> For the complete documentation index, see [llms.txt](https://www.ctfrecipes.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/stack-reading.md).

# Stack reading

Once the offset is obtain and cause a binary crash, it's possible to obtain the value of the next bytes on the stack that will not crash the binary by enumerate all the possible value.

**This technique is mostly used to leak the canary**

{% hint style="danger" %}
If the server is compiled with the [PIE](/pwn/protections/pie.md) flag or if there is a [stack canary](/pwn/protections/stack-canaries.md), the server must be a F**orking** daemon without stack re-randomization.
{% endhint %}

## How it work ?

The idea is to overflow a single byte of the targeted value, for example the canary, overwriting a single byte `x`

If `x` was correct, the binary will not crash.

The algorithm is repeated for all possible 256 byte values until it is found. The attack continues for the next byte until all bytes (8 on 64-bit) are leaked.