ROGUEDSGNR

Powered by PM☰LP

Welcome to ROGUEDSGNR, your trusted partner in innovative design and cybersecurity solutions. Discover how I blend design thinking with advanced security practices to create user-friendly and secure digital experiences.

ROGUEDSGNR | Secure Design and Cybersecurity

ROGUEDSGNR heraldry represented by a fox on a cyber shield

### With over a decade of designing digital experiences, I now dedicate my skills to securing them.

<span style="color:#ffffff">
###### From Pixels to Protection:

I combine design and cybersecurity to build secure, user-friendly solutions. My design background allows me to identify and address security risks while keeping the user experience smooth and intuitive.

Look at my work to see how design thinking strengthens my cybersecurity path. </span>


Let's face it: the security industry has been hijacked by companies that think charging an arm and a leg for basic vulnerability tests is acceptable. They've turned essential security measures into luxury commodities, accessible only to those with deep pockets. VulnCheck is free!

## VulnCheck: Taking Back Control from Overpriced Solutions

***

Let's face it: the security industry has been hijacked by companies that think charging an arm and a leg for basic vulnerability tests is acceptable. They've turned essential security measures into luxury commodities, accessible only to those with deep pockets. Meanwhile, we are left exposed, vulnerable, and frustrated.

I'm not playing by their rules. Security isn't a privilege—it's a fundamental right, a necessity that sits at the very base of Maslow's hierarchy of needs. That's why I created **VulnCheck**, an open-source security scanner designed to put power back into the hands of the people.

### **Why I Built VulnCheck**

The security fat cats have had their day. Charging outrageous fees for vulnerability assessments is not just unethical; it's a slap in the face to every individual and small business trying to protect themselves in a digital world rife with threats. I built VulnCheck to shatter this monopoly and make top-tier security accessible to everyone.

### **Security is Non-Negotiable**

In the same way, you wouldn't compromise on locking your front door, you shouldn't have to compromise on securing your digital assets. It's not an optional extra—it's a basic necessity. VulnCheck ensures that you don't have to choose between paying exorbitant fees and leaving yourself exposed.

## What Is VulnCheck?

**VulnCheck** is a no-nonsense, Python-based security scanner that cuts through the noise. It's designed for those who want to take control of their security without emptying their wallets for the privilege.

### **Core Features**

*   **SSL/TLS Certificate Validation**: Because a secure connection shouldn't be a guessing game.
*   **HTTP Headers Analysis**: Uncover what your headers are silently saying to the world.
*   **Vulnerability Scanning**: Identify real threats like SQL Injection, XSS, CSRF vulnerabilities, and more—without the fluff.
*   **Content Discovery**: Find hidden content before someone else does.
*   **Firewall Circumvention Testing**: Test your defenses like a pro, without needing a corporate budget.

## Empowering You to Secure Yourself

### **Affordable (As in Free)**

I'm giving you VulnCheck for free because security shouldn't come with a price tag. No more choosing between paying rent and securing your website.

### **Knowledge is Power**

I'm not just handing you a tool; I'm giving you the keys to understand and control your security. Learn about vulnerabilities and how to fix them—no overpriced consultant is required.

## The Rogue Philosophy

### **Ethical Responsibility**

Use VulnCheck responsibly. I'm all about empowering you, not enabling malicious activity. Scan your sites or those you have permission to test, and keep it legit.

### **Defying the Status Quo**

I'm not interested in maintaining the status quo that benefits only a select few. I'm here to disrupt, dismantle, and redefine what it means to have access to quality security tools.

### **Community Over Corporations**

Open-source and community-driven, VulnCheck thrives on collaboration and shared knowledge. Together, we are stronger than any overpriced security firm.

### **Foundational Security**

Security is the foundation upon which everything else is built. Just like Maslow's hierarchy starts with basic needs, your digital presence starts with solid security. I'm here to make sure you have that foundation.

