Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options user 53

Using techniques to change the behavior of an application or application component in order to use it to ones advantage. When used it is often referred to software exploitation where an attacker can take control of an applications execution flow in order to run arbitrary code.

2
votes
This should be 0xdeadbeef (dead beef), because it is a word that can be spelled in hexadecimal characters. We usually call this Hexspeak. Other well knowns hexadecimal words are 0xcafebabe or 0xd15e …
answered Jun 24 '14 by perror
1
vote
1answer
I recently heard that using Java inner classes in a class that enclose sensitive information is causing the private data of the class to be changed to protected at the bytecode level (meaning that any …
asked Sep 26 '14 by perror
3
votes
First, you really need to set a breakpoint somewhere if you want gdb to stop before the program end. Then, you should really try to use peda, a set of configuration and Python scripts for gdb designe …
answered Nov 3 '14 by perror
3
votes
If the program is setuid, you can use the fact that it is calling the command ls -al /tmp through system() from the main() function. Create a file ls which contains: #!/bin/sh /bin/sh Set it as an …
answered Mar 19 '18 by perror
4
votes
Yes, all the opcodes ending by a ret can be considered as a gadget. But, consider also the fact that not only legal instructions can be considered as gadget, also 'starting in the middle of an instruc …
answered Apr 9 '14 by perror
0
votes
Because, this technique would require to rewrite the code of the program... And, most of the time, you cannot rewrite the .text section... You only have access to the data stored in the stack and/or …
answered Sep 23 '14 by perror
5
votes
In fact, the memory layout within gdb and outside of it differs of a few bytes. There have been recently a question about this here. You can read: How to predict address space layout differences betwe …
answered Nov 1 '13 by perror
2
votes
I guess that you won't be happy if, while analyzing a malware, a certain pattern in the executable binary makes Hex-rays connect to an evil server somewhere in the World with your account and download …
answered Oct 14 by perror
5
votes
Because the operating system is initializing ESP always at the same value (and that the execution of the program you look at are deterministic). The way the ASLR (Address-Space Layout Randomization) …
answered Aug 19 '14 by perror
9
votes
In fact, the CPU are much more checked and verified than programs. It is very unlikely to find a (significant) bug in a CPU. Even though it happens from time to time. Therefore, it is much more inter …
answered Sep 8 '17 by perror
5
votes
1answer
I am looking for a complete list of the ways to inject a payload in a vulnerable program in a Unix (Linux) context depending on the inputs opened by the program. I know that there are several tricks …
asked Nov 14 '16 by perror
12
votes
First of all, I have bad news for you ! Doug Lea's malloc is almost no more used in any C library implementation (even if understanding dlmalloc can help a lot to understand new ones). The new implem …
answered Dec 5 '13 by perror
1
vote
A common mistake, while programming a server, is to use a fork() to start it and respawn it when it crashes. The problem with a fork() is that is uses a copy of the memory to start over. Of course, u …
answered Jan 21 by perror
14
votes
another terminal. Keep the stdin open after injection Most of the techniques for stdin will send the exploit string to the program which will end shortly after the termination of the input. The best …
answered Nov 14 '16 by perror