I'm doing a lot of learning about buffer overflows, and BROP. My problem is how can I test against real software in the lab? I can find a lot of CVE's that contain sever bugs that are open to a buffer overflow attack but no way of testing. By default installing these on my own server will have buffer overflow protections enabled.

I've created my own software to test against. That's easy, but I want to test against something real.

Any ideas?


There's VMs available which include security challenges, as well as old CTF write-ups covering exactly how specific buffer overflows were triggered.

Here's one I found with a quick Google.

A VM called covfefe, and a Walkthrough which includes a buffer overflow.

This is just an example that there's tons of VMs and challenges out there for you to try. Jumping to exploiting real world programs is going to include a lot of protections that may make it difficult to compromise before you're sufficently experienced.

  • Awesome. I didn't know about these VM's. Any recommended places to bookmark? I have been interested in CTF for a while but have no idea how to get involved. – BugHunterUK Oct 20 '18 at 14:37
  • 1
    CTF Time is my go to site for all the CTFs going on world wide. Many can be done over the internet, but I like the in person ones as I usually learn more from team mates ctftime.org – Daisetsu Oct 20 '18 at 17:00
  • 1
    The website I linked to on my answer (VulnHub) has a lot of VMs. Here's a short list of some of the more common ones though pdrcybersecurity.com/10-sites-find-vulnerable-vms-testing – Daisetsu Oct 20 '18 at 17:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.