when crafting a POST request
Bad variable naming style
Using global variables
Modifying the datastore during execution
1. Not checking the return value of a Metasploit API
2. Ruby 1.9.3 vs 1.8.7... gotcha!
3. Not checking the return value when using match()
4. Not checking nil first before accessing a method
5. Using exception handling to shut an error up
6. Not taking advantage of the 'ensure' block
7. Adding the 'VERBOSE' option
8. Neglecting to use send_request_cgi()'s vars_get or vars_get when crafting a POST/GET request
9. Bad variable naming style
10. Using global variables
11. Modifying the datastore during execution