The Shellcoder’s Handbook

The black hats have kept up with security enhancements. Have you?

In the technological arena, three years is a lifetime. Since the first edition of this book was published in 2004, built-in security measures on compilers and operating systems have become commonplace, but are still far from perfect. Arbitrary-code execution vulnerabilities still allow attackers to run code of their choice on your system—with disastrous results.

In a nutshell, this book is about code and data and what happens when the two become confused. You’ll work with the basic building blocks of security bugs—assembler, source code, the stack, the heap, and so on. You’ll experiment, explore, and understand the systems you’re running—and how to better protect them.

• Become familiar with security holes in Windows, Linux, Solaris, Mac OS X, and Cisco’s IOS
• Learn how to write customized tools to protect your systems, not just how to use ready-made ones
• Use a working exploit to verify your assessment when auditing a network
• Use proof-of-concept exploits to rate the significance of bugs in software you’re developing
• Assess the quality of purchased security products by performing penetration tests based on the information in this book
• Understand how bugs are found and how exploits work at the lowest level

Table of Contents

Part I: Introduction to Exploitation: Linux on x86

Chapter 1: Before You Begin

Chapter 2: Stack Overflows

Chapter 3: Shellcode

Chapter 4: Introduction to Format String Bugs

Chapter 5: Introduction to Heap Overflows

Part II: Other Platforms- Windows, Solaris, OS/X, and Cisco

Chapter 6: The Wild World of Windows

Chapter 7: Windows Shellcode

Chapter 8: Windows Overflows

Chapter 9: Overcoming Filters

Chapter 10: Introduction to Solaris Exploitation

Chapter 11: Advanced Solaris Exploitation

Chapter 12: OS X Shellcode

Chapter 13: Cisco IOS Exploitation

Chapter 14: Protection Mechanisms

Part Ill: Vulnerability Discovery

Chapter 15: Establishing a Working Environment

Chapter 16: Fault Injection

Chapter 17: The Art of Fuzzing

Chapter 18: Source Code Auditing: Finding Vulnerabilities in C-Based

Languages

Chapter 19: Instrumented Investigation: A Manual Approach

Chapter 20: Tracing for Vulnerabilities

Chapter 21: Binary Auditing: Hacking Closed Source Software

Part IV: Advanced Materials

Chapter 22: Alternative Payload Strategies

Chapter 23: Writing Exploits that Work in the Wild

Chapter 24: Attacking Database Software

Chapter 25: Unix Kernel Overflows

Chapter 26: Exploiting Unix Kernel Vulnerabilities

Chapter 27: Hacking the Windows Kernel