CNIT 127: Exploit Development

76488 Mon 6:10 - 9:00 PM SCIE 37

Fall 2015 Sam Bowne

Schedule · Lecture Notes · Projects · Links · Home Page

Scores

Open Lab Hours for Sci 214

Catalog Description

Learn how to find vulnerabilities and exploit them to gain control of target systems, including Linux, Windows, Mac, and Cisco. This class covers how to write tools, not just how to use them; essential skills for advanced penetration testers and software security professionals.

Advisory: CS 110A or equivalent familiarity with programming

Upon successful completion of this course, the student will be able to:
  1. Read and write basic assembly code routines
  2. Read and write basic C programs
  3. Recognize C constructs in assembly
  4. Find stack overflow vulnerabilities and exploit them
  5. Create local privilege escalation exploits
  6. Understand Linux shellcode and be able to write your own
  7. Understand format string vulnerabilities and exploit them
  8. Understand heap overflows and exploit them
  9. Explain essential Windows features and their weaknesses, including DCOM and DCE-RPC
  10. Understand Windows shells and how to write them
  11. Explain various Windows overflows and exploit them
  12. Evade filters and other Windows defenses
  13. Find vulnerabilities in Mac OS X and exploit them
  14. Find vulnerabilities in Cisco IOS and exploit them

Student Learning Outcomes (measured to guide course improvements)

1. Read and write basic assembly code routines
2. Find stack overflow vulnerabilities and exploit them
3. Evade filters and other Windows defenses

Textbook

"The Shellcoder's Handbook: Discovering and Exploiting Security Holes ", by Chris Anley, John Heasman, Felix Lindner, Gerardo Richarte; ASIN: B004P5O38Q Buy from Amazon


Schedule (may be revised)

DateQuizTopic
Mon 8-17  Ch 1: Before you Begin
Mon 8-24  Ch 2: Stack overflows on Linux
Mon 8-31  Ch 3: Shellcode
Fri 9-4 Last Day to Add Classes
Mon 9-7 Holiday - No Class
Mon 9-14Quiz: Ch 1-3
Proj 1-3 due		 Ch 4: Introduction to format string bugs
Mon 9-21No Quiz
Proj 4 due		 Ch 5: Introduction to heap overflows
Mon 9-28Quiz: Ch 4 & 5
Proj 5-6 due		 Ch 6: The Wild World of Windows (Part 1)
Mon 10-5No Quiz
Proj 7 due		 Ch 6: The Wild World of Windows (Part 2)
Mon 10-12Quiz: Ch 6
Proj 8-9 due		 Ch 7: Windows Shellcode
Mon 10-19No Quiz
Proj 10 due		 Ch 8: Windows overflows (Part 1)

Mon 10-26No Quiz
No Proj Due
Guest Speaker: Michael Coates
OWASP Global Board
Bay Area AppSec Mentorship Program 		  

Mon 10-26 Mid-Term Grades Due
Mon 11-2No Quiz
Proj 11-12 due		 Ch 8: Windows overflows (Part 2)
Mon 11-9Quiz: Lec. 7 & Ch 8
Proj 13 due		 Ch 14: Protection Mechanisms
Thu 11-12 Last Day to Withdraw
Mon 11-16No Quiz
Proj 14-15 due		 Ch 16: Fault Injection
Ch 17: The Art of Fuzzing
Ch 18: Source Code Auditing
Mon 11-23Quiz on Ch 14
Proj 16 due		 Hopper Debugger
Mon 11-30No Quiz
No proj due		 Preview of new course "Securing Web Applications" and two more servers to hack
Mon 12-7No Quiz
Proj 17-18 due
All Extra Credit Projects Due 		 Last Class: TBA (Class will meet: the strike was cancelled)
Mon 12-14  Final Exam




Lectures

Policy

Introduction to Exploitation: Linux on x86

Ch 1: Before you Begin (pptx)
Ch 2: Stack overflows on Linux (pptx)
Ch 3: Shellcode (pptx)
Ch 4: Introduction to format string bugs (pptx)
Ch 5: Introduction to heap overflows (pptx)

Windows

Ch 6: The Wild World of Windows (pptx)
Lecture 7: Intro to 64-Bit Assembler (pptx)

We'll skip Ch 7: Windows shellcode

Ch 8: Windows overflows (Part 1)
Ch 8: Windows overflows (Part 2)

We'll skip chapters 9 through 13

Ch 14: Protection Mechanisms (pptx)

We'll skip chapter 15

Ch 16: Fault Injection
Ch 17: The Art of Fuzzing
Ch 18: Source Code Auditing (pptx)

Exploiting Windows: Introduction
Buffer Overflow Defenses

The lectures are in PowerPoint formats
If you do not have PowerPoint you can use Open Office.


