Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [heapspray]

The tag has no usage guidance.

1
vote
0answers
37 views

Why does hydraqs exploit put “abc” in its x1 array?

Here there is a thorough description of the exploit I am talking about. There is this step: var x1 = new Array(); for (i = 0; i < 200; ++i) { x1[i] = document.createElement("COMMENT"); x1[...
1
vote
0answers
79 views

Need help in exploiting an overflow on Linux [closed]

There is a 32-bit linux application. It's possible to overwrite EIP easily. I will call this process: "send a string". It's also possible to send about 10000 custom bytes to heap (it's possible to ...
0
votes
1answer
183 views

Is Heap Spraying only valid for browser applications?

Since heap spraying takes advantage of javascript's predictability in allocating heap chunks, does this mean that heap spraying only works for browser applications and not other usual applications?
3
votes
1answer
635 views

Bitmap heap spray technique

I was recently reading up a PDF (https://www.owasp.org/images/0/01/OWASL_IL_2010_Jan_-_Moshe_Ben_Abu_-_Advanced_Heapspray.pdf) heap spray techniques when they mentioned heap spray with bitmaps. Now ...
1
vote
0answers
86 views

Why makes many copies of the code block in Heap Spray?

I Understand that adding NOP-Sled will increase the possibility of the attack, but why do we need to add more than a copy of NOP-sled + shellcode? if we have one big NOP_sled+shellcode it will be more ...
6
votes
1answer
1k views

Are Heap addresses randomized by ASLR?

I have been reading this article about an Internet Explorer exploit and I am a little confused about why the memory addresses effected by the heap-spray "work". The paper states that the attack uses ...
2
votes
1answer
139 views

Heap Spray in Documents

I was watching Kevin Mitnick demonstrate the results of an exploit via Heap Spray in a PDF https://www.youtube.com/watch?v=0EKTCg7yQ_Y and was wondering what exactly is going on in the PDF and whether ...
3
votes
1answer
54 views

Reason behind HeapSpray format

I am curious as to why heap spraying consists of allocating repeated chunks of NOP + Shellcode? Why is the format not repeating NOP and then just Shellcode at the end; when the stack pivot occurs ...