Linked Questions

0
votes
1answer
3k views

How to bypass DEP and ASLR at the same time? [duplicate]

I have read some articles about bypassing DEP and ASLR , but it seems that they bypass ASLR and DEP by using the instructions in the modules not applying ASLR.But how to bypass ASLR and DEP in the ...
1
vote
1answer
343 views

How non-executable are implemented? [duplicate]

In the "Hacking the art of Exploitation" its said that the basic idea of stack overflows attacks is that the operating system can't differentiate instructions from data inside the stack ,and the ...
85
votes
3answers
88k views

Stack Overflows - Defeating Canaries, ASLR, DEP, NX

To prevent buffer overflows, there are several protections available such as using Canary values, ASLR, DEP, NX. But, where there is a will, there is a way. I am researching on the various methods an ...
13
votes
3answers
3k views

Why is it dangerous when an attacker can control the `n` parameter to `memcpy()`?

I was reading a paper and saw this piece of code has an information leakage vulnerability. It was saying the following code will Leak memory layout information to the attackers Could somebody please ...
18
votes
2answers
20k views

How “leaking pointers” to bypass DEP/ASLR works

I was wondering if anyone could give me some clues on how "leaking pointers" to bypass DEP/ASLR work. I read here: The only way to reliably bypass DEP and ASLR is through an pointer leak. This is ...
11
votes
2answers
1k views

What are the criteria to choose a secure operating system?

Let's say I have a new and empty desktop or laptop computer and I want to decide which operating system to use. I plan to use this computer in a small home LAN with internet access. There are other ...
7
votes
2answers
2k views

How stack smashing is prevented?

I just read AlephOne's paper on smashing the stack, and implemented it on my machine (Ubuntu 12.04), it was a bit old so had to take a lot of help from the internet but I enjoyed it. Now, I want to ...
1
vote
4answers
389 views

Is there a need to define “language safety”?

Language safety is not clearly defined while there're warnings about for instance Java. So how can you say that language is not safe while language safety is not clearly defined? If Java is unsafe now,...
6
votes
1answer
981 views

Hardware enforced DEP on different CPUs

Are there any differences how hardware DEP is implemented on CPUs from different manufacturers (Intel, AMD, nVidia, Texas,...)? Are there any significant differences how hardware DEP works on x86 ...
4
votes
2answers
977 views

How does exploit development work for penetration testers?

When doing exploit development, the process always relies on memory address from the victim's machine. As an exploit developer, you will have to setup an environment of attacker\victim machines and ...
1
vote
1answer
681 views

how to circumvent ASLR without pointer leaks

is there way to circumvent ASLR without pointer leaks, I mean i read many exploit development course Syllabus and many of them talk about bypass ASLR without pointer leaks, Does anyone can explain to ...
1
vote
2answers
775 views

How safe is it to disable DEP for a program?

I've been playing a game and there is a private server (with around 2k population) that asks us to turn off DEP for their game, I read about what it does but I don't understand what the consequences ...
0
votes
1answer
569 views

Why are stack address the same all the time when not using ASLR? [closed]

In an answer to How do ASLR and DEP work? Polynomial says: In a non-ASLR and non-DEP process, the stack address is the same every time we run the process. We know exactly where it is in memory. I ...
2
votes
1answer
264 views

Defeating code injection attacks in x86

In x86 systems, there are three requirements for a code injection attack to work: write attack payload to memory attack payload to be executable divert control-flow to payload How can we prevent 2) ...
0
votes
1answer
356 views

How much is ASLR effectiveness impacted by different ABIs?

Linux has multiple x86 ABIs: ia32, x32 and x86_64. ia32 and x32 both use 32 bit addresses for addressing and x86_64 uses 64 bit. Now, the question: Since the size of the memory space should affect ...

15 30 50 per page