Back to Top

Projects

Downloading the Virtual Machines

Proj 1: Using Jasmin to run x86 Assembly Code (15 pts.)

If you don't want the drawing of a partially undressed woman on the splash screen, use this version of Jasmin:

Download politically correct Jasmin without the cheescake

Note: I now recommend using Kali 2.0 for the projects.

Tips for Kali 2

Proj 1 (must renumber later): Linux Buffer Overflow With Command Injection
Proj 2: Linux Buffer Overflow Without Shellcode (20 pts.)
Proj 3: Linux Buffer Overflow With Shellcode (20 pts.)
Proj 4: Remote Linux Buffer Overflow With Listening Shell (20 pts.)
Proj 5: Using nasm, ld, and objdump (10 pts.)
Proj 6: Exploiting a Format String Vulnerability (20 pts.)
Proj 7: Very Simple Heap Overflow (10 pts.)
Proj 8: Heap Overflow via Data Overwrite (10 pts.)
Proj 9: Exploiting "Vulnerable Server" on Windows (25 pts.)
Proj 10: Exploiting Easy RM to MP3 Converter on Windows with ASLR (20 pts.)
Proj 11: Defeating DEP with ROP (20 pts.)
Proj 12: Intro to 64-bit Assembler (15 pts.)
Proj 13: 64-Bit Buffer Overflow Exploit (15 pts.)
Proj 14: Heap Spray (15 pts.)
Proj 15: SEH-Based Stack Overflow Exploit (25 pts.)
Proj 16: Fuzzing with the Failure Observation Engine (20 pts.)
Proj 17: Security Shepherd (20 pts.)
Proj 18: Fuzzing with Spike (15 pts.)

Extra Credit Projects

Proj 1x: Assembly Code Challenges (30 points)
Proj 2x: Linux Buffer Overflow Without Shellcode Challenges (25 pts.)
Proj 3x: Embedded Security CTF (Up to 25 pts.)
Proj 4x: Linux Buffer Overflow With Shellcode Challenges (30 pts.)
Proj 5x: Linux Buffer Overflow With Canary (25 pts.)
Proj 6x: Remote Shell via Format String Exploit (20 pts.)
Proj 7x: Introduction to Hopper (20 pts.)
Proj 8x: Remote Shell via Heap Exploit (20 pts.)
Proj 9x: Understanding PE Files and ASLR on Windows (15 pts.)

Proj 12x: 64-bit Assembler Challenges (25 pts.)
Proj 13x: 64-Bit Remote Buffer Overflow with ASLR (25 pts.)

Proj 17x: Security Shepherd Challenges (Up to 40 pts.)

Proj 19x: Source Code Analysis with cppcheck (10 pts.)

Proj 21x: PicoCTF (Up to 40 pts.)
Proj 22x: Student Presentation (Usually 15 pts.)

Projects Still Undergoing Revision

Windows Server 2012 Buffer Overflow Defenses and EMET
Fuzzing "Vulnerable Server"

Cultural Enrichment

How to view someones IP address and connection speed with TRACER T! - YouTube

I Pwned Your Server - YouTube

Back to Top

Links

Links for Chapter Lectures

Ch 1a: Anatomy of a Program in Memory - Excellent explanation from 2009
Ch 1b: assembly - difference between 'or eax,eax' and 'test eax,eax'

Ch 2a: Smashing the Stack for Fun and Profit by Aleph One
Ch 2b: Assembly Programming Tutorial
Ch 2c: GDB Command Reference - set disassembly-flavor command
Ch 2d: GDB Tutorial

