0

When I do CTFs, I can usually cope well with and understanding everything pretty much apart from buffer overflows, binary exploitation and reverse engineering

Almost to the point that I would consider myself having zero knowledge at all. I grasp the concept at the very most basic of levels and by that I mean I can operate a mouse and keyboard

Is there anywhere that takes you from zero to hero? I'm currently doing CTFs on https://0x0539.net/ and have done most of them apart from reverse engineering ones.

https://liveoverflow.com/ is a decent start I believe but was wondering where there was a book, an online resource that as I say, could take me from zero to hero

I understand there's a "stack" and "memory" and "assembly language" and then after that... nothing.

Specifically - I would like to get to a point where I come across a related challenge in a CTF and at least know where to start, where to go and how to complete it

Thanks

  • 1
    Have you read the Wikipedia article about Buffer Overflows? If so, what exactly is it that you don't understand? Your question is too broad as it is, so I am trying to help you focus it a bit more – MechMK1 Dec 7 '19 at 15:30
  • How to utilise this knowledge in CTFs basically. Using IDA, R2, GDB etc – pee2pee Dec 7 '19 at 15:35
  • Then please show a specific challenge you struggle with. – MechMK1 Dec 7 '19 at 15:54
  • All of them on 0x0539.net but specifically 0x0539.net/play/fangorn > "Rock Paper Scissors" and also "Go Ahead Crack Me". Rock paper Scissors, for example, takes an input where you give it a length of your name, second input is your name, it then prints your name and you play the game (where you lose). If you put in a value of 1 and put name as Jo, it outputs Jo. If you put length in as -1 and 23 characters as your name, it outputs all 23.... – pee2pee Dec 7 '19 at 16:18
  • Try the "Software Security" course from Michael Hicks / Maryland University on Coursera. It's got plenty on C-language-level security and the stack, well explained. Whatever you do do not spend your time on the Hardware Security course, in my opinion it was abysmally bad with the Usable Security being just "fair". Cryptography was fine, close to Cryptography I from Stanford really - slightly different take. – Maarten Bodewes Dec 7 '19 at 16:49
2

I think the standard, at least back in the 90's was "Smashing the stack for fun and profit" from phrack magazine.

Not the answer you're looking for? Browse other questions tagged or ask your own question.