Path: blob/master/docs/metasploit-framework.wiki/Common-Metasploit-Module-Coding-Mistakes.md
24957 views
Deprecation notice!
Please see CONTRIBUTING.md for an authoritative coding guide. This document has fallen out of date. We don't write bad code any more! Hooray!
This is a collection of all the bad code we often see in Metasploit modules. You should avoid them, too.
Note: Some of these examples use puts() for demo purposes, but you should always use print_status / print_error when writing a module.
Bad Examples You Should NOT Follow:
- Not checking the return value of a Metasploit API 
- Ruby 1.9.3 vs 1.8.7... gotcha! 
- Not checking the return value when using match() 
- Not checking nil before accessing a method 
- Using exception handling to shut an error up 
- Not taking advantage of the 'ensure' block 
- Adding the 'VERBOSE' option 
- Neglecting to use 'vars_post' for send_request_cgi() when crafting a POST request 
- Bad variable naming style 
- Using global variables 
- Modifying the datastore during execution 
1. Not checking the return value of a Metasploit API
2. Ruby 1.9.3 vs 1.8.7... gotcha!
3. Not checking the return value when using match()
4. Not checking nil first before accessing a method
5. Using exception handling to shut an error up
6. Not taking advantage of the 'ensure' block
7. Adding the 'VERBOSE' option
8. Neglecting to use send_request_cgi()'s vars_post or vars_get when crafting a POST/GET request
9. Bad variable naming style
10. Using global variables
11. Modifying the datastore during execution