SherbyNet - /page/wikibook/entry.mu

Micron Document

<!DOCTYPE html>

<title>Shellcode</title>

</head>

<span id="openzim-page-title" class="mw-page-title-main"><span class="mw-page-title-main">Shellcode</span></span>

</h1>

</header>

/* start https://en.wikipedia.org/ */

.mw-parser-output .ambox{border:1px solid #a2a9b1;border-left:10px solid #36c;background-color:#fbfbfb;box-sizing:border-box}.mw-parser-output .ambox+link+.ambox,.mw-parser-output .ambox+link+style+.ambox,.mw-parser-output .ambox+link+link+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+style+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+link+.ambox{margin-top:-1px}html body.mediawiki .mw-parser-output .ambox.mbox-small-left{margin:4px 1em 4px 0;overflow:hidden;width:238px;border-collapse:collapse;font-size:88%;line-height:1.25em}.mw-parser-output .ambox-speedy{border-left:10px solid #b32424;background-color:#fee7e6}.mw-parser-output .ambox-delete{border-left:10px solid #b32424}.mw-parser-output .ambox-content{border-left:10px solid #f28500}.mw-parser-output .ambox-style{border-left:10px solid #fc3}.mw-parser-output .ambox-move{border-left:10px solid #9932cc}.mw-parser-output .ambox-protection{border-left:10px solid #a2a9b1}.mw-parser-output .ambox .mbox-text{border:none;padding:0.25em 0.5em;width:100%}.mw-parser-output .ambox .mbox-image{border:none;padding:2px 0 2px 0.5em;text-align:center}.mw-parser-output .ambox .mbox-imageright{border:none;padding:2px 0.5em 2px 0;text-align:center}.mw-parser-output .ambox .mbox-empty-cell{border:none;padding:0;width:1px}.mw-parser-output .ambox .mbox-image-div{width:52px}@media(min-width:720px){.mw-parser-output .ambox{margin:0 10%}}@media print{body.ns-0 .mw-parser-output .ambox{display:none!important}}

/* end https://en.wikipedia.org/ */

</style>

/* start https://en.wikipedia.org/ */

.mw-parser-output .hatnote{font-style:italic}.mw-parser-output div.hatnote{padding-left:1.6em;margin-bottom:0.5em}.mw-parser-output .hatnote i{font-style:normal}.mw-parser-output .hatnote+link+.hatnote{margin-top:-0.5em}@media print{body.ns-0 .mw-parser-output .hatnote{display:none!important}}

/* end https://en.wikipedia.org/ */

</style><div role="note" class="hatnote navigation-not-searchable">"Shell code" redirects here. For code written in a shell's command language, see <a href="Shell_script" title="Shell script">Shell script</a>.</div>

<div role="note" class="hatnote navigation-not-searchable">"Alphanumeric executable" redirects here. For executable code presented in hexadecimal format, see <a href="Hex_file_(disambiguation)" class="mw-redirect mw-disambig" title="Hex file (disambiguation)">Hex file (disambiguation)</a>.</div>

<p><b>Shellcode</b> is <a href="Executable_code" class="mw-redirect" title="Executable code">executable code</a> intended to be used as a <a href="Payload_(computing)" title="Payload (computing)">payload</a> for <a href="Exploit_(computer_security)" title="Exploit (computer security)">exploiting</a> a <a href="Software" title="Software">software</a> <a href="Vulnerability_(computing)" class="mw-redirect" title="Vulnerability (computing)">vulnerability</a>. The term includes <i>shell</i> because the attack originally described an attack that opens a <a href="Shell_(computing)" title="Shell (computing)">command shell</a> that the attacker can use to control the target machine, but any code that is injected to gain access that is otherwise not allowed can be called shellcode. For this reason, some consider the name <i>shellcode</i> to be inaccurate.<sup id="cite_ref-1" class="reference"><a href="#cite_note-1"><span class="cite-bracket">[</span>1<span class="cite-bracket">]</span></a></sup>

</p><p>An attack commonly injects <a href="Data" title="Data">data</a> that consists of executable code into a <a href="Process_(computing)" title="Process (computing)">process</a> before or as it exploits a vulnerability to gain control. The <a href="Program_counter" title="Program counter">program counter</a> is set the shellcode <a href="Entry_point" title="Entry point">entry point</a> so that that the shellcode runs. Deploying shellcode is often accomplished by including the code in a file that a vulnerable process downloads and then loads into its memory.

</p><p>Common wisdom dictates that to maximum effectiveness, a shellcode payload should be small.<sup id="cite_ref-anley_koziol_2007_2-0" class="reference"><a href="#cite_note-anley_koziol_2007-2"><span class="cite-bracket">[</span>2<span class="cite-bracket">]</span></a></sup> <a href="Machine_code" title="Machine code">Machine code</a> provides the flexibility needed to accomplish the goal. Shellcode <a href="Hacker" title="Hacker">authors</a> leverage small opcodes to create compact shellcode.<sup id="cite_ref-3" class="reference"><a href="#cite_note-3"><span class="cite-bracket">[</span>3<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-4" class="reference"><a href="#cite_note-4"><span class="cite-bracket">[</span>4<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading2"><h2 id="Types">Types</h2></div>

<dl><dt>Local</dt></dl>

<p>A local shellcode attack allows an attacker to gain elevated access privilege on their computer. In some cases, exploiting a vulnerability can be achieved by causing an error such as <a href="Buffer_overflow" title="Buffer overflow">buffer overflow</a>. If successful, the shellcode enables access to the machine via the elevated privileges granted to the targeted process.

</p>

<dl><dt>Remote</dt></dl>

<p>A remote shellcode attack targets a process running on a remote machine – on the same <a href="Local_area_network" title="Local area network">local area network</a>, <a href="Intranet" title="Intranet">intranet</a>, or on the <a href="Internet" title="Internet">internet</a>. If successful, the shellcode provides access to the target machine across the network. The shellcode normally opens a <a href="Internet_protocol_suite" title="Internet protocol suite"> TCP/IP</a> <a href="Stream_socket" class="mw-redirect" title="Stream socket"> socket</a> connection to allow access to a shell on the target machine.

</p><p>A remote shellcode attack can be categorized by its behavior. If the shellcode establishes the connection it is called a <i>reverse shell</i>, or a <i>connect-back</i> shellcode. On the other hand, if the attacker establishes the connection, the shellcode is called a <i>bindshell</i> because the shellcode <i>binds</i> to a certain port on the victim's machine. A <i>bindshell random port</i> skips the binding part and listens on a random port.<sup id="cite_ref-5" class="reference"><a href="#cite_note-5"><span class="cite-bracket">[</span>a<span class="cite-bracket">]</span></a></sup> A <i>socket-reuse</i> shellcode is an exploit that establishes a connection to the vulnerable process that is not closed before the shellcode runs so that the shellcode can re-use the connection to allow remote access. Socket re-using shellcode is more elaborate, since the shellcode needs to find out which connection to re-use and the machine may have many open connections.<sup id="cite_ref-6" class="reference"><a href="#cite_note-6"><span class="cite-bracket">[</span>5<span class="cite-bracket">]</span></a></sup>

</p><p>A <a href="Firewall_(computer)" class="mw-redirect" title="Firewall (computer)">firewall</a> can detect outgoing connections made by connect-back shellcode as well as incoming connections made by bindshells, and therefore, offers some protection against an attack. Even if the system is vulnerable, a firewall can prevent the attacker from connecting to the shell created by the shellcode. One reason why socket re-using shellcode is used is that it does not create new connections and, therefore, is harder to detect and block.

