A vulnerable program

/* vul_prog. */
#include <stdlib.h>
#include <cstdlib>
#include <stdio.h>

int main(int argc, char *argv[])

{
char user_input[100];

scanf("%s", user_input); //getting a string from the user storing it on char

printf("You enter this : %s", user_input); //vulnerable part

return 0;
}

The printf function

Print formatted data to stdout

Writes the C string pointed by format to the standard output (stdout). If format includes format
specifiers (subsequences beginning with %), the additional arguments following format are
formatted and inserted in the resulting string replacing their respective specifiers.
format
C string that contains the text to be written to stdout. It can optionally contain embedded format
specifiers that are replaced by the values specified in subsequent additional arguments and
formatted as requested.
A format specifier follows this prototype: %[flags][width][. precision][length]specifier
Where the specifier character at the end is the most significant component, since it defines the type
and the interpretation of its corresponding argument: (some/common)
parameter meaning passed as
%d decimal (int) value
%u unsigned decimal (unsigned int) value
%x hexadecimal (unsigned int) value
%s string ((const) (unsigned) char*) reference
%n number of bytes written so far, (* int) reference

/* vul_prog. */
#include <stdlib.h>
#include <cstdlib>
#include <stdio.h>

int main(int argc, char *argv[])

{
int id = 1000, age = 25;
char *name = "Johnny Bravo";

printf("Id : %d ",id);
printf("\n");
printf("Name : %s ", name);
printf("\n");
printf("Age : %d ", age);

return 0;
}
Missing Argument
int main(int argc, char *argv[])
{
int id = 1000, age = 25;
char *name = "Johnny Bravo";

printf("Id : %d ",id);
printf("\n");
printf("Name : %s "); //this will cause an error, because it is null and cannot
print an address from memory/stack
printf("\n");
printf("Age : %d", age);

return 0;
}
Crashing A Program
A crash can happen when %s tried to read from unauthorized memory address.
In computing, a segmentation fault or access violation is a fault, or failure condition, raised by
hardware with memory protection, notifying an operating system the software has attempted to
access a restricted area of memory. 

Buffer Overflow Attack with Example

A buffer is a temporary area for data storage. When more data (than was originally allocated to be
stored) gets placed by a program or system process, the extra data overflows. It causes some of that
data to leak out into other buffers, which can corrupt or overwrite whatever data they were
holding.
Programmers is focused on how their programs will work and without understanding how its going
to work in relation to computer memory.
For Analogy
Think of a memory as a drinking glass
- The size of the glass
- How much water is already in
// A C program to demonstrate buffer overflow
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
  
int main(int argc, char *argv[])
{
  
       // Reserve 5 byte of buffer plus the terminating NULL.
       // should allocate 8 bytes = 2 double words,
       // To overflow, need more than 8 bytes...
       char buffer[5];  // If more than 8 characters input
                        // by user, there will be access 
                        // violation, segmentation fault
  
       // a prompt how to execute the program...
       if (argc < 2)
       {
              printf("strcpy() NOT executed....\n");
              printf("Syntax: %s <characters>\n", argv[0]);
              exit(0);
       }
  
       // copy the user input to mybuffer, without any
       // bound checking a secure version is srtcpy_s()
       strcpy(buffer, argv[1]);
       printf("buffer content= %s\n", buffer);
  
       // you may want to try strcpy_s()
       printf("strcpy() executed...\n");
  
       return 0;
}
-