I have recently discovered a Buffer Overflow vulnerability that leads to Remote Code Execution. However, due to the structure of the application assessed, a lot of so-called 'bad chars' came up. The list is as follows:


It basically eliminated the whole uppercase alphabet A-Z, since the application turns these letters to lowercase.

The question is, is exploitation still possible in such a case? If so, what are the methods to achieve it?

  • 2
    I'm not quite clear what you are asking. Is your list a list of the characters used in the exploit? A list of characters that show up as a result of the exploit? Is this an attackers attempt to evade a WAF? Why not just fix the overflow vulnerability? Also, I don't think anyone can tell you whether or not it is still exploitable without knowing more about the code in question. Mar 18, 2020 at 14:47

1 Answer 1


It's impossible to tell whether this specific case is exploitable, but the answer is usually yes. Generating exploit code that avoids certain bad characters is a well-known problem with mature solutions. The exploit payload generator in Metasploit includes an encoding step which takes care of this: you tell it what characters to avoid and it builds a decoder that avoids these characters. You can try it out for yourself.

If you're new to this, keep in mind that just because you don't manage to build an exploit doesn't mean that there isn't one. A good black hatter can often find solutions even where Metasploit gives up.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.