Reverse Engineering Stack Exchange
Reverse Engineering Stack Exchange

Questions tagged [exploit]

Using techniques to change the behavior of an application or application component in order to use it to ones advantage. When used it is often referred to software exploitation where an attacker can take control of an applications execution flow in order to run arbitrary code.

Exploit is the term used for a piece of code that (often maliciously) abuses vulnerabilities in code. This often affects the security of the vulnerable application or system and allows attackers to gain privileges they would otherwise be barred from etc.

One of the most notorious types of exploits is the so-called uncontrolled format string which makes a whole class of functions (printf, sprintf, etc.) vulnerable across a variety of programming languages and systems.

Many more types of exploits exist. TBD

Recommended books:

  • Exploiting Software: How to Break Code
  • Gray Hat Hacking: The Ethical Hackers Handbook
  • A Bug Hunter's Diary: A Guided Tour Through the Wilds of Software Security

External references:

125 questions
13
votes
2 answers

How are vulnerabilities (especially buffer overruns) found in the wild?

I hope this question is not OT for RE, but I'm rather curious as to how vulnerabilities are usually found. Of course I'm aware that companies are doing code audits to identify security problems but I doubt that the results of such audits are…
Devolus
  • 963
  • 1
  • 10
  • 21
2
votes
1 answer

0xdeadbeef in Exploitation?

I am playing a wargame at narnia.labs.overthewire.org. I came arcoss a level called narnia0 which requires me to change the value 0x414141414 into 0xdeadbeef. So far, I have already looked at the source code and reverse engineered the binary. What…
user3286303
  • 107
  • 1
  • 3
  • 7
1
vote
1 answer

Execution failure of shellcode in stack without DEP

Here is the simplest example to show my problem. Everything is in WinXp sp3 with DEP disabled. char f() { // shellcode starting with some NOPs, char shellcode[400]= { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, …
user15580
  • 253
  • 3
  • 11
1
vote
1 answer

Is there a way to exploit 4-byte integer overflows to -1? [memcpy(dest, source, -1)]

I was debugging a program, and discovered a line of code like so: memcpy(stack_variable, attacker_supplied, read_length_from_packet(pPacket)); The read_length_from_packet returns -1 if the length is bigger than 0x1FF, but seems they forgot to…
rev
  • 1,293
  • 12
  • 22
1
vote
3 answers

Exploit Development with python

Are there any libraries to help developing exploits in python, like representing hex string or assembling/disassembling x86 instructions?
user3286303
  • 107
  • 1
  • 3
  • 7
0
votes
4 answers

Not enough space for shellcode

I am working on an exploit for a ctf-challenge and could't find any hint about my problem. My steps so far: I could successfully overwrite EIP with an "jmp esp" address and jump to my shellcode. I have determined all "bad-chars" which will cut my…
user17239
  • 11
  • 1
  • 1