Exploit › Module 5 › Lesson 2
Fortify Sanitize
FORTIFY_SOURCE wraps libc calls; AddressSanitizer catches heap bugs at test time — run on YOUR $PWN_LAB toys in CI and local test.
Visual · pwn_fortify_sanitize
Fortify/sanitize literacy. $PWN_LAB only. Original Cyberlium.
Opening
Compile-time FORTIFY and test-time ASan turn silent corruption into loud failures — use both.
_FORTIFY_SOURCE=2 with -O2 adds bounds checks to selected libc functions at compile time — failures abort with clear message. AddressSanitizer (-fsanitize=address) instruments allocations in test binaries — slows down, catches UAF/overflow during development. Cyberlium runs ASan builds on YOUR toys at $PWN_LAB before merging fixes — not as a step toward weaponization. Next: Safe APIs.
1. FORTIFY_SOURCE (named)
Requires -O2 (or -O3) and glibc. Catches some compile-time-known overflow sizes in strcpy-like wrappers — not a substitute for safe coding.
On $PWN_LAB, trigger FORTIFY abort on toy BOF — observe message; fix with bounded copy; rebuild clean.
Command guide
Try these commands — FORTIFY_SOURCE (named)
═══ LINUX (Binary Analysis & Reverse Engineering) ═══
Disassemble main function using Intel assembly syntax
Command — copy this
objdump -d -M intel -j .text ./target_binary 2>/dev/null | head -30
Check binary security mitigations (NX, Canary, ASLR, PIE)
Command — copy this
checksec --file=./target_binary 2>/dev/null || readelf -l ./target_binary | grep GNU_STACK
Generate unique cyclic pattern for buffer overflow offset calculation
Command — copy this
python3 -c "
from itertools import product
chars = [b'A', b'B', b'C']
pattern = b''.join(b''.join(p) for p in product(b'ABCDEFGHIJKLMNOPQRSTUVWXYZ', b'abcdefghijklmnopqrstuvwxyz', b'0123456789'))[:128]
print('Cyclic Test Pattern (128 bytes):', pattern.decode())
"GDB debugging session quick start gdb -q ./target_binary (gdb) disassemble main (gdb) info registers
Primary tools to practice this lesson: gcc, curl. Reference sites: FORTIFY_SOURCE (https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html#index-D_005fFORTIFY_005fSOURCE); AddressSanitizer (https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html#index-fsanitize_003daddress); Microsoft SDL (https://learn.microsoft.com/en-us/security/sdl/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. AddressSanitizer (named)
Build with -fsanitize=address -g for test target. Run toy UAF demo — ASan prints allocation/free stack. Use ASAN_OPTIONS=log_path for CI artifacts.
Do not ship ASan binaries to production — test-only instrumentation.
3. CI habit
Pipeline: asan test job on toy suite, secure release job with FORTIFY + checksec gate. Failing ASan blocks merge — defender workflow.
Ship: fortify/sanitize card — flags, when to use, sample ASan one-liner from YOUR toy. Next: Safe APIs.
4. What you ship: FORTIFY/ASan card for $PWN_LAB
Flag lines for FORTIFY and ASan. Sample abort/ASan message from toy. Test vs release note. chmod 600.
5. What you record before the next lesson
Date. Fortify/sanitize card. $PWN_LAB named. File t24-m05-l02-fortify-sanitize.txt chmod 600.
6. Wrong vs right: weaponized exploits vs memory-safety literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Disable FORTIFY to 'see raw overflow.' Ship ASan binary as production release.
Right
Document FORTIFY/ASan with sample output from YOUR toy tests. Next: Safe APIs.
Mission: run ASan on one toy
1) Build toy with -fsanitize=address. 2) Paste one ASan error block. 3) Note FORTIFY flag in release Makefile. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
ASan in CI catches bugs before attackers do.
Knowledge Check
APPLY: FORTIFY_SOURCE helps by:
Multiple choice
Knowledge Check
APPLY: True or False: AddressSanitizer is for test builds, not typical production release.
True or False
Knowledge Check
APPLY: ASan report on YOUR toy primarily aids:
Multiple choice