## Get Started Now

### **Installation**

No hoops to jump through. Grab VulnCheck from my [GitHub repository](https://github.com/ROGUEDSGNR/VulnCheck) and you're good to go.

### **Usage**

Fire it up with a simple command:

```bash
python vulncheck.py yourdomain.com
```

Need more details? Check out the [VulnCheck Doc](https://github.com/ROGUEDSGNR/VulnCheck).

### **Spread the Word**

Don't keep this to yourself. Share VulnCheck with your network and help me break the stranglehold overpriced security firms have on essential tools.

## Conclusion

I'm done accepting the notion that security is a luxury. VulnCheck is my statement, my rebellion against a system that has kept quality security tools out of reach for too long. It's time to take back control.

And maybe I'll even start hosting them web-based in the future. Let's see how it goes...

**Stay rogue, stay secure**

**ROGUEDSGNR**

***

**Questions or feedback?** [Contact me](mailto:hello@roguedsgnr.com)
or maybe buy me a [ko-fi](https://ko-fi.com/roguedsgnr/)


VulnCheck: Check Your Cyber Vulnerabilities for Free and for Your Eyes Only

LiteRecon: Your one-stop Python tool for all things domain and IP reconnaissance! Tired of juggling multiple scripts for basic info? LiteRecon's got your back!

# LiteRecon Documentation (Version 2.0)

## Overview

LiteRecon is a Python-based reconnaissance tool designed to gather comprehensive information about domain names and IP addresses. This updated version enhances performance, usability, and reliability by introducing multithreading, improved input validation, better error handling, and additional features like command-line arguments and logging.

***

## What's New in Version 2.0

*   **Improved Input Validation**: Enhanced domain and IP address validation using Python's built-in libraries.
*   **Multithreading**: Network requests are now handled concurrently, significantly improving performance.
*   **Command-Line Interface (CLI)**: Added support for command-line arguments using `argparse`.
*   **Logging**: Implemented logging to better track the tool's operations and errors.
*   **Enhanced Error Handling**: Robust exception handling across all functions to ensure smooth execution.
*   **Modular Code Structure**: Refactored into a class-based design for better maintainability and scalability.
*   **Optional Colored Output**: Users can disable coloured output for better compatibility with different terminal environments.
*   **Disclaimers and Usage Policies**: Added guidelines to promote ethical and authorized use of the tool.

***

## Features

*   **WHOIS Lookup**: Retrieves domain registration details.
*   **DNS Records Retrieval**: Collects A, MX, NS, TXT, and CNAME records for domains.
*   **Reverse DNS Lookup**: Resolves IP addresses to their associated domain names.
*   **Reverse IP Lookup**: Identifies other domains hosted on the same IP address.
*   **Geolocation Fetching**: Obtains geographical information for IP addresses.
*   **Email Scraping**: Extracts email addresses from websites.
*   **Multithreading**: Performs network requests concurrently for faster results.
*   **Logging**: Logs detailed information and errors to a file and console.
*   **Command-Line Arguments**: Users can specify targets and options directly from the terminal.
*   **Enhanced Output Formatting**: Provides clear, word-wrapped, and optionally color-coded outputs for easy interpretation.

***

## Installation

### Prerequisites

*   **Python 3.6 or higher**: Ensure Python is installed on your system.

### Install Dependencies

1.  **Clone the Repository** (if applicable):

    ```bash
    git clone https://github.com/ROGUEDSGNR/lite-recon.git
    cd literecon
    ```

2.  **Install Required Packages**:

    Create a `requirements.txt` file with the following content:

    ```txt
    whois
    dnspython
    requests
    beautifulsoup4
    colorama
    ```

    Install the dependencies using pip:

    ```bash
    pip install -r requirements.txt
    ```

    Alternatively, you can install the packages individually:

    ```bash
    pip install whois dnspython requests beautifulsoup4 colorama
    ```

***

## Usage

### Basic Usage

Run the script using Python, specifying the target domain or IP address:

```bash
python literecon.py example.com
```

### Command-Line Arguments

*   **Target**: The domain or IP address to scan.