</p>

<dl><dt>Download and execute</dt></dl>

<p>A download and execute shellcode attack <a href="Downloads" class="mw-redirect" title="Downloads">downloads</a> and <a href="Execution_(computers)" class="mw-redirect" title="Execution (computers)">executes</a> <a href="Malware" title="Malware">malware</a> on the target system. This type of shellcode does not spawn a shell, but rather instructs the machine to download a certain executable file from the network and execute it. Nowadays, it is commonly used in <a href="Drive-by_download" title="Drive-by download">drive-by download</a> attacks, where a victim visits a malicious webpage that in turn attempts to run such a download and execute shellcode in order to install software on the victim's machine.

</p><p>A variation of this attack downloads and <a href="Dynamic_loading" title="Dynamic loading"> loads</a> a <a href="Library_(computing)" title="Library (computing)">library</a>.<sup id="cite_ref-7" class="reference"><a href="#cite_note-7"><span class="cite-bracket">[</span>6<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-8" class="reference"><a href="#cite_note-8"><span class="cite-bracket">[</span>7<span class="cite-bracket">]</span></a></sup> Advantages of this technique are that the code can be smaller, that it does not require the shellcode to spawn a new process on the target system, and that the shellcode does not need code to clean up the targeted process as this can be done by the library loaded into the process.

</p>

<dl><dt>Staged</dt></dl>

<p>When the amount of data that an attacker can inject into the target process is too limited to achieve the desired effect, it may be possible to deploy shellcode in stages that progressively provide more access. The first stage might do nothing more than download the second stage than then provides the desired access.

</p>

<p>An egg-hunt shellcode attack is a staged attack in which the attacker can inject shellcode into a process but does not know where in the process it is. A second-stage shellcode, generally smaller than the first, is injected into the process to search the process's address space for the first shellcode (the <i>egg</i>) and executes it.<sup id="cite_ref-9" class="reference"><a href="#cite_note-9"><span class="cite-bracket">[</span>8<span class="cite-bracket">]</span></a></sup>

</p>

<dl><dt>Omelet</dt></dl>

<p>An omelet shellcode attack, similar to egg-hunt, looks for multiple small blocks of data (<i>eggs</i>) and combines them into a larger block (<i>omelet</i>) that is then executed. This is used when an attacker is limited on the size of injected code but can inject multiple.<sup id="cite_ref-10" class="reference"><a href="#cite_note-10"><span class="cite-bracket">[</span>9<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading2"><h2 id="Encoding">Encoding</h2></div>

<p>Shellcode is often written in order to work around the restrictions on the data that a process will allow. General techniques include:

</p>

<dl><dt>Optimize for size</dt></dl>

<p>Optimize the code to decrease its size.

</p>

<dl><dt>Self-modifying code</dt></dl>

<p><a href="Self-modifying_code" title="Self-modifying code">Modify its own code</a> before executing it to use byte values that are otherwise restricted.

</p>

<dl><dt>Encryption</dt></dl>

<p>To avoid <a href="Intrusion_detection" class="mw-redirect" title="Intrusion detection">intrusion detection</a>, encode as self-decrypting or <a href="Polymorphic_code" title="Polymorphic code">polymorphic</a>.

</p>

<dl><dt>Character encoding</dt></dl>

<p>An attack that targets a browser might obfuscate shellcode in a <a href="JavaScript" title="JavaScript">JavaScript</a> string using an expanded character encoding.<sup id="cite_ref-11" class="reference"><a href="#cite_note-11"><span class="cite-bracket">[</span>10<span class="cite-bracket">]</span></a></sup> For example, on the <a href="IA-32" title="IA-32">IA-32</a> architecture, here's two unencoded no-operation instructions (used in a <a href="NOP_slide" title="NOP slide">NOP slide</a>):

</p>

<pre>90 NOP

90 NOP

</pre>

<p>As encoded:

</p>

<ul><li><a href="Percent-encoding" title="Percent-encoding">Percent encoded</a>: <code class="mw-highlight mw-highlight-lang-text mw-content-ltr" style="" dir="ltr">unescape("%u9090")</code></li>

<li><a href="Unicode" title="Unicode">Unicode</a> literal: <code class="mw-highlight mw-highlight-lang-text mw-content-ltr" style="" dir="ltr">\u9090</code></li>

<li><a href="Character_encodings_in_HTML" title="Character encodings in HTML">HTML/XML character reference</a> : <code class="mw-highlight mw-highlight-lang-text mw-content-ltr" style="" dir="ltr">&#x9090;</code> or <code class="mw-highlight mw-highlight-lang-text mw-content-ltr" style="" dir="ltr">&#37008;</code></li></ul>

<p>Shellcode must be written without zero-value bytes when it is intended to be injected into a <a href="Null-terminated_string" title="Null-terminated string">null-terminated string</a> that is copied in the target process via the usual algorithm (i.e. <a href="Strcpy" class="mw-redirect" title="Strcpy">strcpy</a>) of ending the copy at the first zero byte – called the <a href="Null_character" title="Null character">null character</a> in common <a href="Character_set" class="mw-redirect" title="Character set">character sets</a>. If the shellcode contained a null, the copy would be truncated and not function properly. To produce null-free code from code that contains nulls, one can replace machine instructions that contain zeroes with instructions that don't. For example, on the <a href="IA-32" title="IA-32">IA-32</a> architecture the instruction to set register EAX to 1 contains zeroes as part of the literal (<code>1</code> expands to <code>0x00000001</code>).

</p>

<pre>B8 01000000 <a href="MOV_(x86_instruction)" class="mw-redirect" title="MOV (x86 instruction)">MOV</a> EAX,1

</pre>

<p>The following instructions accomplish the same goal (EAX containing 1) without embedded zero bytes by first setting EAX to 0, then incrementing EAX to 1:

</p>

<pre>33C0 XOR EAX,EAX

40 INC EAX

</pre>

<p>An alphanumeric shellcode consists of only <a href="Alphanumeric" class="mw-redirect" title="Alphanumeric">alphanumeric</a> characters (0–9, A–Z and a–z).<sup id="cite_ref-Rix_2001_12-0" class="reference"><a href="#cite_note-Rix_2001-12"><span class="cite-bracket">[</span>11<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-Obscou_2003_13-0" class="reference"><a href="#cite_note-Obscou_2003-13"><span class="cite-bracket">[</span>12<span class="cite-bracket">]</span></a></sup> This type of encoding was created by <a href="Hacker_(computer_security)" class="mw-redirect" title="Hacker (computer security)">hackers</a> to obfuscate machine code inside what appears to be <a href="Plain_text" title="Plain text">plain text</a>. This can be useful to avoid detection of the code; to allow the code to pass through filters that scrub non-alphanumeric characters from strings.<sup id="cite_ref-14" class="reference"><a href="#cite_note-14"><span class="cite-bracket">[</span>b<span class="cite-bracket">]</span></a></sup>. A similar type of encoding is called <i>printable code</i> and uses all <a href="Control_character" title="Control character">printable</a> characters (alphanumeric plus symbols like !@#%^&*). A similarly restricted variant is <i>ECHOable code</i> not containing any characters which are not accepted by the <a href="ECHO_(command)" class="mw-redirect" title="ECHO (command)">ECHO</a> command. It has been shown that it is possible to create shellcode that looks like normal text in English.<sup id="cite_ref-Mason-Small-Monrose-MacManus_2009_15-0" class="reference"><a href="#cite_note-Mason-Small-Monrose-MacManus_2009-15"><span class="cite-bracket">[</span>13<span class="cite-bracket">]</span></a></sup>

