Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I found this reference to bypass canaries: http://sota.gen.nz/hawkes_openbsd.pdf

It recommends to brute force the canary byte-for-byte. I don't understand how this works: "Technique is to brute force each byte of the canary individually along with time analysis". How can you do time analysis on a byte-for-byte basis? Isn't the whole canary compared at once? I thought that the the four bytes were compared with only one instruction.

This attack is also referenced in http://www.phrack.org/issues.html?issue=67&id=13

share|improve this question

1 Answer 1

up vote 3 down vote accepted

The idea is to control the length of your attack so you only overwrite the first byte of the canary. You can then brute force the 256 possible values for this byte, and using some kind of side-channel figure out which is correct. Once you've got this, you can brute force the second byte, and continue until you've got the whole canary.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.