*   **Options**:
    *   `--no-color`: Disable colored output in the terminal.

**Example**:

```bash
python literecon.py example.com --no-color
```

### Help

To display the help message with all available options:

```bash
python literecon.py -h
```

***

## Output

LiteRecon provides a detailed report with the following sections:

*   **Domain Information (WHOIS)**
*   **DNS Information**: A, MX, NS, TXT, and CNAME records.
*   **Reverse DNS Lookup**
*   **Domains Hosted on the Server**
*   **Server Geolocation**
*   **Emails Found**

### Color Coding (Optional)

*   **Valid Data**: Shown in green or white.
*   **Missing or Error Data**: Shown in grey.

***

## Example Output

```
Lite Recon Report for example.com

--> Domain Information (WHOIS)
domain_name: example.com
creation_date: 1995-08-14 04:00:00
...

--> DNS Information
A Records:
  - 93.184.216.34
MX Records:
  - ...

--> Reverse DNS Lookup
93.184.216.34.in-addr.arpa

--> Domains Hosted on the Server
  - example.com
  - ...

--> Server Geolocation
ip: 93.184.216.34
city: Los Angeles
region: California
country: US
...

--> Emails Found
  - admin@example.com

Lite Recon Done. Godspeed!
```

***

## Detailed Features

### Input Validation

*   **Domain Validation**: Enhanced regex patterns ensure accurate validation of domain names.
*   **IP Address Validation**: Utilizes the `ipaddress` module for reliable IP address validation.

### Multithreading

*   **Concurrent Execution**: Network requests are handled in separate threads, reducing total execution time.

### Logging

*   **Log File**: Detailed logs are saved to `literecon.log`.
*   **Console Output**: Important messages and errors are displayed in the terminal.

### Modular Code Structure

*   **Class-Based Design**: The `LiteRecon` class encapsulates all functionalities, making the code easier to maintain and extend.

### Command-Line Interface

*   **Argparse Module**: Provides a robust and user-friendly command-line interface.
*   **Optional Arguments**: Users can customize the tool's behaviour using flags and options.

### Enhanced Error Handling

*   **Exception Handling**: All functions include try-except blocks to handle exceptions gracefully.
*   **Retries**: Network requests implement retries to handle temporary failures.

***

## Ethical Use and Disclaimers

*   **Authorized Use Only**: Ensure you have explicit permission to perform reconnaissance on the target domain or IP address.
*   **Compliance**: Be aware of and comply with all applicable laws and regulations regarding data privacy and network scanning.
*   **Responsibility**: The user assumes all responsibility for using this tool.

***

## Contribution

Contributions are welcome! You can submit issues or pull requests on [GitHub](https://github.com/ROGUEDSGNR/lite-recon) to improve LiteRecon.

***

## License

This project is licensed under the [MIT License](LICENSE).

***

## Support

For any questions or support, please contact <hello@roguedsgnr.com>

***

## Troubleshooting

### Common Issues

*   **ImportError**: If you encounter import errors, ensure all dependencies are installed correctly.
*   **Network Errors**: Network-related errors may occur due to connectivity issues or API rate limits.

### Solutions

*   **Dependency Installation**: Reinstall the dependencies using `pip install -r requirements.txt`.
*   **API Rate Limits**: Wait for some time before retrying if you suspect rate limiting.
*   **Permissions**: Run the script with appropriate permissions if required.

***

## Future Enhancements

*   **Asynchronous Programming**: Implementing `asyncio` for even better performance.
*   **Additional Modules**: Adding support for SSL certificate analysis and port scanning.
*   **GUI Version**: Developing a graphical user interface for ease of use.