Ch 3b: What's the difference of the Userland vs the Kernel?
Ch 3c: Protection ring - Wikipedia
Ch 3d: The GNU C Library: glibc
Ch 3e: linux - What is the difference between exit() and exit_group()
Ch 3f: Two excellent syscall examples with explanations
Ch 3g: c - Linux system call table or cheetsheet in assembly language - Stack Overflow
Ch 3h: NASM Tutorial
Ch 3i: Shellcode in C - What does this mean? - Stack Overflow
Ch 3k: C code to test shellcode, simpler than that in the textbook
Ch 3l: execve(2): execute program - Linux man page
Ch 3m: Linux Syscall Reference
Ch 3n: Ways to do syscall: INT 0x80 and call *%gs:0x10 explained

Ch 4a: Format String Exploitation-Tutorial By Saif El-Sherel (updated 1-25-18, ty B Meixell)
Ch 4b: Exploiting Format String Vulnerabilities (from 2001)
Ch 4c: Advanced Format String Attacks (Paul Haas, Slides from DEF CON 18)
Ch 4d: Advanced Format String Attacks with demo videos
Ch 4e: Defcon 18 - Advanced format string attacks Paul Haas - YouTube
Ch 4f: Introduction to format string exploits -- with helpful gdb tips
Ch 4g: Ace Stream Media Format String Vulnerability (from 2014)
Ch 4h: Cisco Email Security Appliance Format String Vulnerability (9-9-2015)
Ch 4i: Graphviz Remote Format String Vulnerability, affects Ubuntu (from 2014)
Ch 4j: Polycom - H.323 Format String Vulnerability (from 2013)
Ch 4k: Python RRDtool Module Function Format String Vulnerability (from 2013)
Ch 4l: Broadcom UPnP Stack Format String Vulnerability (from 2013)
Ch 4m: pidgin-otr log_message_cb() Function Format String Vulnerability (from 2012)
Ch 4n: atexit(3) - Linux man page
Ch 4o: GOT and PLT for pwning
Ch 4p: PLT and GOT - the key to code sharing and dynamic libraries

Ch 5a: A Memory Allocator by Doug Lea
Ch 5b: Understanding the Heap & Exploiting Heap Overflows
Ch 5c: Several Interesting Heap Overflow Example Programs
Ch 5d: Four Excellent Heap Overflow Exercises (updated 1-25-18, ty B Meixell)
Ch 5e: Wonderful Exploit Exercises including VMs and heap overflows
Ch 5f: Dangling Pointer paper from Black Hat 2007
Ch 5g: Working example of a "Dangling Pointers" exploit?
Ch 5h: Dangling Pointers: Vulnerability and Exploitation Basics
Ch 5i: Much ado about NULL: Exploiting a kernel NULL dereference
Ch 5j: HEAP BASED EXPLOITATION. Scott Hand CSG 2/22/12 - PDF (link working 2-28-18)

Ch 6a: theForger's Win32 API Tutorial
Ch 6b: Process Explorer
Ch 6c: Portable Executable - Wikipedia
Ch 6d: PEview (PECOFF file viewer)
Ch 6e: Rebasing Win32 DLLs
Ch 6f: Why is 0x00400000 the default base address for an executable?
Ch 6g: VA (Virtual Adress) & RVA (Relative Virtual Address) - Stack Overflow
Ch 6h: Exploiting the LNK Vulnerability with Metasploit
Ch 6i: Is there any difference between a GUID and a UUID? - Stack Overflow
Ch 6j: Service Control Manager - Wikipedia
Ch 6k: Microsoft RPC Remote Procedure Call and End Point Mapper with Network Traces
Ch 6l: Setting Up Kernel-Mode Debugging over a Network Cable Manually (Windows Debuggers)
Ch 6k: IMMUNITY Debugger
Ch 6l: Operating Systems Development - Portable Executable (PE)
Ch 6m: RPC Endpoint Mapper in a network trace

L7a: AMD64 Architecture Processor (pdf, downloads immediately) (updated 1-25-18, ty B Meixell)
L7b: x64 Architecture - Windows 10 hardware dev
L7c: Introduction to x64 Assembly | Intel Developer Zone
L7d: Behind Windows x64's 44-bit Virtual Memory Addressing Limit
L7e: Windows 8.1 removes the 44-bit limitation (2015)
L7f: X86-64 (AMD64) Tutorial
L7g: AMD CPUID Specification
L7h: Searchable Linux Syscall Table for x86 and x86_64
L7i: Intel® 64 and IA-32 Architectures Software Developer’s Manual
L7j: 64-bit Linux stack smashing tutorial: Part 1
L7k: x86-64 - Wikipedia--AMD 64-bit processors only use 48-bit address space
L7l: Linux/x86_64 execve"/bin/sh"; shellcode 30 bytes
L7m: Writing shellcode for Linux and *BSD - Spawning a shell
L7n: Execve Shellcode 64 bit
L7o: Writing 64-Bit Shellcode - Part 1
L7p: 64 Bits Linux Stack Based Buffer Overflow (updated 1-25-18, ty B Meixell)
L7q: memory management - What and where are the stack and heap? - Stack Overflow

