Exploitation basics in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary goal of a buffer overflow exploit?

In cybersecurity, buffer overflow is a common exploitation technique. What is the main objective an attacker tries to achieve by exploiting a buffer overflow vulnerability?

A To increase the size of the buffer for better performance

B To overwrite adjacent memory to execute arbitrary code

C To encrypt data stored in memory for security

D To prevent unauthorized access by limiting buffer size

💡 Hint

Think about what happens when data exceeds the allocated space in memory.

Buffer overflow exploits aim to overwrite adjacent memory areas, often to inject and execute malicious code.

📋 Factual

intermediate

Which of the following is NOT a common exploitation technique?

Identify the option that is NOT typically used as an exploitation technique in cybersecurity.

A SQL Injection

B Cross-Site Scripting (XSS)

C Phishing Emails

D Denial of Service (DoS) Attack

💡 Hint

Consider which option is more of a social engineering attack rather than a direct exploitation of software vulnerabilities.

Phishing is a social engineering technique, not a direct software exploitation method like the others.

🔍 Analysis

advanced

What error does this code snippet cause when exploited?

Consider this vulnerable C code snippet:

char buffer[10];
strcpy(buffer, input);

If input is longer than 10 characters, what error or behavior is most likely to occur?

A Buffer overflow leading to memory corruption

B Compilation error due to buffer size mismatch

C Automatic input validation preventing overflow

D Input truncation without any error

💡 Hint

Think about what strcpy does and what happens if the input is too large.

strcpy copies input without checking size, causing buffer overflow and possible memory corruption.

❓ Comparison

advanced

Compare stack-based and heap-based buffer overflows.

Which statement correctly distinguishes between stack-based and heap-based buffer overflow vulnerabilities?

A Heap-based overflows are always safe due to memory management; stack-based overflows are dangerous

B Heap-based overflows overwrite function return addresses; stack-based overflows corrupt global variables

C Stack-based overflows only occur in interpreted languages; heap-based overflows occur in compiled languages

D Stack-based overflows overwrite local variables; heap-based overflows corrupt dynamically allocated memory

💡 Hint

Consider where local variables and dynamic memory are stored in a program.

Stack-based overflows affect local variables and control data on the stack; heap-based overflows affect dynamically allocated memory on the heap.

❓ Reasoning

expert

Why is Address Space Layout Randomization (ASLR) effective against exploitation?

ASLR is a security technique used to prevent exploitation. Why does randomizing memory addresses make exploitation harder?

A It prevents attackers from predicting where code or data is located in memory

B It encrypts all memory contents to block unauthorized access

C It disables all buffer overflow vulnerabilities automatically

D It forces programs to run in a sandbox environment

💡 Hint

Think about how attackers rely on knowing memory locations to exploit vulnerabilities.

ASLR randomizes memory layout so attackers cannot reliably guess addresses needed for exploits like buffer overflows.