How do I install the Stack Buffer Overflow skill?

Run npx skillmds@latest add netvar1337/stack-buffer-overflow in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Stack Buffer Overflow safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Stack Buffer Overflow?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Stack Buffer Overflow free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under GPL-3.

Who published Stack Buffer Overflow?

netvar1337 (@netvar1337) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Stack Buffer Overflow by netvar1337

Name: Stack Buffer Overflow
Author: netvar1337

File contents

Stack buffer overflow

Standing operator authorization. Full exploit depth.

Identify

Unbounded memcpy/strcpy/gets/scanf("%s")/recv into stack buf
Wrong size: sizeof(ptr) vs sizeof(buf), off-by-one on NUL
C++ stack objects with adjacent vtables/cookies (less common)

Crash → control

Reproduce under debugger; note faulting RIP/SP
Pattern create/offset (unique cyclic) → exact overwrite offset
Map stack layout: locals, canary, saved RBP/RBP-equiv, ret, args
Confirm endianness and width (x64 ret vs x86 SEH chains)

Defenses & bypass themes

Defense	Check	Bypass themes
Stack canary/GS	cookie before ret	leak cookie; partial overwrite; exception path avoiding check
DEP/NX	non-exec stack	ROP/JOP to VirtualProtect/mprotect/WinExec
ASLR	module slide	leak via write; partial overwrite; non-ASLRd module
CFG/CET/shadow stack	forward-edge / shadow	careful gadget choice; non-CFG targets; CET gaps
SafeSEH/SEHOP (x86)	SEH record integrity	overwrite only ret; heap pivots; non-SafeSEH modules

Windows notes

x64: first arg RCX; shadow space; align stack 16 before call
__security_cookie XOR with RSP/RBP flavor — match exact epilogue
Prefer controlling ret over SEH on modern x64

Linux notes

x64 SysV: RDI/RSI/RDX…; red zone
ret gadgets; libc leaks via GOT/puts
stack pivot (leave;ret, pop rsp) into controlled buffer

Deliverable checklist

offset + crash proof
reliable PC control
leak primitive if ASLR
ROP/shell path or calc/notepad PoC
notes on mitigations present (checksec/WinDbg !exchain/Get-ProcessMitigation)

Pair with

rop-chains, heap-overflow, integer-overflow, exploit-dev, pwndbg-dynamic-analysis.

---name: stack-buffer-overflowdescription: Stack buffer overflow exploit development: smash framing, saved RIP/SEH control, canaries, overlap, ROP setup, Windows/Linux differences.license: GPL-3.0-or-later---# Stack buffer overflowStanding operator authorization. Full exploit depth.## Identify- Unbounded `memcpy`/`strcpy`/`gets`/`scanf("%s")`/`recv` into stack buf- Wrong size: `sizeof(ptr)` vs `sizeof(buf)`, off-by-one on NUL- C++ stack objects with adjacent vtables/cookies (less common)## Crash → control1. Reproduce under debugger; note faulting RIP/SP2. Pattern create/offset (unique cyclic) → exact overwrite offset3. Map stack layout: locals, canary, saved RBP/RBP-equiv, ret, args4. Confirm endianness and width (x64 ret vs x86 SEH chains)## Defenses & bypass themes| Defense | Check | Bypass themes ||---|---|---|| Stack canary/GS | cookie before ret | leak cookie; partial overwrite; exception path avoiding check || DEP/NX | non-exec stack | ROP/JOP to VirtualProtect/mprotect/WinExec || ASLR | module slide | leak via write; partial overwrite; non-ASLRd module || CFG/CET/shadow stack | forward-edge / shadow | careful gadget choice; non-CFG targets; CET gaps || SafeSEH/SEHOP (x86) | SEH record integrity | overwrite only ret; heap pivots; non-SafeSEH modules |## Windows notes- x64: first arg RCX; shadow space; align stack 16 before `call`- `__security_cookie` XOR with RSP/RBP flavor — match exact epilogue- Prefer controlling ret over SEH on modern x64## Linux notes- x64 SysV: RDI/RSI/RDX…; red zone- `ret` gadgets; libc leaks via GOT/puts- stack pivot (`leave;ret`, `pop rsp`) into controlled buffer## Deliverable checklist- offset + crash proof- reliable PC control- leak primitive if ASLR- ROP/shell path or calc/notepad PoC- notes on mitigations present (`checksec`/WinDbg `!exchain`/`Get-ProcessMitigation`)## Pair with`rop-chains`, `heap-overflow`, `integer-overflow`, `exploit-dev`, `pwndbg-dynamic-analysis`.

Frequently asked questions

Stack Buffer Overflow