Writing such shellcode requires in-depth understanding of the <a href="Instruction_set_architecture" title="Instruction set architecture">instruction set architecture</a> of the target machines. It has been demonstrated that it is possible to write alphanumeric code that is executable on more than one machine,<sup id="cite_ref-16" class="reference"><a href="#cite_note-16"><span class="cite-bracket">[</span>14<span class="cite-bracket">]</span></a></sup> thereby constituting <a href="Multi-architecture_executable" class="mw-redirect" title="Multi-architecture executable">multi-architecture executable</a> code.

</p><p>A work-around was published by Rix in <a href="Phrack" title="Phrack">Phrack</a> 57<sup id="cite_ref-Rix_2001_12-1" class="reference"><a href="#cite_note-Rix_2001-12"><span class="cite-bracket">[</span>11<span class="cite-bracket">]</span></a></sup> in which he shows that it is possible to turn any code into alphanumeric code. Often, self-modifying code is leveraged because it allows the code to have byte values that otherwise are not allowed by replacing coded values at runtime. A self-modifying decoder can be created that initially uses only allowed bytes. The main code of the shellcode is encoded, also only using bytes in the allowed range. When the output shellcode is run, the decoder modifies its code to use instructions it requires and then decodes the original shellcode. After decoding the shellcode, the decoder transfers control to it. It has been shown that it is possible to create arbitrarily complex shellcode that looks like normal English text.<sup id="cite_ref-Mason-Small-Monrose-MacManus_2009_15-1" class="reference"><a href="#cite_note-Mason-Small-Monrose-MacManus_2009-15"><span class="cite-bracket">[</span>13<span class="cite-bracket">]</span></a></sup>

</p><p>Modern software uses <a href="Unicode" title="Unicode">Unicode</a> to support <a href="Internationalization_and_localization" title="Internationalization and localization">Internationalization and localization</a>. Often, input <a href="ASCII" title="ASCII">ASCII</a> text is converted to Unicode before processing. When an ASCII (<a href="Latin-1" class="mw-redirect" title="Latin-1">Latin-1</a> in general) character is transformed to UTF-16 (16-bit Unicode), a zero byte is inserted after each byte (character) of the original text. Obscou proved in <a href="Phrack" title="Phrack">Phrack</a> 61<sup id="cite_ref-Obscou_2003_13-1" class="reference"><a href="#cite_note-Obscou_2003-13"><span class="cite-bracket">[</span>12<span class="cite-bracket">]</span></a></sup> that it is possible to write shellcode that can run successfully after this transformation. Programs that can automatically encode any shellcode into alphanumeric UTF-16-proof shellcode exist, based on the same principle of a small self-modifying decoder that decodes the original shellcode.

</p>

<div class="mw-heading mw-heading2"><h2 id="Compatibility">Compatibility</h2></div>

<p>Generally, shellcode is deployed as machine code since it affords relatively unprotected access to the target process. Since machine code is compatible within a relatively narrow computing context (<a href="Central_processing_unit" title="Central processing unit">processor</a>, <a href="Operating_system" title="Operating system">operating system</a> and so on), a shellcode fragment has limited <a href="Compatibility_(computing)" class="mw-redirect" title="Compatibility (computing)">compatibility</a>. Also, since a shellcode attack tends to work best when the code is small and targeting multiple exploits increases the size, typically the code targets only one exploit. None the less, a single shellcode fragment can work for multiple contexts

and exploits.<sup id="cite_ref-Eugene_2001_17-0" class="reference"><a href="#cite_note-Eugene_2001-17"><span class="cite-bracket">[</span>15<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-Nemo_2005_18-0" class="reference"><a href="#cite_note-Nemo_2005-18"><span class="cite-bracket">[</span>16<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-Cha-Pak-Brumley-Lipton_2010_19-0" class="reference"><a href="#cite_note-Cha-Pak-Brumley-Lipton_2010-19"><span class="cite-bracket">[</span>17<span class="cite-bracket">]</span></a></sup> Versatility can be achieved by creating a single fragment that contains an implementation for multiple contexts. Common code branches to the implementation for the runtime context.

</p>

<div class="mw-heading mw-heading2"><h2 id="Analysis">Analysis</h2></div>

<p>As shellcode is generally not executable on its own, in order to study what it does, it is typically loaded into a special process. A common technique is to write a small <a href="C_(programming_language)" title="C (programming language)">C</a> program that contains the shellcode as data (i.e. in a byte buffer), and transfers control to the instructions encoded in the data <a href="Function_pointer" title="Function pointer">function pointer</a> or inline <a href="Assembly_code" class="mw-redirect" title="Assembly code">assembly code</a>). Another technique is to use an online tool, such as <style data-mw-deduplicate="TemplateStyles:r886049734">

/* start https://en.wikipedia.org/ */

.mw-parser-output .monospaced{font-family:monospace,monospace}

/* end https://en.wikipedia.org/ */

</style><span class="monospaced">shellcode_2_exe</span>, to embed the shellcode into a pre-made executable husk which can then be analyzed in a standard debugger. Specialized shellcode analysis tools also exist, such as the iDefense sclog project (originally released in 2005 in the Malcode Analyst Pack). Sclog is designed to load external shellcode files and execute them within an API logging framework. Emulation-based shellcode analysis tools also exist such as the <span class="monospaced">sctest</span> application which is part of the cross-platform libemu package. Another emulation-based shellcode analysis tool, built around the libemu library, is <span class="monospaced">scdbg</span> which includes a basic debug shell and integrated reporting features.