Ch 8a: Win32 Thread Information Block - Wikipedia
Ch 8b: TEB structure (Windows)
Ch 8c: Process Environment Block - Wikipedia
Ch 8d: PEB structure (Windows)
Ch 8e: assembly - What is the "FS" "GS" register intended for? - Stack Overflow
Ch 8f: Preventing the Exploitation of Structured Exception Handler (SEH) Overwrites with SEHOP (2009)
Ch 8h: SEH Based Overflow Exploit Tutorial - InfoSec Resources
Ch 8i: Windows ISV Software Security Defenses (2010)
Ch 8j: Software Defense: mitigating stack corruption vulnerabilities (2014)
Ch 8k: SEHOP per-process opt-in support in Windows 7
Ch 8l: Vista SP1 and Server 2008: Controlling SEHOP security protection
Ch 8m: Reducing the Effective Entropy of GS Cookies (2007)
Ch 8n: HeapCreate function (Windows)
Ch 8o: Heap Overflow: Vulnerability and Heap Internals Explained - InfoSec Resources
Ch 8p: Intercepting Calls to COM Interfaces - CodeProject
Ch 8q: Exploiting Lingering Vulnerabilities in Default COM Objects (pdf, 2011)
Ch 8r: OLE/COM Object Viewer Download
Ch 8s: Active X Exploitation - InfoSec Resources
Ch 8t: HEAP SPRAYING – ACTIVEX CONTROLS UNDER ATTACK -- STEP-BY-STEP INSTRUCTIONS (2013) (updated 1-25-18, ty B Meixell)
Ch 8u: Dranzer | Vulnerability Analysis | The CERT Division
Ch 8v: dranzer download | SourceForge.net
Ch 8w: dzzie/COMRaider on GitHub
Ch 8x: ActiveX vulnerabilities exploitation (from 2010)
Ch 8y: Win32 Thread Information Block - Wikipedia
Ch 8qq: No Loitering: Exploiting Lingering Vulnerabilities in Default COM Objects (paper) | Internet Society
Ch 14a: What is linux-gate.so.1?
Ch 14b: Heap overflow using Malloc Maleficarum
Ch 14c: Windows 8 Heap Internals
Ch 14d: RdRand - Wikipedia
Ch 14e: "We cannot trust" Intel and Via's chip-based crypto, FreeBSD developers say
Ch 14f: Windows 10 security overview
Ch 14g: Windows heap cookie is only 8 bits long

Ch 17a: Awesome-Fuzzing: A curated list of fuzzing resources ( Books, courses - free and paid, videos, tools, tutorials and vulnerable applications to practice on )

Ch 18a: Cscope Home Page
Ch 18b: Using Cscope on large projects (example: the Linux kernel)
Ch 18c: Exuberant Ctags
Ch 18d: Splint Home Page
Ch 18e: Splint the static C code checker
Ch 18f: OPEN SOURCE STATIC CODE ANALYSIS SECURITY TOOLS
CH 18g: More Tricks For Defeating SSL In Practice
Ch 18h: CVE-2003-0161 -- Sendmail prescan() function vulnerability
Ch 18i: Port 25 (SMTP) - Remote Sendmail Header Processing Vulnerability
Ch 18j: PHP Hash Comparison Weakness A Threat To Websites, Researcher Says
Ch 18k: Dangling pointer - Wikipedia
Ch 18l: How to Create a Secure Login Script in PHP and MySQL - wikiHow

