// Foundations

Explore Binary Exploitation

Before you overwrite a return address, you have to know exactly where it lives.

Binary exploitation rewards people who can point to a specific byte and say why it matters. Not "the buffer overflows" but "this write goes eight bytes past the buffer, over the saved RBP, into the return address" — and until you can say that, the stack is just a diagram, not a target.

your tutor starts by putting an actual stack frame in front of you: locals, saved RBP, return address, stacked in the order a function call actually pushes them. You work out the offset by hand, with a cyclic pattern and a debugger, before anyone talks about ROP or canaries or bypassing anything. The mitigations only make sense once you've felt the plain overflow work — and then hit the wall each one puts up.

This isn't a substitute for your coursework or your CTF team's writeups. It's where you stop pasting exploit scripts you don't understand and start predicting, before you run a payload, exactly where the crash will land and why.

// What a session feels like

You bring the questions. Your tutor asks the next one.

  • your tutor lays out a stack frame on the whiteboard — locals, saved RBP, return address — and asks you to mark where a 40-byte strcpy into a 32-byte buffer actually lands. You get the boundary wrong once; it asks what 'past the end' means for a stack that grows down while your buffer fills up.
  • In the terminal, you run checksec against a target binary. Canary: enabled. Your tutor doesn't hand you a bypass — it asks what you'd expect a crash to look like now versus on the unprotected version, and waits for you to notice the difference is a canary check failing, not a clean redirect.
  • You've built a cyclic pattern with pwntools and crashed the binary in the Docker lab. Your tutor asks you to find the offset by matching the crash address against the pattern by hand, before it will let the conversation move to writing the return address itself.

Start exploring Binary Exploitation tonight — a 30-day trial, cancel anytime.

Start your 30-day trial