</p>

<ul><li><a href="Computer_security" title="Computer security">Computer security</a> – Protection of computer systems from information disclosure, theft or damage</li>

<li><a href="Heap_overflow" title="Heap overflow">Heap overflow</a> – Software anomaly</li>

<li><a href="Metasploit_Project" class="mw-redirect" title="Metasploit Project">Metasploit Project</a> – Computer security testing tool<span style="display:none" class="category-annotation-with-redirected-description">Pages displaying short descriptions of redirect targets</span></li>

<li><a href="Shell_shoveling" title="Shell shoveling">Shell shoveling</a> – Redirecting the input and output of a shell to a service so that it can be remotely accessed</li>

<li><a href="Stack_buffer_overflow" title="Stack buffer overflow">Stack buffer overflow</a> – Software anomaly</li></ul>

<div class="mw-heading mw-heading2"><h2 id="Notes">Notes</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .reflist{margin-bottom:0.5em;list-style-type:decimal}@media screen{.mw-parser-output .reflist{font-size:90%}}.mw-parser-output .reflist .references{font-size:100%;margin-bottom:0;list-style-type:inherit}.mw-parser-output .reflist-columns-2{column-width:30em}.mw-parser-output .reflist-columns-3{column-width:25em}.mw-parser-output .reflist-columns{margin-top:0.3em}.mw-parser-output .reflist-columns ol{margin-top:0}.mw-parser-output .reflist-columns li{page-break-inside:avoid;break-inside:avoid-column}.mw-parser-output .reflist-upper-alpha{list-style-type:upper-alpha}.mw-parser-output .reflist-upper-roman{list-style-type:upper-roman}.mw-parser-output .reflist-lower-alpha{list-style-type:lower-alpha}.mw-parser-output .reflist-lower-greek{list-style-type:lower-greek}.mw-parser-output .reflist-lower-roman{list-style-type:lower-roman}

/* end https://en.wikipedia.org/ */

</style><div class="reflist reflist-lower-alpha">

<li id="cite_note-5"><span class="mw-cite-backlink"><b><a href="#cite_ref-5">^</a></b></span> <span class="reference-text">The <i><a rel="nofollow" class="external text" href="https://github.com/geyslan/SLAE/blob/master/improvements/tiny_shell_bind_tcp_random_port_x86_64.asm">bindshell random port</a></i> is the smallest stable bindshell shellcode for <a href="X86-64" title="X86-64">x86_64</a> available to date.</span>

</li>

<li id="cite_note-14"><span class="mw-cite-backlink"><b><a href="#cite_ref-14">^</a></b></span> <span class="reference-text">in part, such filters were a response to non-alphanumeric shellcode exploits</span>

</li>

</ol></div></div>

<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("./mw/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("./mw/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("./mw/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("./mw/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}

/* end https://en.wikipedia.org/ */

</style><cite id="CITEREFFosterPrice2005" class="citation book cs1">Foster, James C.; Price, Mike (2005-04-12). <a rel="nofollow" class="external text" href="https://books.google.com/books?id=ZNI5dvBSfZoC"><i>Sockets, Shellcode, Porting, & Coding: Reverse Engineering Exploits and Tool Coding for Security Professionals</i></a>. Elsevier Science & Technology Books. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>1-59749-005-9</bdi>.</cite></span>

</li>

<li id="cite_note-anley_koziol_2007-2"><span class="mw-cite-backlink"><b><a href="#cite_ref-anley_koziol_2007_2-0">^</a></b></span> <span class="reference-text"><cite id="CITEREFAnleyKoziol2007" class="citation book cs1">Anley, Chris; Koziol, Jack (2007). <i>The shellcoder's handbook: discovering and exploiting security holes</i> (2 ed.). Indianapolis, Indiana, UA: Wiley. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-0-470-19882-7</bdi>. <a href="OCLC_(identifier)" class="mw-redirect" title="OCLC (identifier)">OCLC</a> <a rel="nofollow" class="external text" href="https://search.worldcat.org/oclc/173682537">173682537</a>.</cite></span>

</li>

<li id="cite_note-3"><span class="mw-cite-backlink"><b><a href="#cite_ref-3">^</a></b></span> <span class="reference-text"><cite id="CITEREFFoster2005" class="citation book cs1">Foster, James C. (2005). <i>Buffer overflow attacks: detect, exploit, prevent</i>. Rockland, MA, USA: Syngress. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>1-59749-022-9</bdi>. <a href="OCLC_(identifier)" class="mw-redirect" title="OCLC (identifier)">OCLC</a> <a rel="nofollow" class="external text" href="https://search.worldcat.org/oclc/57566682">57566682</a>.</cite></span>

</li>

<li id="cite_note-4"><span class="mw-cite-backlink"><b><a href="#cite_ref-4">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://github.com/geyslan/SLAE/blob/master/4th.assignment/tiny_execve_sh.asm">"Tiny Execve sh - Assembly Language - Linux/x86"</a>. <i>GitHub</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2021-02-01</span></span>.</cite></span>

</li>

<li id="cite_note-6"><span class="mw-cite-backlink"><b><a href="#cite_ref-6">^</a></b></span> <span class="reference-text"><cite id="CITEREFBHA2013" class="citation web cs1">BHA (2013-06-06). <a rel="nofollow" class="external text" href="http://www.blackhatlibrary.net/Shellcode/Socket-reuse">"Shellcode/Socket-reuse"</a><span class="reference-accessdate">. Retrieved <span class="nowrap">2013-06-07</span></span>.</cite></span>

</li>

<li id="cite_note-7"><span class="mw-cite-backlink"><b><a href="#cite_ref-7">^</a></b></span> <span class="reference-text"><cite id="CITEREFSkyLined2010" class="citation web cs1">SkyLined (2010-01-11). <a rel="nofollow" class="external text" href="https://web.archive.org/web/20100123014637/http://skypher.com/index.php/2010/01/11/download-and-loadlibrary-shellcode-released/">"Download and LoadLibrary shellcode released"</a>. Archived from <a rel="nofollow" class="external text" href="http://skypher.com/index.php/2010/01/11/download-and-loadlibrary-shellcode-released/">the original</a> on 2010-01-23<span class="reference-accessdate">. Retrieved <span class="nowrap">2010-01-19</span></span>.</cite></span>

</li>

<li id="cite_note-8"><span class="mw-cite-backlink"><b><a href="#cite_ref-8">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://code.google.com/p/w32-dl-loadlib-shellcode/">"Download and LoadLibrary shellcode for x86 Windows"</a>. 2010-01-11<span class="reference-accessdate">. Retrieved <span class="nowrap">2010-01-19</span></span>.</cite></span>

</li>

<li id="cite_note-9"><span class="mw-cite-backlink"><b><a href="#cite_ref-9">^</a></b></span> <span class="reference-text"><cite id="CITEREFSkape2004" class="citation web cs1">Skape (2004-03-09). <a rel="nofollow" class="external text" href="http://www.hick.org/code/skape/papers/egghunt-shellcode.pdf">"Safely Searching Process Virtual Address Space"</a> <span class="cs1-format">(PDF)</span>. nologin<span class="reference-accessdate">. Retrieved <span class="nowrap">2009-03-19</span></span>.</cite></span>

</li>

<li id="cite_note-10"><span class="mw-cite-backlink"><b><a href="#cite_ref-10">^</a></b></span> <span class="reference-text"><cite id="CITEREFSkyLined2009" class="citation web cs1">SkyLined (2009-03-16). <a rel="nofollow" class="external text" href="https://web.archive.org/web/20090323030636/http://skypher.com/wiki/index.php?title=Shellcode%2Fw32_SEH_omelet_shellcode">"w32 SEH omelet shellcode"</a>. Skypher.com. Archived from <a rel="nofollow" class="external text" href="http://skypher.com/wiki/index.php?title=Shellcode/w32_SEH_omelet_shellcode">the original</a> on 2009-03-23<span class="reference-accessdate">. Retrieved <span class="nowrap">2009-03-19</span></span>.</cite></span>