***

## Acknowledgements

*   **Open-Source Libraries**: Thanks to the developers of `whois`, `dnspython`, `requests`, `beautifulsoup4`, and `colorama`.
*   **Community Feedback**: Appreciation to users who provided feedback for improving LiteRecon.

***

## Important Notes

*   **External Services**: LiteRecon uses external APIs (e.g., `hackertarget.com`, `ipinfo.io`) which may have usage limitations.
*   **Data Accuracy**: The accuracy of the data retrieved depends on the external services and the availability of information.
*   **Privacy**: Be cautious when handling sensitive data obtained through reconnaissance.

***

## Contact Information

*   **Developer**: ROGUEDSGNR
*   **Email**: <hello@roguedsgnr.com>
*   **GitHub**: [github.com/ROGUEDSGNR](https://github.com/ROGUEDSGNR/)

***

By using LiteRecon, you agree to use it responsibly and ethically, respecting all applicable laws and regulations.


LiteRecon: Your one-stop Python tool for all things domain and IP reconnaissance! Tired of juggling multiple scripts for basic info? Lite Recon's got your back!

LiteRecon: My Little Recon Helper

VulnCheck: Taking Note of Your Vulnerabilities

⚔️ Insights and key takeaways from my C|EH v12 journey. Explore practical tips, essential concepts, and real-world applications from my notes on the C|EH v12.

[Check my Notes on GitHub](https://github.com/ROGUEDSGNR/EH-C-v12-Notes)

Embarking on the Certified Ethical Hacker (C|EH) v12 journey has been a challenging yet rewarding experience. As I dive deep into each module, I’m excited to share my notes and insights with you all. Whether you’re just starting or looking to refresh your knowledge, these notes are designed to help break down the key concepts, tools, and techniques covered in the C|EH curriculum.

## What to Expect from the Modules

The C|EH v12 course is structured to provide a comprehensive understanding of the latest ethical hacking tools and methodologies. From the basics of ethical hacking and information security to advanced penetration testing techniques, each module builds upon the last, creating a solid foundation for aspiring ethical hackers.

### Here’s a brief overview of some of the key modules you can expect to see in my notes:

*   **Introduction to Ethical Hacking**: Understanding the fundamental principles, concepts, and terminologies in ethical hacking.
*   **Footprinting and Reconnaissance**: Techniques to gather information about targets, including network and web reconnaissance.
*   **Scanning Networks**: Tools and techniques to identify live systems, open ports, and vulnerabilities.
*   **Enumeration**: Delving deeper into the target to gather usernames, machine names, and network resources.
*   **Vulnerability Analysis**: Identifying security weaknesses in systems and applications.
*   **System Hacking**: Methods to gain unauthorized access, including password cracking and privilege escalation.
*   **Malware Threats**: Understanding different types of malware and their propagation mechanisms.
*   **Sniffing**: Capturing and analyzing data packets to discover sensitive information.
*   **Social Engineering**: Exploiting human psychology to gain access to information or systems.
*   **Denial of Service (DoS)**: Techniques to disrupt the availability of services.
*   **Session Hijacking**: Taking control of user sessions and accessing restricted information.
*   **Evading IDS, Firewalls, and Honeypots**: Techniques to bypass security defenses.
*   **Hacking Web Servers and Web Applications**: Exploiting vulnerabilities in web servers and web applications.
*   **SQL Injection**: Understanding and exploiting SQL vulnerabilities to access restricted data.
*   **Hacking Wireless Networks**: Techniques to compromise wireless networks and encryption methods.
*   **Hacking Mobile Platforms**: Security issues and vulnerabilities specific to mobile devices.
*   **IoT and OT Hacking**: Exploring vulnerabilities in Internet of Things (IoT) devices and Operational Technology (OT).
*   **Cloud Computing**: Understanding cloud environment security risks and challenges.
*   **Cryptography**: Basics of cryptography, encryption techniques, and cryptanalysis.
*   **Penetration Testing**: Conducting ethical hacking engagements in a structured and systematic way.

