I am reading brute-forcing stack canary. But I am confused why the server can be brute-forced one byte at a time on a crashable-server and what does mean this fork-and-accept ?
A common mistake, while programming a server, is to use a
fork() to start it and respawn it when it crashes.
The problem with a
fork() is that is uses a copy of the memory to start over. Of course, using a copy means that the respawned server will be stuck with the exact same canaries even if it has been crashed and respawn. Somehow, it's memory layout and it's canaries are frozen until it is really re-run from the executable file.
The good way to program a server would be to systematically use an
execve() in place of the
fork(). This ensure that the memory start from scratch an re-initialize all the memory settings (ASLR, canaries, and so on).
But, indeed, most of the servers in the wild are using an
execve(), we can only find
fork() on old implementations or on educational security challenges.