</li>

<li id="cite_note-11"><span class="mw-cite-backlink"><b><a href="#cite_ref-11">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://web.archive.org/web/20150403203325/http://www.iss.net/security_center/reference/vuln/JavaScript_Large_Unescape.htm">"JavaScript large number of unescape patterns detected"</a>. Archived from <a rel="nofollow" class="external text" href="http://www.iss.net/security_center/reference/vuln/JavaScript_Large_Unescape.htm">the original</a> on 2015-04-03.</cite></span>

</li>

<li id="cite_note-Rix_2001-12"><span class="mw-cite-backlink">^ <a href="#cite_ref-Rix_2001_12-0"><sup><i><b>a</b></i></sup></a> <a href="#cite_ref-Rix_2001_12-1"><sup><i><b>b</b></i></sup></a></span> <span class="reference-text"><cite id="CITEREFrix2001" class="citation journal cs1">rix (2001-08-11). <a rel="nofollow" class="external text" href="http://www.phrack.org/issues.html?issue=57&id=15#article">"Writing ia32 alphanumeric shellcodes"</a>. <i>Phrack</i>. <b>0x0b</b> (57). Phrack Inc. #0x0f of 0x12. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20220308045645/http://phrack.org/issues/57/15.html#article">Archived</a> from the original on 2022-03-08<span class="reference-accessdate">. Retrieved <span class="nowrap">2022-05-26</span></span>.</cite></span>

</li>

<li id="cite_note-Obscou_2003-13"><span class="mw-cite-backlink">^ <a href="#cite_ref-Obscou_2003_13-0"><sup><i><b>a</b></i></sup></a> <a href="#cite_ref-Obscou_2003_13-1"><sup><i><b>b</b></i></sup></a></span> <span class="reference-text"><cite id="CITEREFobscou2003" class="citation journal cs1">obscou (2003-08-13). <a rel="nofollow" class="external text" href="http://www.phrack.org/issues.html?issue=61&id=11#article">"Building IA32 'Unicode-Proof' Shellcodes"</a>. <i>Phrack</i>. <b>11</b> (61). Phrack Inc. #0x0b of 0x0f. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20220526165740/http://phrack.org/issues/61/11.html#article">Archived</a> from the original on 2022-05-26<span class="reference-accessdate">. Retrieved <span class="nowrap">2008-02-29</span></span>.</cite></span>

</li>

<li id="cite_note-Mason-Small-Monrose-MacManus_2009-15"><span class="mw-cite-backlink">^ <a href="#cite_ref-Mason-Small-Monrose-MacManus_2009_15-0"><sup><i><b>a</b></i></sup></a> <a href="#cite_ref-Mason-Small-Monrose-MacManus_2009_15-1"><sup><i><b>b</b></i></sup></a></span> <span class="reference-text"><cite id="CITEREFMasonSmallMonroseMacManus2009" class="citation conference cs1">Mason, Joshua; Small, Sam; Monrose, Fabian; MacManus, Greg (November 2009). <a rel="nofollow" class="external text" href="http://www.cs.jhu.edu/~sam/ccs243-mason.pdf"><i>English Shellcode</i></a> <span class="cs1-format">(PDF)</span>. Proceedings of the 16th ACM conference on Computer and Communications Security. New York, NY, USA. pp. <span class="nowrap">524–</span>533. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20220526164459/https://www.cs.jhu.edu/~sam/ccs243-mason.pdf">Archived</a> <span class="cs1-format">(PDF)</span> from the original on 2022-05-26<span class="reference-accessdate">. Retrieved <span class="nowrap">2010-01-10</span></span>.</cite> (10 pages)</span>

</li>

<li id="cite_note-16"><span class="mw-cite-backlink"><b><a href="#cite_ref-16">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://web.archive.org/web/20120621124443/http://www.blackhatlibrary.net/Alphanumeric_shellcode">"Multi-architecture (x86) and 64-bit alphanumeric shellcode explained"</a>. Blackhat Academy. Archived from <a rel="nofollow" class="external text" href="http://www.blackhatlibrary.net/Alphanumeric_shellcode">the original</a> on 2012-06-21.</cite></span>

</li>

<li id="cite_note-Eugene_2001-17"><span class="mw-cite-backlink"><b><a href="#cite_ref-Eugene_2001_17-0">^</a></b></span> <span class="reference-text"><cite id="CITEREFeugene2001" class="citation web cs1">eugene (2001-08-11). <a rel="nofollow" class="external text" href="http://www.phrack.org/issues.html?issue=57&id=14#article">"Architecture Spanning Shellcode"</a>. <i>Phrack</i>. Phrack Inc. #0x0e of 0x12. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20211109173710/http://phrack.org/issues/57/14.html#article">Archived</a> from the original on 2021-11-09<span class="reference-accessdate">. Retrieved <span class="nowrap">2008-02-29</span></span>.</cite></span>

</li>

<li id="cite_note-Nemo_2005-18"><span class="mw-cite-backlink"><b><a href="#cite_ref-Nemo_2005_18-0">^</a></b></span> <span class="reference-text"><cite id="CITEREFnemo2005" class="citation web cs1">nemo (2005-11-13). <a rel="nofollow" class="external text" href="https://seclists.org/fulldisclosure/2005/Nov/387">"OSX - Multi arch shellcode"</a>. <i><a href="Full_disclosure_(mailing_list)" class="mw-redirect" title="Full disclosure (mailing list)">Full disclosure</a></i>. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20220526191616/https://seclists.org/fulldisclosure/2005/Nov/387">Archived</a> from the original on 2022-05-26<span class="reference-accessdate">. Retrieved <span class="nowrap">2022-05-26</span></span>.</cite></span>

</li>

<li id="cite_note-Cha-Pak-Brumley-Lipton_2010-19"><span class="mw-cite-backlink"><b><a href="#cite_ref-Cha-Pak-Brumley-Lipton_2010_19-0">^</a></b></span> <span class="reference-text"><cite id="CITEREFChaPakBrumleyLipton2010" class="citation conference cs1">Cha, Sang Kil; Pak, Brian; <a href="David_Brumley" title="David Brumley">Brumley, David</a>; <a href="Richard_Jay_Lipton" class="mw-redirect" title="Richard Jay Lipton">Lipton, Richard Jay</a> (2010-10-08) [2010-10-04]. <a rel="nofollow" class="external text" href="https://softsec.kaist.ac.kr/~sangkilc/papers/cha-ccs10.pdf"><i>Platform-Independent Programs</i></a> <span class="cs1-format">(PDF)</span>. Proceedings of the 17th ACM conference on Computer and Communications Security (CCS'10). Chicago, Illinois, USA: <a href="Carnegie_Mellon_University" title="Carnegie Mellon University">Carnegie Mellon University</a>, Pittsburgh, Pennsylvania, USA / <a href="Georgia_Institute_of_Technology" class="mw-redirect" title="Georgia Institute of Technology">Georgia Institute of Technology</a>, Atlanta, Georgia, USA. pp. <span class="nowrap">547–</span>558. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1145%2F1866307.1866369">10.1145/1866307.1866369</a>. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-1-4503-0244-9</bdi>. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20220526153147/https://softsec.kaist.ac.kr/~sangkilc/papers/cha-ccs10.pdf">Archived</a> <span class="cs1-format">(PDF)</span> from the original on 2022-05-26<span class="reference-accessdate">. Retrieved <span class="nowrap">2022-05-26</span></span>.</cite> <a rel="nofollow" class="external autonumber" href="https://web.archive.org/web/20220526182333/http://users.ece.cmu.edu/~sangkilc/papers/ccs10-cha.pdf">[1]</a> (12 pages) (See also: <a rel="nofollow" class="external autonumber" href="https://security.ece.cmu.edu/pip/index.html">[2]</a>)</span>

