DEFINITELY DEFINITELY DEFINITELY recommend installing a local copy of whatever you find and testing your own payloads on it. (as some others have mentioned)
Also helps to read what the bad characters are (I think I wasted an hour or two wondering why nothing was working…). I used the python script.
My first attempt doing it on the box ( after figuring stuff out locally) went off flawlessly.