📔
eCPPTv2 Notes
  • About
  • 1-System Security
    • Architecture Fundamentals
      • Security Implementations
      • References
    • Assembler Debuggers and Tool Arsenal
      • Compiler
      • NASM
      • Tool Arsenal
      • References
    • Buffer Overflow
      • Finding Buffer Overflows
      • Exploiting Buffer Overflow
      • Security Implementations
      • References
    • Shellcoding
      • Types of Shellcode
      • Encoding of Shellcode
      • Debugging a Shellcode
      • Creating our First Shellcode
      • More Advanced Shellcode
      • Shellcode and Payload Generators
      • References
    • Cryptography and Password Cracking
      • Cryptography Hash Function
      • Public Key Infrastructure
      • Pretty Good Privacy (PGP)
      • Secure Shell (SSH)
      • Cryptographic Attack
      • Security Pitfalls
      • Windows 2000/XP/2k3/Vista/7/8 Passwords
      • References
    • MALWARE
      • Techniques Used by Malware
      • How Malware Spreads
      • Samples
      • References
  • 2-Network Security
    • Information Gathering
      • Search Engines
      • Social Media
      • Infrastructures
      • Tools
      • References
    • Scanning
      • Detect Live Hosts and Ports
      • Service and OS detection
      • Firewall/IDS Evasion
      • References
    • Enumeration
      • NetBIOS
      • SNMP
      • References
    • Sniffing and MitM Attacks
      • What is Sniffing
      • Sniffing in Action
      • Basic of ARP
      • Sniffing Tools
      • Man in the Middle Attacks
      • Attacking Tools
      • Intercepting SSL Traffic
      • References
    • Exploitation
      • Vulnerability Assessment
      • Low Hanging Fruits
      • Exploitation
      • References
    • Post Exploitation
      • Privilege Escalation and Maintaining Access
      • Pillaging / Data Harvesting
      • Mapping the internal network
      • Exploitation through Pivoting
      • References
    • Anonymity
      • Browsing Anonymously
      • Tunneling for Anonymity
      • References
    • Social Engineering
      • Types of Social Engineering
      • Samples of Social Engineering Attacks
      • Pretexting Samples
      • Tools
      • References
  • 3-Powershell for Pentesters
    • Introduction
      • Why PowerShell ?
      • References
    • PowerShell Fundamentals
      • Cmdlets
      • Modules
      • Scripts
      • Objects
      • References
    • Offensive PowerShell
      • Downloading & Execution
      • Obfuscation
      • Information Gathering & Recon
      • Post-Exploitation With Powershell
      • References
Powered by GitBook
On this page

Was this helpful?

  1. 1-System Security
  2. Buffer Overflow

Finding Buffer Overflows

These are the examples of operations that may be vulnerable to buffer overflows:

  • strcpy

  • strcat

  • gets / fgets

  • scanf / fscanf

  • printf

  • vsprintf

  • memcpy

Any function which carries out the following operations may be vulnerable to buffer overflows:

  • Does not properly validate inputs before operating

  • Does not check input boundaries

However, buffer overflows are problems of unsafe languages. All interpreted languages such as C#, Visual Basic, .Net, Java, etc. are safe from such vulnerabilities.

Moreover, buffer overflows can be triggered by any of the following buffer operations:

  • User input

  • Data loaded from a disk

  • Data from network

If we want to find buffer overflows manually, it can be very time consuming. However, we will document some of the techniques that make this process easier, such as:

Other techniques are the followings:

  • When a crash occurs, be prepared to hunt for the vulnerability with a debugger. Some companies use cloud-fuzzing to brute-force crashing (using file-based inputs). Whenever a crash is found, it is recorded for further analysis

  • A dynamic analysis tool like a fuzzer or tracer, which tracks all executions ant the data flow, help in finding problems

Fuzzing is a software testing technique that provides invalid data, i.e., unexpected or random data as input to a program. Input can be in any form such as:

  • Command line

  • Network data

  • Databases

  • Keyboard/mouse input

  • Parameters

  • File input

  • Shared memory regions

  • Environment variables

This technique basically works by supplying a random data to the program, and then the program is checked for incorrect behavior such as:

  • Memory hogging (excessive use of memory)

  • CPU hogging

  • Crashing

Whenever inconsistent behavior is found, all related information is collected, which will later be used by operator to recreate the case and hunt-down/solve the problem.

However, fuzzing is an exponential problem and is also resource-intensive, and therefore, in reality, it cannot be used to test all the cases.

Some fuzzing frameworks:

2.1 Finding Buffer Overflows in Binary Programs

Let's see how to identify a buffer overflow after the crash of the application.

2.2 Code Observation

2.3 Overflow the Buffer

PreviousBuffer OverflowNextExploiting Buffer Overflow

Last updated 4 years ago

Was this helpful?

If you are a developer and you have access to the source code, such as statistic analysis tools (, , etc.). Such tools will try to detect not only buffer overflows but also some other types of errors.

Another tool that will help you identify buffer overflows is IDA Pro. You can download a free non-commercial .

splint
Cppcheck
Peach Fuzzing Platform
Sulley
Sfuzz
FileFuzz
edition