+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Pentesting and Forensics (https://hackforums.net/forumdisplay.php?fid=231)
+---- Thread: Are stack overflows still effective? (/showthread.php?tid=4563231)
Are stack overflows still effective? - Ov3rfl0w - Nov 30, 2014
I'm new in software security.
Ive noticed that compilers have something called stack smashing protection, which stops you from overflowing fully trough the stack on the compiled program.
Are stack overflows dying or its still effective nowadays?🤝
* - -Hyperion - Nov 30, 2014
It is dieing out in stuff but remember 37% of windows are still XP machines etc so stack overflow is still usable.
* - Goodies - Nov 30, 2014
It seems to me that Heap attacks are rather more common than stack overflows, but you should have a working understanding of both.
* - Ichi - Dec 1, 2014
Overflows are still prevalent in today's world but like Goodies said, you might want to get more comfortable with heap overflows because youll run into those more. Stack overflows, to me, tend to be easier because of how the stack is handled..compared to heap. If you understand stack overflows, heap overflows shouldnt be too hard for you.
Here's a nice little guide on the differences and properties of Stack vs Heap
http://gribblelab.org/CBootcamp/7_Memory_Stack_vs_Heap.html
* - Ov3rfl0w - Dec 1, 2014
(Dec 1, 2014 09:38 AM)Ichi Wrote: Overflows are still prevalent in today's world but like Goodies said, you might want to get more comfortable with heap overflows because youll run into those more. Stack overflows, to me, tend to be easier because of how the stack is handled..compared to heap. If you understand stack overflows, heap overflows shouldnt be too hard for you.Alright thanks for the replies and thank you for that info site 🤝
Here's a nice little guide on the differences and properties of Stack vs Heap
* - K0FIN - Dec 1, 2014
Stack Overflows are still alive and well, most people say they aren't because of protection schemes (ASLR, DEP, Stack canaries, etc.) but they are. The heap is a very popular exploitation vector as well, it's just a different segment of memory that is used differently than the stack. I would suggest to anyone that learning both is basically required.
* - K4Fr - Dec 1, 2014
Basic stack smashing is definitely in decline. Some are still exploitable, but many are entirely mitigated. And to be pedantic, the stack and heap are in the same segment, but are different regions within that segment. Segment has a technical meaning. Stack overflows are mostly mitigated by canaries and a general lack of flexibility in terms of what you can clobber. DEP and ASLR matter, but you usually do not even get to them (usually other mitigations stop you from even getting to the point of being blocked by DEP or ASLR). Heap overflows happen, but use after free and type confusion are often easier to find. Stack overflows can be easier or harder depending on the details.
* - gizmodo - Dec 3, 2014
Good to know this, I really appreciate the expert opinions.