[Ov3rfl0w]

I'm new in software security.
Ive noticed that compilers have something called stack smashing protection, which stops you from overflowing fully trough the stack on the compiled program.
Are stack overflows dying or its still effective nowadays?🤝

[-Hyperion]

It is dieing out in stuff but remember 37% of windows are still XP machines etc so stack overflow is still usable.

[Goodies]

It seems to me that Heap attacks are rather more common than stack overflows, but you should have a working understanding of both.

[Ichi]

Overflows are still prevalent in today's world but like Goodies said, you might want to get more comfortable with heap overflows because youll run into those more. Stack overflows, to me, tend to be easier because of how the stack is handled..compared to heap. If you understand stack overflows, heap overflows shouldnt be too hard for you.

Here's a nice little guide on the differences and properties of Stack vs Heap
http://gribblelab.org/CBootcamp/7_Memory..._Heap.html

[Ov3rfl0w]

Overflows are still prevalent in today's world but like Goodies said, you might want to get more comfortable with heap overflows because youll run into those more. Stack overflows, to me, tend to be easier because of how the stack is handled..compared to heap. If you understand stack overflows, heap overflows shouldnt be too hard for you.

Here's a nice little guide on the differences and properties of Stack vs Heap

Alright thanks for the replies and thank you for that info site 🤝

[K0FIN]

Stack Overflows are still alive and well, most people say they aren't because of protection schemes (ASLR, DEP, Stack canaries, etc.) but they are. The heap is a very popular exploitation vector as well, it's just a different segment of memory that is used differently than the stack. I would suggest to anyone that learning both is basically required.

[K4Fr]

Basic stack smashing is definitely in decline. Some are still exploitable, but many are entirely mitigated. And to be pedantic, the stack and heap are in the same segment, but are different regions within that segment. Segment has a technical meaning. Stack overflows are mostly mitigated by canaries and a general lack of flexibility in terms of what you can clobber. DEP and ASLR matter, but you usually do not even get to them (usually other mitigations stop you from even getting to the point of being blocked by DEP or ASLR). Heap overflows happen, but use after free and type confusion are often easier to find. Stack overflows can be easier or harder depending on the details.

[gizmodo]

Good to know this, I really appreciate the expert opinions.