Tagged Questions

In computing, C (/ˈsiː/, like the letter C) is a general-purpose programming language initially developed by Dennis Ritchie at bell labs Its design provides constructs that map efficiently to typical machine instructions

learn more… | top users | synonyms

2
votes
1answer
316 views

Is there a way to identify the client using SSL Handshake Messages?

I have an SSL Server and it can be connected by two types of Clients, one for which Client Authentication is needed and the other for which Client Authentication is not needed. Is there any mechanism ...
2
votes
2answers
353 views

vulnerable getlogin

I was reading "A taxonomy of Coding Errors" and I have a doubt regarding the point mentioned in C/C++ >> API Abuse >> Often Misused: Authentication(getlogin). I fail to understand the attack vector ...
3
votes
1answer
2k views

Why do I get “Cannot find bound of current function” when I overwrite the ret address of a vulnerable program?

I want to exploit a stack based buffer overflow for education purposes.There is a typical function called with a parameter from main which is given as input from the program and a local buffer where ...
5
votes
1answer
2k views

OpenSSL RAND_poll 'good enough'

We are using OpenSSL for generating IV's and other random data. We initialize it using RAND_poll and, on Windows, RAND_screen. The question is though, if the seed generated by those methods is good ...
11
votes
2answers
253 views

security implications of NULL dereference

Suppose we have code like this: struct somedata { int a; int b; }; struct somedata *data; /* ... */ data = malloc(sizeof(struct somedata)); data->a = something; Now, as you can see, NULL ...
16
votes
4answers
872 views

Does compiling from sources “kinda” protects from buffer overflow attacks?

While discussing buffers overflows, somebody told me that compiling your own binary for an application (with specific compilation flags) instead of using the "mainstream binary" makes it more ...
8
votes
1answer
2k views

Howto seed the PRNG in OpenSSL properly?

I am creating an application which runs on a mobile node with Ubuntu, which does not generate enough entropy bytes to the /dev/random, and does not always stay connected on the Internet to use typical ...
10
votes
7answers
3k views

Secure memcpy for pure C

Buffer overflows are nothing new. And yet they still appear often, especially in native (i.e. not managed) code... Part of the root cause, is usage of "unsafe" functions, including C++ staples ...
7
votes
8answers
396 views

Topics for SecureCoding course in C

So I was asked to put together a syllabus for a series of courses on the basics of secure coding, for a programming team. Though the time constraints are a bit... constraining, I'm working around ...