3

I'm looking for some good x86 linux binaries that cover most general vulnerabilities you would find while reversing. Does anyone have any good references to binaries that are public and available for offline analysis ?

Thanks!

-V

  • I see nothing wrong with the question. Perhaps the (expert??) person who gave the negative vote would like to come forward and point out the mistake with the question. – viv Mar 26 '14 at 10:50
  • To be honest this question does not show any research effort (valid reason for down voting). Any 10 minute Google attempt would give you some results from which one could work. Then one could come back and ask for more specific help and demonstrate ones 'failed' attempt(s) (research effort). It will also generate a primarily opinion based answer, although that should not be a reason to down vote but to close. – ixje Mar 26 '14 at 20:12
3

Pretty much every version of WU-FTPD is chock full of security vulnerabilities. Here's an archive of old versions: http://ftp.gwdg.de/pub/misc/wu-ftpd/ftp.wu-ftpd.org/wu-ftpd-attic/

3

You can try playing a few wargames. IO on the SmashTheStack network gives a pretty solid introduction to binary reversing and exploitation and their other wargames are pretty good too.

There is also OverTheWire , a successor to the much famed old PullThePlug wargame network, with their bag of different wargames. I'd recommend Vortex.

3

WeChall.net is a conglomeration of a lot of "hacking challenge" websites. And most importantly it has a point/ranking system. Because points always matter. It includes IO and SmashTheStack and OverTheWire. It also has a rating system for people who have completed the "challenge" which includes fun factor/educational/difficulty which I found useful when trying to find problems to do. The one caveat is you run into a lot of contrived examples (aka DEFCON bs, like shellcode goes through a bubble sort) though practice is practice.

MicroCorruption is a embedded CTF type website with a nice interface including interactive debugger that was put together by Matasano and Square. It focuses on embedded type systems and goes through the gamut of bugs but in an embedded environment (not x86, praise jesus)

Another option is to go through disclosed vulnerabilities from exploit-db. This obviously requires you to find proper versions of software but generally I've seen ways to obtain the software.

Not the answer you're looking for? Browse other questions tagged or ask your own question.