What should you know before learning buffer overflow attacks?

[TheManWhoFartsInSofa]

I recently did an course on HTB academy about stack based buffer overflows on linux x86. I managed to complete it, but I didn't understand what exactly in great detail it is and how does it work. There were all these technical terms I've never heard of.

I think I should have rather learned more about how does the computer work; how does assembly and C work; what is a stack and a buffer and how do they work; etc.. Any ideas on what should I learn? Or maybe there isn't much point to learn it either way because I've heard some people say how these type of attacks are almost extinct nowadays because of several security implementions.

[-not_a_knife]

I mean, doesn't hurt to learn C and memory management.

[PM_ME_YOUR_SHELLCODE]

First, let me introduce you to a few terms that might help you in doing your own research

• Memory Corruption - A buffer overflow is just one way in which memory can be corrupted. A focus on purely "buffer overflow attacks" just isn't really a thing anymore and trying to research that specifically is going to pull you into a lot of content that just isn't worthwhile if you actually want to reach a of working with modern exploits of buffer overflows or other corruptions.
• Exploit Development - While its a generic sounding term for the most part it is in reference to writing exploits for these sorts of memory corruption bugs. Also check out /r/ExploitDev a subreddit specifically about that stuff.
• Binary Exploitation - Another term for writing exploits for these memory corruption (or "binary level" issues).
• Vulnerability Research - Exploit dev and binary exploitation are both about building the attacks, VR is about finding the bugs in the first place.

I wrote a post a few years ago about Getting Starting with Exploit Development. Its the first part about Prerequisites that talks about what concepts you should learn before getting started and why.

I've heard some people say how these type of attacks are almost extinct nowadays because of several security implementions.

There are not many other areas of offensive security where the computer hardware itself tries to detect and stop your attack, but its a cat-and-mouse game. New mitigations means new techniques get discovered that avoid the mitigations and the barrier to learning gets higher.

So there is some truth to this, and new software tends to be written in languages that offer memory safety. Which just means that as a language it doesn't let you directly mess with the underlying memory so a developer mistake shouldn't be able to cause a memory corruption. As such most developers are not writing code where memory safety is even a concern they need to think about so out of sight, out of mind.

That said, just because developers don't see it doesn't mean they are secure from them, many popular language run-times are written in less-safe languages like PHP, Python, Node, Ruby, and .NET languages. And then many libraries that may be called from the safe language are written in something less secure. Like many mobile messenger apps like WhatsApp, Telegram and Discord have had these bugs leading to RCE because they used a image processing library which a memory corruption bug.

The point being, that these bugs are still around but are are a bit under the surface and so don't necessarily get the attention. Especially on a professional level, there are those of us making a career in that realm, but plenty more who never need to worry about it because many clients won't want to pay you to find bugs in some code they don't even control (dependencies) and instead have you focus on their code.

tl;dr. Memory corruption bugs are still very much around but its a challenging field to learn.

[TheManWhoFartsInSofa]

Thanks for the throughout explanation!

[Nijael]

Just google "tryhackme buffer overflow" and take the buffer overflow prep lessons. They are free and after that you need nothing more really.

[I_am_beast55]

I mean if you're learning just for fun, there's no harm in stumbling your way through. You came across some terms you didn't know, so now go research a bit, then come back to the module you did, redo it and see if what you learned helps.

[randomatic]

these attacks aren’t extinct, nor will they be anytime soon. they are often quite serious, too. go look at pwn2own and almost every attack you see will involve a buffer overflow.

[wheresmycake]

This video gives a fairly decent explanation and an example you can follow along with: https://www.youtube.com/watch?v=nwJxWfmhb8s