Collaborate Disseminate
I have successfully overwritten the EIP register (pointing to my shellcode) but the shellcode is not executing. I compiled with the command
gcc -g -fno-stack-protector -z execstack -no-pie vuln.c -o vuln
Here’s the output of gdb-peda … Continue reading EIP pointing to shellcode but shellcode is not executing?
So I started to learn reverse engineering, and I came across the ret2libc exploit.
I tried to understand how it works and I got a bit confused.
They say that when you return to the address of system you then need to give 4 … Continue reading ret2libc – why need 4 bytes of garbage
Since buffer overflows always let an evil hacker write outside the buffer and overwrite the return pointer to a shellcode the evil hacker can place, does it mean that successful exploitation of a stack buffer overflow always … Continue reading Does a buffer overflow vulnerability always mean a code execution vulnerability?
I wrote a vulnerable test program to practice buffer overflows; however, I was having trouble getting it to work. Finally, after slightly modifying the return address, I was able to gain a shell, but I don’t understand why this small, seem… Continue reading Why Does Only 1 Of These 2 Almost-identical Payloads Give Me A Shell?
Listen to the latest episode now! Continue reading S2 Ep 13: Weird Android zero day and other tech fails – Naked Security podcast
can anyone tell me that What is the concepts of secure return address stack and secure cache?
Continue reading What is the concepts of secure return address stack and secure cache?
It’s the time-saving technique employed by many coders – copy and paste code from crowd-sourcing ‘Q&A’ websites. But is it always secure? Continue reading Copy-and-paste sharing on Stack Overflow spreads insecure code
While I was studying ret2libc, I saw that tutorials use:
call_to_function + ret addr + arguments
For example I understand that if I want to execute system function from libc I can use the following scheme:
system_address… Continue reading ret2libc calling function arguments order
I was reading the wikipedia article on this subject and it states that when a program starts, the canary is calculated at random, stored in a local variable(which I presume was introduced by the compiler) and is padded by un… Continue reading How are stack canaries padded by unmapped pages?
[ I’ve disabled the image that normally was here, to fit the ethics of Information Security]
23:40pm #20112000