</li>

</ol></div></div>

<div class="mw-heading mw-heading2"><h2 id="External_links">External links</h2></div>

<ul><li><a rel="nofollow" class="external text" href="http://www.shell-storm.org/shellcode/">Shell-Storm</a> Database of shellcodes Multi-Platform.</li>

<li><a rel="nofollow" class="external text" href="http://www.phrack.org/issues.html?issue=49&id=14#article">An introduction to buffer overflows and shellcode</a></li>

<li><a rel="nofollow" class="external text" href="http://www.infosecwriters.com/text_resources/pdf/basics_of_shellcoding.pdf">The Basics of Shellcoding</a> (PDF) An overview of <a href="X86" title="X86">x86</a> shellcoding by <a rel="nofollow" class="external text" href="http://www.rosiello.org/">Angelo Rosiello</a></li>

<li><a rel="nofollow" class="external text" href="https://web.archive.org/web/20120109070051/http://goodfellas.shellcode.com.ar/docz/bof/Writing_shellcode.html">An introduction to shellcode development</a></li>

<li><a rel="nofollow" class="external text" href="https://web.archive.org/web/20080302111910/http://www.metasploit.com/shellcode/">Contains x86 and non-x86 shellcode samples and an online interface for automatic shellcode generation and encoding, from the Metasploit Project</a></li>

<li><a rel="nofollow" class="external text" href="https://web.archive.org/web/20060619025456/http://www.linux-secure.com/endymion/shellcodes/">a shellcode archive, sorted by Operating system</a>.</li>

<li><a rel="nofollow" class="external text" href="https://web.archive.org/web/20061112203748/http://www.milw0rm.com/papers/11">Microsoft Windows and Linux shellcode design tutorial going from basic to advanced</a>.</li>

<li><a rel="nofollow" class="external text" href="http://www.vividmachines.com/shellcode/shellcode.html">Windows and Linux shellcode tutorial containing step by step examples</a>.</li>

<li><a rel="nofollow" class="external text" href="https://web.archive.org/web/20210322094322/http://www.enderunix.org/docs/en/sc-en.txt">Designing shellcode demystified</a></li>

<li><a rel="nofollow" class="external text" href="https://code.google.com/p/alpha3/">ALPHA3</a> A shellcode encoder that can turn any shellcode into both Unicode and ASCII, uppercase and mixedcase, alphanumeric shellcode.</li>

<li><a rel="nofollow" class="external text" href="https://web.archive.org/web/20061115040739/http://www.ngssoftware.com/research/papers/WritingSmallShellcode.pdf">Writing Small shellcode by Dafydd Stuttard</a> A whitepaper explaining how to make shellcode as small as possible by optimizing both the design and implementation.</li>

<li><a rel="nofollow" class="external text" href="http://skypher.com/wiki/index.php?title=Www.edup.tudelft.nl/~bjwever/whitepaper_shellcode.html.php">Writing IA32 Restricted Instruction Set Shellcode Decoder Loops by SkyLined</a> <a rel="nofollow" class="external text" href="https://web.archive.org/web/20150403114315/http://skypher.com/wiki/index.php?title=Www.edup.tudelft.nl%2F~bjwever%2Fwhitepaper_shellcode.html.php">Archived</a> 2015-04-03 at the <a href="Wayback_Machine" title="Wayback Machine">Wayback Machine</a> A whitepaper explaining how to create shellcode when the bytes allowed in the shellcode are very restricted.</li>

<li><a rel="nofollow" class="external text" href="https://code.google.com/p/beta3/">BETA3</a> A tool that can encode and decode shellcode using a variety of encodings commonly used in exploits.</li>

<li><a rel="nofollow" class="external text" href="http://sandsprite.com/shellcode_2_exe.php">Shellcode 2 Exe</a> - Online converter to embed shellcode in exe husk</li>

<li><a rel="nofollow" class="external text" href="https://github.com/dzzie/sclog">Sclog</a> - Updated build of the iDefense sclog shellcode analysis tool (Windows)</li>

<li><a rel="nofollow" class="external text" href="https://archive.today/20130219020328/http://libemu.carnivore.it/">Libemu</a> - emulation based shellcode analysis library (*nix/Cygwin)</li>

<li><a rel="nofollow" class="external text" href="http://sandsprite.com/blogs/index.php?uid=7&pid=152">Scdbg</a> - shellcode debugger built around libemu emulation library (*nix/Windows)</li></ul>

/* start https://en.wikipedia.org/ */

.mw-parser-output .hlist dl,.mw-parser-output .hlist ol,.mw-parser-output .hlist ul{margin:0;padding:0}.mw-parser-output .hlist dd,.mw-parser-output .hlist dt,.mw-parser-output .hlist li{margin:0;display:inline}.mw-parser-output .hlist.inline,.mw-parser-output .hlist.inline dl,.mw-parser-output .hlist.inline ol,.mw-parser-output .hlist.inline ul,.mw-parser-output .hlist dl dl,.mw-parser-output .hlist dl ol,.mw-parser-output .hlist dl ul,.mw-parser-output .hlist ol dl,.mw-parser-output .hlist ol ol,.mw-parser-output .hlist ol ul,.mw-parser-output .hlist ul dl,.mw-parser-output .hlist ul ol,.mw-parser-output .hlist ul ul{display:inline}.mw-parser-output .hlist .mw-empty-li{display:none}.mw-parser-output .hlist dt::after{content:": "}.mw-parser-output .hlist dd::after,.mw-parser-output .hlist li::after{content:" · ";font-weight:bold}.mw-parser-output .hlist dd:last-child::after,.mw-parser-output .hlist dt:last-child::after,.mw-parser-output .hlist li:last-child::after{content:none}.mw-parser-output .hlist dd dd:first-child::before,.mw-parser-output .hlist dd dt:first-child::before,.mw-parser-output .hlist dd li:first-child::before,.mw-parser-output .hlist dt dd:first-child::before,.mw-parser-output .hlist dt dt:first-child::before,.mw-parser-output .hlist dt li:first-child::before,.mw-parser-output .hlist li dd:first-child::before,.mw-parser-output .hlist li dt:first-child::before,.mw-parser-output .hlist li li:first-child::before{content:" (";font-weight:normal}.mw-parser-output .hlist dd dd:last-child::after,.mw-parser-output .hlist dd dt:last-child::after,.mw-parser-output .hlist dd li:last-child::after,.mw-parser-output .hlist dt dd:last-child::after,.mw-parser-output .hlist dt dt:last-child::after,.mw-parser-output .hlist dt li:last-child::after,.mw-parser-output .hlist li dd:last-child::after,.mw-parser-output .hlist li dt:last-child::after,.mw-parser-output .hlist li li:last-child::after{content:")";font-weight:normal}.mw-parser-output .hlist ol{counter-reset:listitem}.mw-parser-output .hlist ol>li{counter-increment:listitem}.mw-parser-output .hlist ol>li::before{content:" "counter(listitem)"\a0 "}.mw-parser-output .hlist dd ol>li:first-child::before,.mw-parser-output .hlist dt ol>li:first-child::before,.mw-parser-output .hlist li ol>li:first-child::before{content:" ("counter(listitem)"\a0 "}

