> For the complete documentation index, see [llms.txt](https://www.ctfrecipes.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.ctfrecipes.com/pwn/stack-exploitation.md).

# Stack exploitation

- [Stack Buffer Overflow](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow.md)
- [Dangerous functions](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/dangerous-functions.md)
- [gets](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/dangerous-functions/gets.md)
- [memcpy](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/dangerous-functions/memcpy.md)
- [sprintf](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/dangerous-functions/sprintf.md)
- [strcat](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/dangerous-functions/strcat.md)
- [strcpy](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/dangerous-functions/strcpy.md)
- [Basics](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/basics.md): Data overwrite
- [Challenge example](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/basics/challenge-example.md)
- [Instruction pointer Overwrite](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/instruction-pointer-overwrite.md): Arbitrary Instruction redirection
- [Challenge example](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/instruction-pointer-overwrite/challenge-example.md)
- [De Bruijn Sequences](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/de-bruijn-sequences.md): "Calculating" offset
- [Stack reading](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/stack-reading.md): Bruteforce as stack reader
- [Challenge example](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/stack-reading/challenge-example.md)
- [Format string](https://www.ctfrecipes.com/pwn/stack-exploitation/format-string.md)
- [Dangerous functions](https://www.ctfrecipes.com/pwn/stack-exploitation/format-string/dangerous-functions.md)
- [printf](https://www.ctfrecipes.com/pwn/stack-exploitation/format-string/dangerous-functions/printf.md)
- [fprintf](https://www.ctfrecipes.com/pwn/stack-exploitation/format-string/dangerous-functions/fprintf.md)
- [Placeholder](https://www.ctfrecipes.com/pwn/stack-exploitation/format-string/specifier.md)
- [Data Leak](https://www.ctfrecipes.com/pwn/stack-exploitation/format-string/data-leak.md)
- [Challenge example](https://www.ctfrecipes.com/pwn/stack-exploitation/format-string/data-leak/challenge-example.md)
- [Data modification](https://www.ctfrecipes.com/pwn/stack-exploitation/format-string/data-modification.md)
- [Challenge example](https://www.ctfrecipes.com/pwn/stack-exploitation/format-string/data-modification/data-modification.md)
- [Arbitrary code execution](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution.md)
- [Shellcode](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/arbitrary-code-execution.md)
- [ret2reg](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/ret2reg.md): Using register
- [Code reuse attack](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack.md)
- [Ret2plt](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/ret2plt.md): ASLR bypass
- [Ret2dlresolve](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/ret2dlresolve.md): Resolving an arbitrary libc functions
- [GOT Overwrite](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/got-overwrite.md)
- [Ret2LibC](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/ret2libc.md)
- [Leaking LibC](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/leaking-libc.md): ASLR bypass
- [Ret2csu](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/ret2csu.md): Controlling registers
- [Return Oriented Programming - ROP](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/return-oriented-programming-rop.md)
- [Sigreturn Oriented Programming - SROP](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/sigreturn-oriented-programming-srop.md): A syscall to rule them all
- [Blind Return Oriented Programming - BROP](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/blind-return-oriented-programming-brop.md)
- [Challenge example](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/blind-return-oriented-programming-brop/challenge-example.md)
- [Call Oriented Programming - COP](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/call-oriented-programming-cop.md)
- [Jump Oriented Programming - JOP](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/jump-oriented-programming-jop.md)
- [One gadget](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/one-gadget.md): Quick win
- [Stack pivoting](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/stack-pivoting.md): ROP with a small buffer