Exploit › Module 5 › Lesson 3
Safe APIs
Replace gets/strcpy with fgets/snprintf and bounded copies — refactor YOUR $PWN_LAB toys; defenders code review for banned APIs.
Visual · pwn_safe_apis
Safe API literacy. $PWN_LAB only. Original Cyberlium.
Opening
Banned API lists exist because the unsafe functions keep appearing in CVEs — swap them in source, not at exploit time.
Replace gets → fgets with size; strcpy/strcat → strncpy/strncat with bounds or snprintf; sprintf → snprintf; scanf %s → width-limited scans or parse libraries. C++ std::string and Rust reduce manual buffer math. Cyberlium refactors one unsafe toy into safe variant at $PWN_LAB — diff shows crash gone and checksec unchanged but source risk reduced. Next: Build Lab.
1. Common replacements (named)
fgets(buf, sizeof buf, stdin) respects cap. snprintf(buf, sizeof buf, fmt,.) never unbounded. memcpy with explicit length check against destination size.
On $PWN_LAB, pick one toy BOF line — show before/after patch in notes with line numbers.
Command guide
Try these commands — Common replacements (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Safe C APIs — https://man7.org/linux/man-pages/man3/fgets.3.html (bounded input) CWE-120 — https://cwe.mitre.org/data/definitions/120.html (replace gets/strcpy) Microsoft SDL banned APIs — https://learn.microsoft.com/en-us/security/sdl/ (strcpy/gets avoidance)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install build-essential
macOS:
Command — copy this
xcode-select --install # or brew install gcc
Windows: Use WSL or MinGW
═══ LINUX / macOS ═══
Command — copy this
export LAB_PWN=${LAB_PWN:-$HOME/cyberlium-lab/t24-pwn}
grep -E 'gets|strcpy|printf\(buf' "$LAB_PWN/src/"*_vuln.c "$LAB_PWN/src/"*_named.c
grep -E 'fgets|strncpy|printf\("%s' "$LAB_PWN/src/"*_safe.c
printf 'short
' | "$LAB_PWN/bin/bof_safe"
printf 'short-input
' | "$LAB_PWN/bin/strcpy_safe"
echo 'safe API lab: fgets/strncpy/fixed printf — remediation before any crash triage'Primary tools to practice this lesson: gcc, grep. Reference sites: Safe C APIs (https://man7.org/linux/man-pages/man3/fgets.3.html); CWE-120 (https://cwe.mitre.org/data/definitions/120.html); Microsoft SDL banned APIs (https://learn.microsoft.com/en-us/security/sdl/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Review and lint habits
grep -R 'gets\|strcpy\|sprintf' in CI — fail on hits in new code. Semgrep rules for dangerous functions in privileged paths.
Mentor reviews ask: where is input length validated?
3. Language migration literacy
Greenfield modules in memory-safe languages reduce class density — still validate FFI boundaries at C calls.
Ship: safe API diff — three replacements applied to YOUR toy with retest note (no crash / ASan clean). Next: Build Lab.
4. What you ship: safe API refactor diff for $PWN_LAB
Before/after API table for YOUR toy. Retest sentence. NO new bug introduction. chmod 600.
5. What you record before the next lesson
Date. Safe API diff. $PWN_LAB named. File t24-m05-l03-safe-apis.txt chmod 600.
6. Wrong vs right: weaponized exploits vs memory-safety literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Keep gets for 'realism.' Patch binary bytes instead of source.
Right
Refactor unsafe APIs in YOUR toy source and document diff. Next: Build Lab.
Mission: refactor one unsafe call
1) Replace one banned API in toy source. 2) Rebuild with SECURE_FLAGS. 3) Retest — note clean run. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Source fix beats mitigation bypass arms race.
Knowledge Check
APPLY: Safe API literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: fgets with sizeof buffer is safer than gets for line input.
True or False
Knowledge Check
APPLY: CI grep for strcpy primarily:
Multiple choice