.

Suggest me a e-book for understanding basics of buffer over flow?

<<

manoj9372

Jr. Member
Jr. Member

Posts: 72

Joined: Mon Oct 05, 2009 8:54 am

Post Sat Sep 18, 2010 5:23 pm

Suggest me a e-book for understanding basics of buffer over flow?

I am interested in learning understanding about the basics of buffer over flow ,how it works?
etc,can any one suggest me a good e-book or link or paper to understand the basic operation and functions of buffer overflow?


Hope i will get some help here...
<<

hayabusa

User avatar

Hero Member
Hero Member

Posts: 1661

Joined: Mon Jan 29, 2007 2:59 pm

Post Sat Sep 18, 2010 8:00 pm

Re: Suggest me a e-book for understanding basics of buffer over flow?

Well, I (and many others) began here:

http://insecure.org/stf/smashstack.html
(Smashing the Stack for Fun and Profit)

There are plenty of other books / tutorials, and a fast Google search will turn up a lot.
~ hayabusa ~ 

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'


OSCE, OSCP , GPEN, C|EH
<<

former33t

Full Member
Full Member

Posts: 226

Joined: Sat Feb 14, 2009 12:33 am

Post Sat Sep 18, 2010 8:07 pm

Re: Suggest me a e-book for understanding basics of buffer over flow?

If you have $32 to spend, jump over to amazon and buy "Hacking: the art of exploitation."  Then read some papers and realize that your money was well spent from all the time you saved reading a book that gives you a good grounding to digest everything else.  Search the site for some book reviews on this.  It is widely read and universally recommended.

BTW, I'm pathologically cheap, but I do invest money freely in two things:
1.  Good hardware
2.  Good documentation

Both actually save me money over the long haul.  The book falls into the later category.
Certifications: CREA, MCSE: Security, CCNA, Security+, other junk
<<

MaXe

User avatar

Hero Member
Hero Member

Posts: 671

Joined: Tue Aug 17, 2010 9:49 am

Post Sun Sep 19, 2010 6:21 am

Re: Suggest me a e-book for understanding basics of buffer over flow?

A user actually requested similar information recently on the forum I host, so I thought I'd share the same links here  ;)

------------ Link Start ------------

Writing Windows Exploits:
http://forum.intern0t.net/cinema/video-21/ (or: http://guides.intern0t.net/msf2.php )
http://www.offensive-security.com/video ... roller.swf
http://en.wikibooks.org/wiki/Metasploit ... owsExploit

Egghunters:
http://www.offensive-security.com/video ... roller.swf

SEH Overflow:
http://www.offensive-security.com/video ... roller.swf

Smashing the Stack 2010: (paper)
http://5d4a.wordpress.com/2010/08/02/sm ... k-in-2010/
http://mariano-graziano.llab.it/docs/report.pdf

Metasploit Unleashed: (chapter 07)
http://www.offensive-security.com/metasploit-unleashed/


There's also a couple of books, I would probably read these:
http://www.amazon.com/Buffer-Overflow-A ... 932266674/
http://www.amazon.com/Shellcoders-Handb ... 47008023X/
http://www.amazon.com/Writing-Security- ... 597499978/

I haven't read any of these books yet though I intend to

There's also a couple of interesting articles I would read:
http://www.phrack.com/issues.html?issue=62&id=7
http://www.phrack.com/issues.html?issue=55&id=15
http://www.phrack.com/issues.html?issue=49&id=14
http://www.phrack.org/issues.html?id=14&issue=49

Smashing the Stack: (original)
http://insecure.org/stf/smashstack.html
http://www-inst.eecs.berkeley.edu/%7Ecs ... ashing.pdf

The Tao of Windows Buffer Overflow:
http://www.cultdeadcow.com/cDc_files/cDc-351/

And of course lets not forget the tutorials from Corelan:
http://www.corelan.be:8800/index.php/ca ... ls/page/3/

------------ Link End ------------

There's some resources to get you started  ;)

Reference:
http://forum.intern0t.net/general-hacki ... ation.html
I'm an InterN0T'er
<<

Xen

User avatar

Sr. Member
Sr. Member

Posts: 386

Joined: Tue Feb 03, 2009 3:59 am

Post Sun Sep 19, 2010 6:58 am

Re: Suggest me a e-book for understanding basics of buffer over flow?

Do you have basic understanding of C/C++, specifically arrays,strings and pointers? If not then it'll be useful to firstly get some programming experience. I suggest reading "C programming language" http://www.amazon.com/Programming-Langu ... 188&sr=8-1

You can then move to assembly language tutorials from securitytube especially videos 1,2,3,4 and 11. (I suggest watching all the videos, but if you can't then don't miss at least these five)
http://www.securitytube.net/Assembly-Pr ... video.aspx

Armed with this knowledge it should be easy for you to understand bufferoverflows.
Again, securitytube has free buffer overflow primer videos. I found these very useful.
http://www.securitytube.net/Buffer-Over ... video.aspx
<<

H4TT1fn4TT

User avatar

Jr. Member
Jr. Member

Posts: 54

Joined: Tue Feb 08, 2011 2:48 pm

Location: Void

Post Thu Feb 17, 2011 11:11 am

Re: Suggest me a e-book for understanding basics of buffer over flow?