/* end https://en.wikipedia.org/ */

</style><style data-mw-deduplicate="TemplateStyles:r1236075235">

/* start https://en.wikipedia.org/ */

.mw-parser-output .navbox{box-sizing:border-box;border:1px solid #a2a9b1;width:100%;clear:both;font-size:88%;text-align:center;padding:1px;margin:1em auto 0}.mw-parser-output .navbox .navbox{margin-top:0}.mw-parser-output .navbox+.navbox,.mw-parser-output .navbox+.navbox-styles+.navbox{margin-top:-1px}.mw-parser-output .navbox-inner,.mw-parser-output .navbox-subgroup{width:100%}.mw-parser-output .navbox-group,.mw-parser-output .navbox-title,.mw-parser-output .navbox-abovebelow{padding:0.25em 1em;line-height:1.5em;text-align:center}.mw-parser-output .navbox-group{white-space:nowrap;text-align:right}.mw-parser-output .navbox,.mw-parser-output .navbox-subgroup{background-color:#fdfdfd}.mw-parser-output .navbox-list{line-height:1.5em;border-color:#fdfdfd}.mw-parser-output .navbox-list-with-group{text-align:left;border-left-width:2px;border-left-style:solid}.mw-parser-output tr+tr>.navbox-abovebelow,.mw-parser-output tr+tr>.navbox-group,.mw-parser-output tr+tr>.navbox-image,.mw-parser-output tr+tr>.navbox-list{border-top:2px solid #fdfdfd}.mw-parser-output .navbox-title{background-color:#ccf}.mw-parser-output .navbox-abovebelow,.mw-parser-output .navbox-group,.mw-parser-output .navbox-subgroup .navbox-title{background-color:#ddf}.mw-parser-output .navbox-subgroup .navbox-group,.mw-parser-output .navbox-subgroup .navbox-abovebelow{background-color:#e6e6ff}.mw-parser-output .navbox-even{background-color:#f7f7f7}.mw-parser-output .navbox-odd{background-color:transparent}.mw-parser-output .navbox .hlist td dl,.mw-parser-output .navbox .hlist td ol,.mw-parser-output .navbox .hlist td ul,.mw-parser-output .navbox td.hlist dl,.mw-parser-output .navbox td.hlist ol,.mw-parser-output .navbox td.hlist ul{padding:0.125em 0}.mw-parser-output .navbox .navbar{display:block;font-size:100%}.mw-parser-output .navbox-title .navbar{float:left;text-align:left;margin-right:0.5em}body.skin--responsive .mw-parser-output .navbox-image img{max-width:none!important}@media print{body.ns-0 .mw-parser-output .navbox{display:none!important}}

/* end https://en.wikipedia.org/ */

</style></div><div role="navigation" class="navbox" aria-labelledby="Information_security92" style="padding:3px"><table class="nowraplinks mw-collapsible autocollapse navbox-inner" style="border-spacing:0;background:transparent;color:inherit"><tbody><tr><th scope="col" class="navbox-title" colspan="3"><style data-mw-deduplicate="TemplateStyles:r1239400231">

/* start https://en.wikipedia.org/ */

.mw-parser-output .navbar{display:inline;font-size:88%;font-weight:normal}.mw-parser-output .navbar-collapse{float:left;text-align:left}.mw-parser-output .navbar-boxtext{word-spacing:0}.mw-parser-output .navbar ul{display:inline-block;white-space:nowrap;line-height:inherit}.mw-parser-output .navbar-brackets::before{margin-right:-0.125em;content:"[ "}.mw-parser-output .navbar-brackets::after{margin-left:-0.125em;content:" ]"}.mw-parser-output .navbar li{word-spacing:-0.125em}.mw-parser-output .navbar a>span,.mw-parser-output .navbar a>abbr{text-decoration:inherit}.mw-parser-output .navbar-mini abbr{font-variant:small-caps;border-bottom:none;text-decoration:none;cursor:inherit}.mw-parser-output .navbar-ct-full{font-size:114%;margin:0 7em}.mw-parser-output .navbar-ct-mini{font-size:114%;margin:0 4em}html.skin-theme-clientpref-night .mw-parser-output .navbar li a abbr{color:var(--color-base)!important}@media(prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .navbar li a abbr{color:var(--color-base)!important}}@media print{.mw-parser-output .navbar{display:none!important}}

/* end https://en.wikipedia.org/ */

</style><div id="Information_security92" style="font-size:114%;margin:0 4em"><a href="Information_security" title="Information security">Information security</a></div></th></tr><tr><th scope="row" class="navbox-group" style="width:1%"><a href="Threat_(computer)" class="mw-redirect" title="Threat (computer)">Threats</a></th><td class="navbox-list-with-group navbox-list navbox-odd hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Adware" title="Adware">Adware</a></li>

<li><a href="Advanced_persistent_threat" title="Advanced persistent threat">Advanced persistent threat</a></li>

<li><a href="Arbitrary_code_execution" title="Arbitrary code execution">Arbitrary code execution</a></li>

<li><a href="Backdoor_(computing)" title="Backdoor (computing)">Backdoors</a></li>

<li>Bombs

<li><a href="Logic_bomb" title="Logic bomb">Logic</a></li>

<li><a href="Hardware_backdoor" title="Hardware backdoor">Hardware backdoors</a></li>

<li><a href="Code_injection" title="Code injection">Code injection</a></li>

<li><a href="Crimeware" title="Crimeware">Crimeware</a></li>

<li><a href="Cross-site_scripting" title="Cross-site scripting">Cross-site scripting</a></li>

<li><a href="Cross-site_leaks" title="Cross-site leaks">Cross-site leaks</a></li>

<li><a href="DOM_clobbering" title="DOM clobbering">DOM clobbering</a></li>

<li><a href="History_sniffing" title="History sniffing">History sniffing</a></li>

<li><a href="Cryptojacking" title="Cryptojacking">Cryptojacking</a></li>

<li><a href="Botnet" title="Botnet">Botnets</a></li>

<li><a href="Data_breach" title="Data breach">Data breach</a></li>

<li><a href="Drive-by_download" title="Drive-by download">Drive-by download</a></li>

<li><a href="Browser_Helper_Object" title="Browser Helper Object">Browser Helper Objects</a></li>

<li><a href="Computer_virus" title="Computer virus">Viruses</a></li>

<li><a href="Data_scraping" title="Data scraping">Data scraping</a></li>

<li><a href="Denial-of-service_attack" title="Denial-of-service attack">Denial-of-service attack</a></li>

