Linked Questions
17 questions linked to/from How do ASLR and DEP work?
0
votes
1
answer
4k
views
How to bypass DEP and ASLR at the same time? [duplicate]
I have read some articles about bypassing DEP and ASLR , but it seems that they bypass ASLR and DEP by using the instructions in the modules not applying ASLR.But how to bypass ASLR and DEP in the ...
- 11
1
vote
1
answer
576
views
How non-executable are implemented? [duplicate]
In the "Hacking the art of Exploitation" its said that the basic idea of stack overflows attacks is that the operating system can't differentiate instructions from data inside the stack ,and the ...
- 1,218
0
votes
0
answers
51
views
How does ASLR work [duplicate]
I have read about ASLR and understand that it randomizes the location in memory where an executable is loaded every time it is run.
But I have a doubt, take an example of an elf executable. It tells ...
- 1
99
votes
3
answers
111k
views
Stack Overflows - Defeating Canaries, ASLR, DEP, NX
To prevent buffer overflows, there are several protections available such as using Canary values, ASLR, DEP, NX. But, where there is a will, there is a way. I am researching on the various methods an ...
- 4,330
13
votes
3
answers
4k
views
Why is it dangerous when an attacker can control the `n` parameter to `memcpy()`?
I was reading a paper and saw this piece of code has an information leakage vulnerability. It was saying the following code will Leak memory layout information to the attackers
Could somebody please ...
- 366
19
votes
2
answers
25k
views
How "leaking pointers" to bypass DEP/ASLR works
I was wondering if anyone could give me some clues on how "leaking pointers" to bypass DEP/ASLR work. I read here:
The only way to reliably bypass DEP and ASLR is through an pointer
leak. This is ...
- 509
14
votes
2
answers
3k
views
What are the criteria to choose a secure operating system?
Let's say I have a new and empty desktop or laptop computer and I want to decide which operating system to use. I plan to use this computer in a small home LAN with internet access. There are other ...
- 8,021
7
votes
2
answers
4k
views
How stack smashing is prevented?
I just read AlephOne's paper on smashing the stack, and implemented it on my machine (Ubuntu 12.04), it was a bit old so had to take a lot of help from the internet but I enjoyed it.
Now, I want to ...
- 227
4
votes
2
answers
1k
views
How does exploit development work for penetration testers?
When doing exploit development, the process always relies on memory address from the victim's machine.
As an exploit developer, you will have to setup an environment of attacker\victim machines and ...
- 998
1
vote
4
answers
473
views
Is there a need to define "language safety"?
Language safety is not clearly defined while there're warnings about for instance Java. So how can you say that language is not safe while language safety is not clearly defined? If Java is unsafe now,...
2
votes
2
answers
9k
views
How safe is it to disable DEP for a program?
I've been playing a game and there is a private server (with around 2k population) that asks us to turn off DEP for their game, I read about what it does but I don't understand what the consequences ...
- 35
6
votes
1
answer
1k
views
Hardware enforced DEP on different CPUs
Are there any differences how hardware DEP is implemented on CPUs from different manufacturers (Intel, AMD, nVidia, Texas,...)?
Are there any significant differences how hardware DEP works on x86 ...
- 2,822
0
votes
1
answer
2k
views
Why are stack address the same all the time when not using ASLR? [closed]
In an answer to How do ASLR and DEP work? Polynomial says:
In a non-ASLR and non-DEP process, the stack address is the same every time we run the process. We know exactly where it is in memory.
I ...
- 219
1
vote
1
answer
1k
views
how to circumvent ASLR without pointer leaks
is there way to circumvent ASLR without pointer leaks, I mean i read many exploit development course Syllabus and many of them talk about bypass ASLR without pointer leaks, Does anyone can explain to ...
- 41
2
votes
1
answer
390
views
Defeating code injection attacks in x86
In x86 systems, there are three requirements for a code injection attack to work:
write attack payload to memory
attack payload to be executable
divert control-flow to payload
How can we prevent 2) ...
- 739