52 lessons

Binary exploitation

Memory layout, mitigations, crashes, and lab-only exploitation concepts.

  1. 001 Process memory layout Learn Process memory layout through a safe, repeatable binary exploitation workflow. intro tutorial 20 min
  2. 002 Stack frames and calling conventions Learn Stack frames and calling conventions through a safe, repeatable binary exploitation workflow. intro tutorial 20 min
  3. 003 Crash triage workflow Learn Crash triage workflow through a safe, repeatable binary exploitation workflow. intro tutorial 20 min
  4. 004 Fuzzing a toy parser Learn Fuzzing a toy parser through a safe, repeatable binary exploitation workflow. intro tutorial 20 min
  5. 005 Mitigations overview Learn Mitigations overview through a safe, repeatable binary exploitation workflow. intro tutorial 20 min
  6. 006 Integer bug concepts Learn Integer bug concepts through a safe, repeatable binary exploitation workflow. intro tutorial 20 min
  7. 007 Format string concepts Learn Format string concepts through a safe, repeatable binary exploitation workflow. intro reference 12 min
  8. 008 Return-oriented programming overview Learn Return-oriented programming overview through a safe, repeatable binary exploitation workflow. intro tutorial 20 min
  9. 009 Shellcode ethics and lab boundaries Learn Shellcode ethics and lab boundaries through a safe, repeatable binary exploitation workflow. core lab 30 min
  10. 010 Writing safe binary exploit notes Learn Writing safe binary exploit notes through a safe, repeatable binary exploitation workflow. core tutorial 20 min
  11. 011 Buffer overflow basics Learn Buffer overflow basics through a safe, repeatable binary exploitation workflow. core tutorial 20 min
  12. 012 Stack buffer overflow Learn Stack buffer overflow through a safe, repeatable binary exploitation workflow. core tutorial 20 min
  13. 013 Off by one overwrite Learn Off by one overwrite through a safe, repeatable binary exploitation workflow. core tutorial 20 min
  14. 014 Cyclic patterns and offset finding Learn Cyclic patterns and offset finding through a safe, repeatable binary exploitation workflow. core reference 12 min
  15. 015 Endianness and packing values Learn Endianness and packing values through a safe, repeatable binary exploitation workflow. core tutorial 20 min
  16. 016 Saved return pointer control Learn Saved return pointer control through a safe, repeatable binary exploitation workflow. core tutorial 20 min
  17. 017 NX and executable stack Learn NX and executable stack through a safe, repeatable binary exploitation workflow. core tutorial 20 min
  18. 018 ASLR and address leaks Learn ASLR and address leaks through a safe, repeatable binary exploitation workflow. core lab 30 min
  19. 019 PIE and base address leaks Learn PIE and base address leaks through a safe, repeatable binary exploitation workflow. core tutorial 20 min
  20. 020 Stack canaries Learn Stack canaries through a safe, repeatable binary exploitation workflow. core tutorial 20 min
  21. 021 Canary leak patterns Learn Canary leak patterns through a safe, repeatable binary exploitation workflow. core reference 12 min
  22. 022 Return to win challenges Learn Return to win challenges through a safe, repeatable binary exploitation workflow. core tutorial 20 min
  23. 023 Return to libc Learn Return to libc through a safe, repeatable binary exploitation workflow. core tutorial 20 min
  24. 024 ret2plt and GOT leaks Learn ret2plt and GOT leaks through a safe, repeatable binary exploitation workflow. core tutorial 20 min
  25. 025 ROP chain fundamentals Learn ROP chain fundamentals through a safe, repeatable binary exploitation workflow. core tutorial 20 min
  26. 026 ROP gadgets and constraints Learn ROP gadgets and constraints through a safe, repeatable binary exploitation workflow. advanced tutorial 35 min
  27. 027 Stack pivoting basics Learn Stack pivoting basics through a safe, repeatable binary exploitation workflow. advanced lab 45 min
  28. 028 Sigreturn oriented programming concepts Learn Sigreturn oriented programming concepts through a safe, repeatable binary exploitation workflow. advanced reference 12 min
  29. 029 Format string reads Learn Format string reads through a safe, repeatable binary exploitation workflow. advanced tutorial 35 min
  30. 030 Format string writes Learn Format string writes through a safe, repeatable binary exploitation workflow. advanced tutorial 35 min
  31. 031 Integer overflow to memory corruption Learn Integer overflow to memory corruption through a safe, repeatable binary exploitation workflow. advanced tutorial 35 min
  32. 032 Use after free concepts Learn Use after free concepts through a safe, repeatable binary exploitation workflow. advanced tutorial 35 min
  33. 033 Double free concepts Learn Double free concepts through a safe, repeatable binary exploitation workflow. advanced tutorial 35 min
  34. 034 Heap chunk metadata Learn Heap chunk metadata through a safe, repeatable binary exploitation workflow. advanced tutorial 35 min
  35. 035 Fastbins overview Learn Fastbins overview through a safe, repeatable binary exploitation workflow. advanced reference 12 min
  36. 036 Unsorted bin leaks Learn Unsorted bin leaks through a safe, repeatable binary exploitation workflow. advanced lab 45 min
  37. 037 Tcache basics Learn Tcache basics through a safe, repeatable binary exploitation workflow. advanced tutorial 35 min
  38. 038 Tcache poisoning in labs Learn Tcache poisoning in labs through a safe, repeatable binary exploitation workflow. advanced tutorial 35 min
  39. 039 House of force concepts Learn House of force concepts through a safe, repeatable binary exploitation workflow. advanced tutorial 35 min
  40. 040 House of spirit concepts Learn House of spirit concepts through a safe, repeatable binary exploitation workflow. advanced tutorial 35 min
  41. 041 Heap grooming workflow Learn Heap grooming workflow through a safe, repeatable binary exploitation workflow. advanced tutorial 35 min
  42. 042 One gadget constraints Learn One gadget constraints through a safe, repeatable binary exploitation workflow. advanced reference 12 min
  43. 043 RELRO and GOT overwrite limits Learn RELRO and GOT overwrite limits through a safe, repeatable binary exploitation workflow. advanced tutorial 35 min
  44. 044 Seccomp filter review Learn Seccomp filter review through a safe, repeatable binary exploitation workflow. advanced tutorial 35 min
  45. 045 Pwntools process workflow Learn Pwntools process workflow through a safe, repeatable binary exploitation workflow. advanced lab 45 min
  46. 046 Pwntools remote workflow Learn Pwntools remote workflow through a safe, repeatable binary exploitation workflow. advanced tutorial 35 min
  47. 047 GDB and pwndbg workflow Learn GDB and pwndbg workflow through a safe, repeatable binary exploitation workflow. advanced tutorial 35 min
  48. 048 Core dump analysis Learn Core dump analysis through a safe, repeatable binary exploitation workflow. advanced tutorial 35 min
  49. 049 Fuzzing harness basics Learn Fuzzing harness basics through a safe, repeatable binary exploitation workflow. advanced reference 12 min
  50. 050 AFL crash triage Learn AFL crash triage through a safe, repeatable binary exploitation workflow. advanced tutorial 35 min
  51. 051 Symbol stripping and debugging Learn Symbol stripping and debugging through a safe, repeatable binary exploitation workflow. advanced tutorial 35 min
  52. 052 Writing exploit notes safely Learn Writing exploit notes safely through a safe, repeatable binary exploitation workflow. advanced tutorial 35 min