4 ms·
This has been required reading for all the pentesters at my org for the past 20 years.
by no-dr-onboard 6y ago
This has been required reading for all the pentesters at my org for the past 20 years.
- rixrax 6y agoShould propably be required reading for every programmer and especially for those that work with memory unsafe languages. With a side of modern mitigation techniques.[0] [0] https://en.m.wikipedia.org/wiki/Buffer_overflow https://en.m.wikipedia.org/wiki/Buffer_overflow (See buffer overflow protection)
- e12e 6y agoA simple compare and contrast between C and zig/rust/D might be interesting - or even golang for that matter (the idea being that code could be reasonably similar, and yet somewhat idiomatic - and illustrate how the C code is exploitable, but the safe language version isn't - except when made to be).
- notsureaboutpg 6y agoThis was required reading in my university's CS program.
- tptacek 6y agoWhy? Exploitation of novel memory corruption vulnerabilities is pretty rare on penetration tests.