Skip to main content
Information Security

Questions tagged [buffer-overflow]

Ask Question

A buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory.

513 questions
Newest Active Bountied Unanswered
Filter by
Sorted by
Tagged with
0 votes
0 answers
667 views

I am trying to do a buffer overflow on 64-bit Kali VM. When I execute the program and inject the NOP sled + shellcode + return address, the shell does not execute. I think it might have something to ...
malpa's user avatar
  • 1
4 votes
2 answers
347 views

I am practicing a function return address overwriting exploit. However, the program instruction pointer instead gets overwritten by gibberish. I have tried compiling with -fno-builtin and -fno-...
Stone True's user avatar
  • 2,032
2 votes
1 answer
881 views

I am a student in networking, we learn cybersecurity, but we don't learn buffer overflow vulnerabilities in depth, I understand how it works, but I don't understand how an hacker can detect this ...
init_first's user avatar
  • 55
5 votes
1 answer
15k views

I'm new to buffer overflow exploitation. I've written a simple C program which will ask the user to input a string (as a password) and match that string with "1235". If matched then it will ...
Abhirup Bakshi's user avatar
  • 197
0 votes
2 answers
204 views

I understand how this exploits work on the theoretical level, but I can't find detailed worked tutorials that show for example how to overwrite the return adress in the stack when overflowing a given ...
hehehe's user avatar
  • 29
-1 votes
1 answer
2k views

I was trying to solve SEED security lab regarding buffer overflow attack but in that exercise we get buffer address and ebp and thus offset of it. so we are able to guess where the return address is ...
John's user avatar
  • 21
0 votes
1 answer
241 views

I am writing an app that serves images to clients. The app is written mostly in python. I store the images in AWS s3 and serve the clients them directly from there. Am I vulnerable to buffer overflow ...
Dr J's user avatar
  • 1
0 votes
2 answers
754 views

People say buffer overflows are serious security bugs that can usually be exploited. Here is an artificial buffer overflow #include <stdio.h> int main(){ int a[3]={0,1,2}; printf("...
zell's user avatar
  • 125
1 vote
1 answer
1k views

I recently was studying x86 buffer overflows + ret2libc attacks from https://www.ret2rop.com/2018/08/return-to-libc.html and I noticed the order is as follows: bytes to fill buffer + address of system ...
asd_665's user avatar
  • 13
0 votes
0 answers
1k views

Note: this is extra credit for a homework assignment I'm trying to figure out how to call win() via stdin. I assumed that the vulnerability would be exploited by a buffer overflow, but I can't even ...
Smiley's user avatar
  • 1
1 vote
1 answer
445 views

I am working on exploiting an application on MIPS to further my knowledge of ROP chaining. The library I am trying to build a ROP chain is libuClibc-0.9.30.3.so. I found a gadget that I want to use ...
joshu's user avatar
  • 121
1 vote
0 answers
108 views

Background In practicing pentesting a VM on Vulnhub I encountered an issue that is quite interesting with Brainpan. After initial access with a limited shell generated from a BoF exploit on a service ...
0x5929's user avatar
  • 375
0 votes
1 answer
858 views

Needless to I say I have no idea how to do this. I'm performing a pentest and I found an exploit related the box : https://www.exploit-db.com/exploits/44298 In the exploit comments, the author said : ...
steven miller's user avatar
  • 3
0 votes
0 answers
255 views

Let's consider a stack that grows downwards and a function that has a local variable for a buffer that takes 100 bytes of memory. So, reading from top to bottom, it would be a 4-byte long return ...
theodosis's user avatar
  • 101
31 votes
2 answers
9k views

I'm a listener of the podcast "Security Now" where they often claim that there are no reasons to limit the number of characters a user can use in their passwords when they create an account ...
Thomas's user avatar
  • 420
2 votes
2 answers
684 views

I'm currently practicing buffer overflows, but there is one thing I don't understand yet. I have read this similar question. I understand that if you don't know the address of ESP you must look for an ...
Maikkeyy's user avatar
  • 257
7 votes
1 answer
1k views

I am trying to exploit a bufferoverflow on raspberry pi 4 which makes use of Cortex-A72 (ARM v8) 64-bit SoC. The linux kernel version is v4.19 and the OS a Debian Buster compiled for the raspberry pi ...
Safe'nSound's user avatar
  • 71
0 votes
1 answer
543 views

I am attempting to overwrite the eip of a binary (in order to perform a ret2libc attack). The program has full relro, PIE and NX. Here's my thought process. First I try this, I input "C"*260 + "...
elmuscovado's user avatar
  • 3
1 vote
0 answers
138 views

I am trying to understand how a SEH based buffer overflow is working and I have to write a paper about how an exploit works. I took this PoC for my paper. junk = "\x41" * 4091 nseh = "\x61\x62" seh ...
Bnr's user avatar
  • 11
0 votes
1 answer
693 views

I'm doing a buffer overflow challenge, and I can't understand what exactly I'm doing wrong. Through debugging, I managed to figure out how my input should look like such that I can force the program ...
Ayumu Kasugano's user avatar
  • 101
1 vote
1 answer
2k views

As a home exercise I'm trying to achieve buffer overflow attack by running a simple char array program that stores the input argument in the program stack and then overflowing that stack with long ...
Sinipelto's user avatar
  • 113
0 votes
3 answers
1k views

I have an interview where I am expecting to have to review some vulnerable C code and point out the vulnerability(s). I am by no means a C developer, but I do know that the common vulnerabilities are ...
Hysii's user avatar
  • 249
1 vote
1 answer
423 views

I have recently discovered a Buffer Overflow vulnerability that leads to Remote Code Execution. However, due to the structure of the application assessed, a lot of so-called 'bad chars' came up. The ...
Vilius Povilaika's user avatar
  • 1,012
1 vote
0 answers
1k views

I am trying to complete level 3 of buffer bomb lab. The task is to supply an exploit string that will cause getbuf to return my cookie (0x4b64b076) back to test, rather than the value 1. The exploit ...
Helen Grey's user avatar
  • 111
1 vote
1 answer
1k views

struct record { char name[24]; char * message; }; int main() { puts("GOT Overwrite"); // Create the struct record struct record student; strcpy(student.name, "Alice"); student.message = (char *) ...
Revinous's user avatar
  • 11

1
2
3 4 5
…
11