Advanced Offensive Security

Binary Exploitation & Buffer Overflows

Smash the stack, control execution, and understand modern mitigations.

Advanced · 20 min

Open the interactive lesson →

Binary exploitation attacks compiled programs (C/C++) at the memory level. The classic is the stack buffer overflow: writing past a buffer's bounds to overwrite the saved return address and redirect execution to your own code.

The classic stack overflow

• A function copies attacker input into a fixed-size stack buffer with no bounds check (e.g. strcpy).
• Overflowing it overwrites the saved return address (EIP/RIP).
• Point that address at your shellcode (or a ROP chain) to gain code execution.

# Typical workflow (e.g. classic OSCP-style overflow)
1. Fuzz until crash
2. Find exact offset to EIP (cyclic pattern)
3. Control EIP
4. Find bad characters
5. Locate a 'JMP ESP' instruction
6. Generate shellcode (msfvenom) and get a shell

Modern mitigations you must defeat

• DEP/NX — stack isn't executable → bypass with ROP (reuse existing code).
• ASLR — addresses randomised → need an info leak to defeat.
• Stack canaries — a guard value detects overflows → must leak or avoid it.
• PIE — position-independent executables randomise the binary base too.

Take the quiz →