<li><a href="Eavesdropping" title="Eavesdropping">Eavesdropping</a></li>

<li><a href="Email_fraud" title="Email fraud">Email fraud</a></li>

<li><a href="Email_spoofing" title="Email spoofing">Email spoofing</a></li>

<li><a href="Exploit_(computer_security)" title="Exploit (computer security)">Exploits</a></li>

<li><a href="Dialer#Fraudulent_dialer" title="Dialer">Fraudulent dialers</a></li>

<li><a href="Hacktivism" title="Hacktivism">Hacktivism</a></li>

<li><a href="Infostealer" title="Infostealer">Infostealer</a></li>

<li><a href="Insecure_direct_object_reference" title="Insecure direct object reference">Insecure direct object reference</a></li>

<li><a href="Keystroke_logging" title="Keystroke logging">Keystroke loggers</a></li>

<li><a href="Malware" title="Malware">Malware</a></li>

<li><a href="Payload_(computing)" title="Payload (computing)">Payload</a></li>

<li><a href="Phishing" title="Phishing">Phishing</a>

<ul><li><a href="Voice_phishing" title="Voice phishing">Voice</a></li></ul></li>

<li><a href="Polymorphic_engine" title="Polymorphic engine">Polymorphic engine</a></li>

<li><a href="Privilege_escalation" title="Privilege escalation">Privilege escalation</a></li>

<li><a href="Ransomware" title="Ransomware">Ransomware</a></li>

<li><a href="Rootkit" title="Rootkit">Rootkits</a></li>

<li><a href="Scareware" title="Scareware">Scareware</a></li>

<li><a href="Spamming" title="Spamming">Spamming</a></li>

<li><a href="Social_engineering_(security)" title="Social engineering (security)">Social engineering</a></li>

<li><a href="Spyware" title="Spyware">Spyware</a></li>

<li><a href="Software_bug" title="Software bug">Software bugs</a></li>

<li><a href="Trojan_horse_(computing)" title="Trojan horse (computing)">Trojan horses</a></li>

<li><a href="Hardware_Trojan" title="Hardware Trojan">Hardware Trojans</a></li>

<li><a href="Remote_access_trojan" class="mw-redirect" title="Remote access trojan">Remote access trojans</a></li>

<li><a href="Vulnerability_(computer_security)" title="Vulnerability (computer security)">Vulnerability</a></li>

<li><a href="Web_shell" title="Web shell">Web shells</a></li>

<li><a href="Wiper_(malware)" title="Wiper (malware)">Wiper</a></li>

<li><a href="Computer_worm" title="Computer worm">Worms</a></li>

<li><a href="SQL_injection" title="SQL injection">SQL injection</a></li>

<li><a href="Rogue_security_software" title="Rogue security software">Rogue security software</a></li>

<li><a href="Zombie_(computing)" title="Zombie (computing)">Zombie</a></li></ul>

</div></td><td class="noviewer navbox-image" rowspan="3" style="width:1px;padding:0 0 0 2px"><div></div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Defenses</th><td class="navbox-list-with-group navbox-list navbox-even hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Application_security" title="Application security">Application security</a>

<ul><li><a href="Secure_coding" title="Secure coding">Secure coding</a></li>

<li>Secure by default</li>

<li><a href="Secure_by_design" title="Secure by design">Secure by design</a>

<ul><li><a href="Misuse_case" title="Misuse case">Misuse case</a></li></ul></li></ul></li>

<li><a href="Computer_access_control" title="Computer access control">Computer access control</a>

<ul><li><a href="Authentication" title="Authentication">Authentication</a>

<ul><li><a href="Multi-factor_authentication" title="Multi-factor authentication">Multi-factor authentication</a></li></ul></li>

<li><a href="Authorization" title="Authorization">Authorization</a></li></ul></li>

<li><a href="Computer_security_software" title="Computer security software">Computer security software</a>

<ul><li><a href="Antivirus_software" title="Antivirus software">Antivirus software</a></li>

<li><a href="Security-focused_operating_system" title="Security-focused operating system">Security-focused operating system</a></li></ul></li>

<li><a href="Data-centric_security" title="Data-centric security">Data-centric security</a></li>

<li><a href="Obfuscation_(software)" title="Obfuscation (software)">Software obfuscation</a></li>

<li><a href="Data_masking" title="Data masking">Data masking</a></li>

<li><a href="Encryption" title="Encryption">Encryption</a></li>

<li><a href="Firewall_(computing)" title="Firewall (computing)">Firewall</a></li>

<li><a href="Intrusion_detection_system" title="Intrusion detection system">Intrusion detection system</a>

<ul><li><a href="Host-based_intrusion_detection_system" title="Host-based intrusion detection system">Host-based intrusion detection system</a> (HIDS)</li>

<li><a href="Anomaly_detection" title="Anomaly detection">Anomaly detection</a></li></ul></li>

<li><a href="Information_security_management" title="Information security management">Information security management</a>

<ul><li><a href="Information_risk_management" class="mw-redirect" title="Information risk management">Information risk management</a></li>

<li><a href="Security_information_and_event_management" title="Security information and event management">Security information and event management</a> (SIEM)</li></ul></li>

<li><a href="Runtime_application_self-protection" title="Runtime application self-protection">Runtime application self-protection</a></li>

<li><a href="Site_isolation" title="Site isolation">Site isolation</a></li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Related<br>security<br>topics</th><td class="navbox-list-with-group navbox-list navbox-odd hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Computer_security" title="Computer security">Computer security</a></li>

<li><a href="Automotive_security" title="Automotive security">Automotive security</a></li>

<li><a href="Cybercrime" title="Cybercrime">Cybercrime</a>

<ul><li><a href="Cybersex_trafficking" title="Cybersex trafficking">Cybersex trafficking</a></li>

<li><a href="Computer_fraud" title="Computer fraud">Computer fraud</a></li></ul></li>

<li><a href="Cybergeddon" title="Cybergeddon">Cybergeddon</a></li>

<li><a href="Cyberterrorism" title="Cyberterrorism">Cyberterrorism</a></li>

<li><a href="Cyberwarfare" title="Cyberwarfare">Cyberwarfare</a></li>

<li><a href="Electronic_warfare" title="Electronic warfare">Electronic warfare</a></li>

<li><a href="Information_warfare" title="Information warfare">Information warfare</a></li>

<li><a href="Internet_security" title="Internet security">Internet security</a></li>

<li><a href="Mobile_security" title="Mobile security">Mobile security</a></li>

<li><a href="Network_security" title="Network security">Network security</a></li>

<li><a href="Copy_protection" title="Copy protection">Copy protection</a></li>

<li><a href="Digital_rights_management" title="Digital rights management">Digital rights management</a></li></ul>

</div></td></tr></tbody></table></div></div><div><div class="zim-footer">

This article is issued from <a class="external text" title="Last edited on 2025-07-31" href="https://en.wikipedia.org/wiki/?title=Shellcode&oldid=1303586416">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.

</div>

</div></div>

</div>

</main>

</div>

</body></html>