3

I'm looking for some really small apps on Ubuntu for some bufferoverflow exploitation training.

I don't want to start off with some huge apps.

I know some sites like http://www.oldversion.com.de/ where i could start but most of the apps are just to big or too hard to exploit for a beginner or just not available for linux. Most of the tutorial on the Internet or windows based.

Do you know any app where i could start playing around? Which debugger do usually people use on ubuntu?

As a .NET dev i already have the theoretical knowledge for exploits, but I need to do it myself to understand it better.

2

There are plenty of apps i think, you can get old (vurnable) applications from www.oldapps.com. Then once there was Damn Vurnable Linux. Or Badstore: www.badstore.net then we have exploit training: exploit-exercises.com or Pentester lab: www.pentesterlab.com. Then there is Damn Vurnable webapp: www.dvwa.co.uk and what i like the most (windows) is vurnable server: www.thegreycorner.com/p/vulnserver.html‎. Vurnable server you could run on linux when using wine (did not test this by myself). The debugger of choice on Linux Gnu Debugger (gdb www.sourceware.org/gdb/‎). Also in the view of the fact that exploits get more and more sophisticated i have to mention exploit development is allways hard.

Kind regards,

Dirk

  • Thank you very much. Just one more question, and i will accept your answer: Is there a good debugger with a gui like Ollydbg or ummunitydbg for linux & x64 system? – Teko Apr 27 '14 at 21:55
  • Hey there no problem, there are some for gdb (afaik is gdb the only really good debugger in linux) it has some front ends like ddd: www.gnu.org/software/ddd/ , you can also use gdb within emacs or eclipse (extra config steps might needed) then there is a terminal interface for gdb cgdb.github.io . Unfortunaly there are no such pretty debuggers like in windows (i prefer immunitydbg). But this helps at start: stanford.edu/class/cs107/other/gdbrefcard.pdf – Dirk Apr 28 '14 at 5:31
2

Try going through the extensive list on OWASP Vulnerable Web Applications Directory Project.

Some of them I know and have played with:

  • Google Gruyere
  • Damn Vunerable App

But some of ASP.NET specific ones include SPI Dynamics (live), Watchfire (live), Acunetix 2 and 3 (live), HackmeBank, and OWASP SiteGenerator. Hope this helps!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.