## Making My Notes Public

As I progress through these modules, I’ll publicly share my notes. I aim to make this resource valuable for anyone pursuing the C|EH certification or looking to enhance their cybersecurity knowledge. However, please bear with me as this is a work in progress. I’m actively updating and refining the notes to ensure they are as accurate and comprehensive as possible.

Your patience and feedback are greatly appreciated, and I hope these notes become a helpful companion on your C|EH journey. Stay tuned for regular updates, and feel free to reach out with any questions or suggestions!

Thank you for joining me on yet anther learning adventure! 🎓

[Check my Notes on GitHub](https://github.com/ROGUEDSGNR/EH-C-v12-Notes)


C|HE v12 Notes

Projects:

Projects

Posts

An illustration of a cartoon-like mobile phone character with an aggressive expression, demanding to be charged. The phone's screen has a jagged, open mouth, and it appears to be yelling 'CHARGE!!!' in a speech bubble. The device is wrapped in a charging cable, and its hands are clenched in an intense pose. The entire image has a green, halftone style with a grunge effect, giving it a retro, hacker-themed vibe

<span style="color:#ffffff"> Picture this: You’re at a café, and someone casually asks, “Mind if I plug my phone into your laptop to charge?” You might think, “What’s the harm?” In reality, this can be one of the oldest social engineering tricks in the book—and it’s coming for your data, fast.

Let’s break down how attackers can weaponize Android devices, Kali NetHunter, and some sneaky Ducky Script to pull off a full-scale attack, all with the perfect alibi: “Just charging my phone.”

***

### The Android Device as a Weapon

Modern Android devices, especially when configured with **Kali NetHunter**, become portable hacking rigs. NetHunter, a version of Kali Linux tailored for Android, enables attackers to execute everything from **network traffic analysis** to **payload delivery**—all from a device that, at a glance, looks like an innocent phone. But there’s a twist here: it’s not just passive sniffing; NetHunter allows for hands-on attacks. Combine that with **Ducky Script**, and the possibilities start looking like a hacker’s playground.

So, what’s the game plan if a hacker asks to charge their phone? Here’s a rough attack flow.

***

### Step 1: Deploying Payloads

1.  **Setting Up Ducky Script**\
    Ducky Script is like the Swiss Army knife for scripting keystrokes. Once an attacker plugs in their Android device (masquerading as a USB HID device), they can execute a pre-written script that takes control of the target’s machine—no questions asked.

2.  **Loading the Payload**\
    A payload, maybe something like a **Meterpreter shell** or a **reverse TCP connection**, can be embedded in the script. The device triggers the payload to install malware or a backdoor without raising any flags.


### Step 2: Covering Tracks - Disabling Command History & Opening Backdoors

After deploying the initial payload, the attacker will aim to cover their tracks right away.

*   **Disabling Command History**: Attackers can prevent their actions from being recorded by disabling command history on Unix-based systems. Using commands like `unset HISTFILE` or setting `HISTFILESIZE` and `HISTSIZE` to 0, they ensure their command history isn’t saved, effectively erasing evidence of what they’ve done.

*   **Opening Backdoors**: With command history disabled, attackers can use Kali NetHunter to drop a **backdoor** that re-establishes a connection every time the compromised device boots. This way, they don’t need physical access again.

*   **Advanced Techniques**: They can enable persistence by adding entries to the system startup or creating scheduled tasks to ensure the backdoor reinitializes automatically.


### Step 3: Clearing Logs and Modifying Timestamps (Timestomping)

After establishing persistence, attackers will continue covering tracks by scrubbing logs and modifying timestamps.

*   **Clearing Logs**: By targeting specific log files, like those in Windows Event Viewer or Linux’s `auth.log` and `syslog`, attackers can delete traces of their access.

