All Questions
7 questions
1
vote
2
answers
432
views
How is executable shellcode inserted?
How is shellcode (the payload) added to an executable file? Assume it is close source.
How does the hacker then get the address of where it is? They need this for when they overwrite the return ...
- 713
3
votes
2
answers
1k
views
How does ASLR protect libc entry points?
ASLR randomizes the addresses of the process executable code, stack, heap and libraries. This is to make the life of an attacker difficult as they cannot hardcode addresses in the code across multiple ...
- 95
1
vote
0
answers
338
views
Buffer overflow and register contents?
I am doing an exam practice question, suppose I have a function like;
void func(char* arg)
{
char buf[32];
strcpy(buf, arg);
}
command break func:
-buf begins at 0xbffebfb0
-(gdb) x/2wx $...
- 145
2
votes
1
answer
357
views
Are stack buffer overflows even possible in this instance?
Let's say there is a C program that simply takes a string argv[1] and uses sprintf to copy it in a finite buffer. Classic stack buffer overflow. Let's even say the program is more complicated, ...
- 21
5
votes
2
answers
3k
views
ASLR and how a program can actually call its functions
I'm studying protection techniques and I've got a doubt about how ASLR works for a program in a Windows environment.
As far as I know ASLR works by randomizing part of the imagebase address when ...
- 169
19
votes
2
answers
25k
views
How "leaking pointers" to bypass DEP/ASLR works
I was wondering if anyone could give me some clues on how "leaking pointers" to bypass DEP/ASLR work. I read here:
The only way to reliably bypass DEP and ASLR is through an pointer
leak. This is ...
- 509
129
votes
2
answers
106k
views
How do ASLR and DEP work?
How do Address Space Layout Randomisation (ASLR) and Data Execution Prevention (DEP) work, in terms of preventing vulnerabilities from being exploited? Can they be bypassed?
- 136k