DANGEROUS C Functions gets & strcpy (PicoCTF 2022 #04 buffer-overflow0)

Help the channel grow with a Like, Comment, & Subscribe!
Check out the affiliates below for more free or discounted learning!

📧Contact me! (I may be very slow to respond or completely unable to)

[jlm]

I was at that part in my Security+ chapter about buffer-overflow and I was looking for an example of what it really did in C. Thanks man !! :)

[JBlly]

Maybe putting -fstack-protector when compiling would have worked? Not sure

[mrnord]

Thank you John, every time I watch one of your videos I always learn something new :)

[jpiercelt]

Dude, following along right with you, even going ahead now until I get stuck! Please keep going, this is great and I appreciate you so much!

[windows]

Haha I'm a noob at these CTF challenges and had troubles solving this one for some reason. Looking through it with your guidance I'm like "Wow I'm an idiot, it was so simple" lol

[greyether]

Thanks John. We appreciate how you thoroughly explain everything and keep it simple at the same time. You're a rockstar!!

[Talyzeni]

These videos are so awesome. Thanks so much John

[VAKAMA]

Super cool series, always a pleasure to watch them! Keep it up!

[logiciananimal]

3 ways to fail the computer systems course I did ~20 years ago: 1) cheat 2) do way too little adequate work 3) use gets()

[KGAD]

Loving this series, John. Please finish it!

[wChris_]

it seems to be a kali linux thing having no stack-protector when building with gcc, as it works on my machine (ubuntu)

[kaleabalemayehu]

you already know it but let me tell you one more time YOU ARE AWESOME.

[tuxmaster]

You the best John, thanks a lot for these material and your explanations,

You are a master mind my friend

[richardStretcher]

I wanted to subscribe, but I've completely forgotten that I already was. Anyway, thanks for another informative video!

[henrym]

Thank you for all the beginner-friendly content
A question as an absolute newbie into binary: only an input of length>=20 causes the SIGSEGV, i.e. it doesn’t happen with say 17. Is there a way to know or estimate how many more bytes I need?

[cqundefine]

sigsegv stands for signal segmentation violation

[MiguelDevOps]

6:34 a minor correction: the char array buf1 is 100*sizeof(char) Bytes long

[anmoldeepsingh]

i think the stack smashing wasnt detected probably the way gcc was compiled, its default could have been -fno-stack-protector, so default build task will never include a canary

[zer]

I think strcpy is the most used function to demonstrate bufferoverflows.

[TehPwnerer]

Oh the days I coded in C/C++, flush of output buffer is not guaranteed without the flush