Long Beard's Guide to Exploit Dev

Every time you hardcode a payload, God kills a zero day. On a daily basis we see standalone exploit code released in various languages, all using different option parsing and hardcoded shellcode (usually taken from msf anyway). Standalone exploits cannot possibly support all the complexities of flexible and reliable exploitation required in a professional environment. So please, stop writing shitty exploits.

This talk will cover some of the reasons why you should write your exploits in the Metasploit Framework including but not limited to:

• APIs for just about anything you can think of -- protocols, file formats, encryption, you name it
• Obfuscation and IDS/IPS/AV evasion
• Payloads and Encoders
• Community support (testing, maintenance, code review)
• Standardized option parsing -- everyone already knows how to 'set RHOST'