Re: Blind Remote Buffer Overflow

[vision () WHITEHATS COM (Max Vision)]

On Mon, 1 May 2000, Blue Boar wrote:
> In many cases, you will have more than one shot at trying your
> buffer overflow.  One possibility is just trying them all.  If the
> service doesn't auto-restart, then try each arch a week apart, so the
> admin doesn't get suspicious.

The issue of admin suspicion should never come into this - anyone who
values their freedom will conduct their vulnerability research on their
local machines, or with explicit authorization from the remote admin.  The
vuln-dev phase is definitely not the right time to play seaky/clever games
over a network, regardless of one's intention.

Max