# Filling in the Blanks: Exploiting Null Byte Buffer Overflow for a $40,000 Bounty

Null bytes in a registration email field were stripped before reaching a C backend that still used the original length, causing it to read uninitialized memory and leak server secrets.

- Payout: $40,000
- Severity: critical
- Program: -
- Credited: Sam Curry
- Disclosed: 2019-11-01
- Write-up quality: 8/10
- Original: https://samcurry.net/filling-in-the-blanks-exploiting-null-byte-buffer-overflow-for-a-40000-bounty/
- Library page: https://bugbountylibrary.com/r/blog%3Asamcurry-net-filling-in-the-blanks-exploiting-null-byte-buffer-overflow-for-a-40000-bounty
- Tags: domain:web impact:data-leak impact:internal-access kind:research platform:research sev:critical tech:rest technique:fuzzing technique:source-review vuln:info-disclosure vuln:memory-corruption

**Target:** Registration email input field backed by a C application
**Root cause:** Frontend passed string and length to a C backend; null bytes were stripped from the string but the length was not decremented, so the C app read past the string into uninitialized memory.
**Steps:**
1. Register with email `victim%00@domain.com`; observe reflection returns `victimL@domain.com` (memory byte substituted for null).
2. Send `victim%00%00%00@domain.com`; observe `victimIdL@domain.com`, confirming random memory bytes fill null positions.
3. Send a large POST body with many `%00` sequences to create a large empty string tank.
4. Read response body: megabytes of server memory including RSA private keys, internal HTTP requests, user DOMs, plaintext usernames/passwords.
5. Repeat request to harvest different memory regions; script and grep for secrets.
**How found:** Hypothesis that a username could be manipulated with removable characters (null byte, CRLF, Unicode) to overwrite a victim's registration; testing `victim%00@domain.com` unexpectedly reflected `victimL@domain.com`, revealing memory bytes replacing nulls, prompting escalation to many null bytes.
**Exploitation:** Attacker submits registration requests with many null bytes; the backend reads the declared length of bytes into the string, filling the null-stripped space with adjacent process memory, which is returned in the response. Replaying harvests megabytes of memory per request.
**Escalation:** Repeated requests and automated scraping to collect large volumes of memory, grepping for secrets, keys, and credentials.
**Insight:** When a string and its length cross a language boundary, test characters that one layer strips (null bytes, CRLF, Unicode) but the other counts; a reflected value differing by one random byte signals length/value desync and memory disclosure.