*   **Timestamp Modification**: Attackers may alter timestamps on files to make them appear unchanged. Ducky Script can automate commands to adjust `mtime` (modification time), `ctime` (change time), and `atime` (access time) to blend in with regular system activity.


### Step 4: Exfiltrating Data (Just for Good Measure)

Using a range of tools on Kali NetHunter, attackers can exfiltrate sensitive data, from passwords to session tokens.

*   **Data Transfer**: Since NetHunter supports tools like **SSH**, **netcat**, and **cURL**, data can be packaged and sent out covertly to a designated server.
*   **Hidden Data**: Attackers can also conceal stolen data within images or documents, leveraging **steganography** to avoid detection by DLP (Data Loss Prevention) tools.

***

### The Alternative: O.MG Cables - The Spy in Your Cable

If using a fully equipped Android device with Kali NetHunter feels too high-tech, attackers can take a more covert approach with **O.MG cables**. These look and function like regular charging cables but are embedded with a tiny Wi-Fi chip and payload storage. Once plugged in, an attacker can remotely trigger commands via a Wi-Fi connection, executing a Ducky Script from a distance.

Imagine the convenience: they ask to charge their device, plug in the O.MG cable, and walk away. They could then initiate attacks like payload drops, keylogging, or backdoor creation—right from a phone app or laptop across the room. O.MG cables make it easier to leave the scene while maintaining full control over the target.

***

### Defending Against the “Just Charging” Attack Vector

This attack method can catch even the most cautious users off guard. Here’s how to keep yourself from falling victim:

1.  **USB Port Security**\
    Disable USB ports where possible, or use a data-blocking USB adapter that allows charging only—no data transfer.

2.  **Device Management Policies**\
    Set up policies to prompt user confirmation when a new USB device is connected. Security tools like Linux's **Udev** rules can help enforce strict control over USB ports.

3.  **Logging & Monitoring**\
    Check logs regularly for anomalies. Use **intrusion detection** systems to monitor for unusual behaviour, such as unauthorized access attempts or changes in access times.

4.  **Endpoint Protection**\
    Enabling endpoint protection with real-time USB monitoring can alert you the moment an unexpected device connects.

***

In a world where your phone might be as powerful as a laptop, staying rogue means staying alert. Next time someone asks, “Can I charge my phone?” remember the risks and protect your gear.

**Stay rogue.** </span>


A simple request to charge a phone could lead to a full-scale breach. Discover how attackers use Android devices with Kali NetHunter and O.MG cables to deploy payloads, open backdoors, and cover their tracks without leaving a trace.

How Attackers Use Android Devices and O.MG Cables to Hack You

Just Charging My Phone... Or Am I? The Android Attack Vector You Need to Know

A digital illustration featuring a green, robotic boar head with mechanical and organic details. The design includes cybernetic tusks and fur, with symmetrical geometric patterns and glowing eyes, set against a black background.

## **Broken Authentication and Session Management**  
**Category:** #Authentication-and-Session-Attack 

**Attack:**
Broken authentication occurs when session management mechanisms (such as session tokens, cookies, and login functions) are improperly implemented, allowing attackers to hijack sessions or bypass authentication mechanisms.

**Attack Example (Session Hijacking):**

An attacker steals a valid session ID from a victim’s session and uses it to gain unauthorized access to their account.

**Vulnerable Code (Session without Secure Flags):**

```python
@app.route('/login', methods=['POST'])
def login():
    session['user'] = request.form['username']  # Session cookie is not secure
    return "Login successful"
```

In this example, the session cookie is vulnerable because it is not marked as secure and can be stolen over unencrypted connections.

**Remediation Steps:**
- **Use Secure Cookies:** Ensure cookies are flagged as `HttpOnly`, `Secure`, and `SameSite`.
- **Regenerate Session IDs:** After a successful login, regenerate session tokens to prevent session fixation attacks.
- **Session Timeout:** Implement session expiration after a period of inactivity or maximum session lifetime.
- **Use Strong Session Management Libraries:** Use well-established authentication and session management libraries (e.g., OAuth2) to avoid custom insecure implementations.