Equix3n- wrote:Do you have basic understanding of C/C++, specifically arrays,strings and pointers? If not then it'll be useful to firstly get some programming experience. I suggest reading "C programming language"

Just a quick note (and sorry for bringing up an old topic) as far as I am aware C does not support strings so that should only refer to C++. From how I learned it C only supports array's of characters.

Next to that all a great book that should be mentioned for learning C, some assembly and how it is used to write exploits would be "hacking, the art of exploitation".

http://www.amazon.com/Hacking-Art-Explo ... pd_sim_b_2
"The quality of programmers is a decreasing function of the density of go to statements in the programs they produce."
<<

ambient

User avatar

Newbie
Newbie

Posts: 20

Joined: Tue Feb 17, 2009 1:33 am

Location: Thailand

Post Sun Jul 10, 2011 9:47 am

Re: Suggest me a e-book for understanding basics of buffer over flow?

A nice video tutorial set from securitytube.net,
http://www.securitytube.net/groups?operation=view&groupId=4

I'm quite sure you might like it  8).
<<

mesho

Newbie
Newbie

Posts: 24

Joined: Tue Aug 10, 2010 8:01 am

Post Sun Jul 10, 2011 10:20 am

Re: Suggest me a e-book for understanding basics of buffer over flow?

H4TT1fn4TT wrote:
Equix3n- wrote:Do you have basic understanding of C/C++, specifically arrays,strings and pointers? If not then it'll be useful to firstly get some programming experience. I suggest reading "C programming language"

Just a quick note (and sorry for bringing up an old topic) as far as I am aware C does not support strings so that should only refer to C++. From how I learned it C only supports array's of characters.


this is absolutely untrue, C is the father of C++/Java..

there's a pleny ways to define string in C:
char *string=""
char string[]=""

and define your own struct to use only the keyword string  ;)
<<

WCNA

User avatar

Full Member
Full Member

Posts: 187

Joined: Wed Mar 02, 2011 8:05 am

Location: Florida

Post Mon Jul 11, 2011 12:37 pm

Re: Suggest me a e-book for understanding basics of buffer over flow?

As others have already pointed out, securitytube is where I start for all such questions. With over 2,000 videos there's almost always something of interest on whatever subject you're interested in. And the videos are getting much better as people like Vivek have upgraded their editing software.

His wireless security megaprimer is *awesome* (as he would say). :D
ISC2 Associate, WCNA, CWNA, OSCP, Network+
<<

bigapple

Newbie
Newbie

Posts: 8

Joined: Thu Aug 18, 2011 12:07 pm

Post Sat Aug 20, 2011 11:16 am

Re: Suggest me a e-book for understanding basics of buffer over flow?

If you want a book, you should read Hacking: The Art Of Exploitation. Even if you cant program in C or Assembly it should get you into writing exploits. If you can do that well, you should read The Shellcoders Handbook, which goes a little bit further than The Art Of Exploitation but both will teach you how to write exploits, and how exploits work.
<<

mambru

Jr. Member
Jr. Member

Posts: 98

Joined: Wed Jun 03, 2009 3:11 pm

Post Sat Aug 20, 2011 6:24 pm

Re: Suggest me a e-book for understanding basics of buffer over flow?

Quote from: H4TT1fn4TT on February 17, 2011, 05:11:12 PM
Quote from: Equix3n- on September 19, 2010, 01:58:49 PM
Do you have basic understanding of C/C++, specifically arrays,strings and pointers? If not then it'll be useful to firstly get some programming experience. I suggest reading "C programming language"
Just a quick note (and sorry for bringing up an old topic) as far as I am aware C does not support strings so that should only refer to C++. From how I learned it C only supports array's of characters.

this is absolutely untrue, C is the father of C++/Java..

there's a pleny ways to define string in C:
char *string=""
char string[]=""

and define your own struct to use only the keyword string


I think H4TT1fn4TT meant that C does not have a built-in "Strings" type, and he's right. Of course you can define your own types and data structures and call them whatever you want, but in C you don't have that native type as other languages do.
<<

Sys0pinion

Newbie
Newbie

Posts: 2

Joined: Sun Sep 18, 2011 7:33 pm

Post Sun Sep 18, 2011 7:50 pm

Re: Suggest me a e-book for understanding basics of buffer over flow?

Hey forumer33t i was wondering does the book cover the ability to hack or just defend a website? I want to know to see if i shoupd get it.
<<

raptorsl

User avatar

Newbie
Newbie

Posts: 4

Joined: Thu Aug 26, 2010 6:32 am

Post Wed Sep 28, 2011 1:39 am

Re: Suggest me a e-book for understanding basics of buffer over flow?

I found this training session from Dino Dai Zovi to be very useful.

http://pentest.cryptocity.net/exploitation/

Return to Programming

Who is online

Users browsing this forum: No registered users and 0 guests

cron
.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software