Stack Buffer Overflow Exploitation

You are exploiting a classic stack buffer overflow in a 32-bit Linux binary during a CTF or authorized penetration test.

**Vulnerability Confirmation**
- How do you confirm a buffer overflow is stack-based vs heap-based?
- What crash output confirms EIP control? What does a segfault without EIP control tell you?
- How do you determine the exact offset to EIP using a cyclic/De Bruijn pattern?

**Environment Profiling**
- Which protections are active? (ASLR, NX/DEP, Stack Canary, PIE)
- How does each active protection change your exploit strategy?
- How do you check for exploitable memory regions when NX is off?

**Shellcode Approach (NX disabled)**
- How do you find a reliable return address to your shellcode?
- Why do NOPs matter and how large should a NOP sled be?
- How do you handle bad characters in your shellcode?
- How do you generate shellcode for a specific OS and architecture?

**ROP Approach (NX enabled)**
- What is a ROP gadget and how do you find one?
- What is the minimum ROP chain to call system("/bin/sh")?
- How do you handle ASLR if a library base leak is available?

**Exploit Reliability**
- What makes an exploit unreliable across environments?
- How do you test an exploit across multiple OS versions or configurations?

Output:
- Step-by-step exploitation methodology
- Checklist: protections → technique selection
- Pwntools skeleton for 32-bit Linux ret2shellcode and ret2libc