**Safe Code (Using secure session cookies in Python Flask):**

```python
app.config['SESSION_COOKIE_HTTPONLY'] = True  # Prevent access from JavaScript
app.config['SESSION_COOKIE_SECURE'] = True    # Send cookies only over HTTPS
app.config['SESSION_COOKIE_SAMESITE'] = 'Lax'  # Prevent cross-site request sharing

@app.route('/login', methods=['POST'])
def login():
    session['user'] = request.form['username']
    return "Login successful"
```

**Reference:**
[OWASP Session Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html)

Broken authentication leaves your app vulnerable to session hijacking. Learn how to safeguard your sessions with secure cookies, session expiration, and regeneration practices.

Broken Authentication and Session Management: Keeping Sessions Secure

11. Broken Authentication and Session Management

A digital illustration of a green, mechanical dog head with intricate cybernetic details. The design features sharp metallic elements and geometric patterns, giving the dog a futuristic and robotic look, set against a black background.

## **Buffer Overflow**
**Category:** #Code-Execution-Attack 

**Attack:**
A buffer overflow occurs when data written to a buffer exceeds the buffer’s capacity, potentially allowing attackers to overwrite adjacent memory and execute arbitrary code or crash the application.

**Attack Code Example (C-style Buffer Overflow):**

```c
#include <stdio.h>
#include <string.h>

int main() {
    char buffer[8];  // Buffer with a fixed size of 8 bytes
    strcpy(buffer, "This is a very long string that will overflow the buffer!");
    printf("Buffer content: %s\n", buffer);  // The overflow corrupts memory here
    return 0;
}
```

In this C example, the string `"This is a very long string that will overflow the buffer!"` exceeds the 8-byte buffer, leading to an overflow that may crash the program or allow arbitrary code execution.

**Vulnerable Code Example:**

```c
void vulnerable_function(char *user_input) {
    char buffer[16];
    strcpy(buffer, user_input);  // No bounds checking, allowing overflow
}
```

**Remediation Steps:**
- **Use Safe Functions:** Replace unsafe functions like `strcpy()` with safer alternatives such as `strncpy()` or use bounds-checking libraries.
- **Input Validation:** Always validate the length of the input before writing it into a buffer.
- **Use Modern Programming Languages:** Use languages with automatic memory management (e.g., Python, Java) that are inherently safe from buffer overflow issues.

**Safe Code Example (C with `strncpy()`):**

```c
void safe_function(char *user_input) {
    char buffer[16];
    strncpy(buffer, user_input, sizeof(buffer) - 1);  // Ensure no overflow
    buffer[sizeof(buffer) - 1] = '\0';  // Null-terminate the string
}
```

**Reference:**
[OWASP Buffer Overflow Overview](https://owasp.org/www-community/vulnerabilities/Buffer_Overflow)

Buffer overflow exploits can lead to arbitrary code execution. Explore how attackers use this technique and how to safeguard your code with safe practices and bounds checking.

With over a decade of designing digital experiences, I now dedicate my skills to securing them.

From Pixels to Protection:

VulnCheck: Taking Note of Your Vulnerabilities

LiteRecon: My Little Recon Helper

C|HE v12 Notes

Just Charging My Phone... Or Am I? The Android Attack Vector You Need to Know

11. Broken Authentication and Session Management

14. Buffer Overflow

Got an interesting project?

Home

With over a decade of designing digital experiences, I now dedicate my skills to securing them.

From Pixels to Protection:

VulnCheck: Taking Note of Your Vulnerabilities

LiteRecon: My Little Recon Helper

C|HE v12 Notes

Just Charging My Phone... Or Am I? The Android Attack Vector You Need to Know

11. Broken Authentication and Session Management

14. Buffer Overflow

Got an interesting project?