# 1- Spiking **Spiking:** Finding the vulnerable Part of the program. Run the Vulnserver software with administrator:

Run the Immunity Debug software with administrator. Go to **File** and select **Attach** and select **Vulnserver.**

We can check the status at the bottom right corner **"Paused"**

By clicking button **Run** or **F9** and we can check status **"Running"** at the bottom right corner.

From Kali machine, use **NetCat** tool connect to the vulnserver:

To perform spike, we can use tool "**generic\_send\_tcp**"

For **spike\_script**: we send randomly variable to try to break the part of the program **"STATS"**.

We start to send out randomly variable to test whether that part of the program vulnerable or not and nothing happened and it doesn't look like vulnerable.

Again, we send randomly variable to try to break the part of the program **"TRUN"**.

We found out that, after send out randomly to the TRUN part, immediately the immunity debug start blinking. We can check the status and found **"Paused****"** and **Access violation**.

Also noticed that the vulnserver already **crashed**.

On Immunity Debugger, we found that the buffer space was filled out by letter **"A"** and actually it was filled over. Noticed that we have filled over **ESP (Extended Stack Pointer)**, **EBP (Extended Based Pointer)**, and **EIP (Extended Instruction Pointer) / Return address**. The EIP is the important. The fact, if we can control this **EIP**, we can point this to malicious.

--- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://vulnableone.gitbook.io/vulnableone/course-review/cyber-security-courses-journey/oscp-journey/ctf/buffer-overflow/bof-tcm/1-spiking.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.