skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

exploiting-stack-buffer-overflows

Exploit stack-based buffer overflows in native binaries using cyclic patterns and ROP chains.

954|172|Updated Mar 13, 2026
Search Tags:#pwntools#GDB#buffer overflow#binary exploitation#ROP chain#stack canary#ret2win
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill exploiting-stack-buffer-overflows
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: exploiting-stack-buffer-overflows
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/binary-exploitation/exploiting-stack-buffer-overflows
Command: npx skills add https://github.com/xalgord/xalgorix --skill exploiting-stack-buffer-overflows

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

When a native binary crashes on oversized input during an authorized assessment, it is hard to tell whether the crash is a mere denial of service or a controllable return-address overwrite. This Skill provides a repeatable methodology to triage crashes, compute exact overwrite offsets, and build working exploits based on the binary's mitigations.

Core Features & Use Cases

  • Crash Triage and Offset Discovery: Use De Bruijn cyclic patterns with gdb/pwndbg/GEF and pwntools to confirm instruction-pointer control and compute the exact offset to the saved return address.
  • Mitigation-Aware Exploitation: Select ret2win, stack shellcode, ret2libc, or ROP chains based on checksec results (canary, NX, PIE, RELRO), including stack-alignment fixes and bad-byte enumeration.
  • Advanced Scenarios: Covers Windows SEH overwrites, partial pointer overwrites, and byte-by-byte canary brute forcing against forked servers.
  • Use Case: During a CTF or authorized pentest, a 64-bit non-PIE binary crashes on long input; use this methodology to confirm RIP control at offset 72 and build a ret2win payload that calls an unused win() function.

Quick Start

Ask the AI to analyze a crashed vulnerable binary with checksec and a cyclic pattern, determine the return-address offset, and build a pwntools exploit payload appropriate to its mitigations.

Frequently Asked Questions about exploiting-stack-buffer-overflows

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find the offset to the return address in a buffer overflow?▼

Send a De Bruijn cyclic pattern (e.g. pwn cyclic 200) as input and let the program crash under gdb. Read the value in the faulting instruction pointer or at the stack pointer, then use cyclic_find or GEF's pattern search to compute the exact offset.

How do I exploit a stack buffer overflow with pwntools?▼

Confirm the offset with a cyclic pattern, then build a payload of padding plus the target address using p64. For non-PIE binaries with an unused win() function, overwrite the return address with win's address, adding a bare ret gadget first to fix stack alignment.

Does a segmentation fault prove a buffer overflow is exploitable?▼

No. A crash only proves memory corruption. You must confirm the saved return address contains bytes from your input pattern; a crash inside a canary check or a faulting read/write without IP control is a denial-of-service primitive, not control-flow hijack.

Why does my exploit fail when addresses contain null bytes?▼

Functions like strcpy, gets, and sscanf %s stop copying at the first NUL byte, truncating your payload. Enumerate bad bytes first, choose gadgets whose addresses avoid them, or abuse delimiter-based parsers that append NULs at chosen positions.

What protections affect stack overflow exploitation?▼

Checksec reports the key mitigations: stack canaries detect overwrites, NX prevents executing stack shellcode, PIE randomizes code addresses, and RELRO protects the GOT. No canary plus no PIE with NX enabled is the classic ROP target.

Can a stack canary be bypassed on forked servers?▼

Yes. When a service forks per request, children share the parent's canary, so you can brute-force it one byte at a time using the response (e.g. HTTP 200 vs 502) as an oracle, then recover the saved base pointer and return address the same way.

Related Skills

Explore More Software Engineering Skills→
2389-research2389-research
90

binary-re:static-analysis

Analyze binary structure and decompile functions with radare2 and Ghidra headless.

Official
Advanced
bitcoin-is-moneybitcoin-is-money
6

security-audit

Identify and document security vulnerabilities in BIM's codebase with severity ratings.

Official
Advanced
wgpsecwgpsec
1.7k

binary-exploitation-methodology

Guides analysis and exploitation of binary vulnerabilities including stack overflows, heap corruption, and format strings.

Official
Advanced
xuziqiang98xuziqiang98

pwn-exploit

Analyze Linux binary vulnerabilities and develop exploits for CTF challenges.

Community
Advanced