If I can add, with ref to buffer overflow exploits to have some usefulness to the hacker, it is not only important to know the correct OS of the target machine but also it is very important to know the service pack or patch level. As this will help the attacker to land the exploit code at right memory addresss in the buffer so that it can be executed.
http://www.linuxjournal.com/article/6701
This is a good link which explains the basics of BoF and technique used to write a expolit








Network Pen Testing : Tomcat authentication with sqlmap