Fuzz 1: Failure Observation Engine (FOE) tutorial - YouTube
Fuzz 2: Fuzz Testing for Dummies (2011)
Fuzz 3: Analyze Crashes to Find Security Vulnerabilities in Your Apps
Fuzz 4: VBinDiff - Visual Binary Diff
Fuzz 5: vbindiff(1) - Linux man page
Fuzz 6: An Introduction to Fuzzing: Using fuzzers (SPIKE) to find vulnerabilities - InfoSec Resources
Fuzz 7: Fuzzing with Peach Part 1
Fuzz 8: GlobalSCAPE CuteZIP Stack Buffer Overflow | Rapid7
Fuzz 9: Android Intent Fuzzer
Fuzz 10: Basic Fuzzing Framework (BFF) | Vulnerability Analysis | The CERT Division
Fuzz 11: HOWTO : CERT Basic Fuzzing Framework (BFF) on Ubuntu Desktop 12.04 LTS
Fuzz 12: Fuzzer Automation with SPIKE - InfoSec Resources
Fuzz 13: Fuzzing with Spike to Find Overflows
Fuzz 14: [Python] IRC Fuzzer - IRCdFuzz.py
Fuzz 15: american fuzzy lop
Fuzz 16: Bug Hunting Using Fuzzing and Static Analysis
Fuzz 17: Fuzzing Tools in Kali Linux

Ch 16a: Socket.NoDelay Property
Ch 16b: Flawfinder Home Page

Hopper 1: Use The Debugger with Hopper Disassembler/Decompiler - YouTube
Hopper 2: Tutorial
Hopper 3: Hopper Download
Hopper 4: Linux Installation
Hopper 5: Intro to Hopper - YouTube
Hopper 6: Crackmes | Reverse Engineering Mac OS X
Hopper 7: Linux x86 Program Start Up -- EXCELLENT EXPLANATION

Miscellaneous Links

SmashTheStack Wargaming Network
Great exploit tutorials from 2012 in the WayBack Machine
Exploit Exercises
farlight.org -- useful exploits and shells
Bypassing AV Scanners -- OLLYDBG PROJECT IN HERE
Valgrind Tutorial
Bypassing EMET's EAF with custom shellcode using kernel pointer (from 2011)
Disarming Enhanced Mitigation Experience Toolkit (EMET) v 5.0
Rootkits by Csaba Barta (from 2009) (updated 1-25-18, ty B Meixell)
PSA: don't run 'strings' on untrusted files -- WORTH EXPLOITING
From 0-day to exploit -- Buffer overflow in Belkin N750 (CVE-2014-1635)
Disarming and Bypassing EMET 5.1
BinScope Binary Analyzer -- vulnerability detector
Popular security suites open to attack -- DEP and ASLR Not Enabled
GDB: Debugging stripped binaries
USBPcap -- USE FOR PROJECTS
PBKDF2 - Wikipedia
Installing VMware Tools on Kali Linux
Kali Linux Downloads
IMMUNITY : Download
How to setup Dark Comet RAT (with download and pictures) : hacking
Cython: C-Extensions for Python -- MAKES SMALL EXEs
HT Editor -- powerful binary ELF editor
ntpdc local buffer overflow - Exploit Development example, interesting GDB commands
Seven Resume Strategies for the Long-Term Unemployed
KdExploitMe - Hackable Windows Kernel Driver -- USE FOR PROJECTS
64-bit Linux Return-Oriented Programming
Exploit Exercises -- GOOD FOR PROJECTS
WIRESHARK 1.12.4 and below Access Violation and Memory Corruption PoC
Fuzzing with AFL-Fuzz, a Practical Example ( AFL vs binutils ) -- USEFUL FOR PROJECT
Radare portable reversing framework
Hopper: The OS X and Linux Disassembler -- GOOD FOR PROJECTS
Gdbinit: user-friendly gdb configuration file -- GOOD FOR PROJECTS
Format String Bug Exploration -USEFUL FOR PROJECT
90s-style security flaw puts "millions" of routers at risk -- LOOKS GOOD FOR A PROJECT
Exploit Development Class for Win 7 64-bit -- USEFUL FOR PROJECTS
EDB (Evan's Debugger) -- Like OllyDbg on Linux ty @offsectraining
Sophos AV Bypass - YouTube
New buffer overflow protection in gcc 4.9 -fstack-protector-strong
Old Versions of Kali Linux
Animated Metasploit Linux Payload in gdb - YouTube
Stack Smashing On A Modern Linux System
Buffer Overflow Vulnerability Lab
VMware Tools installation fails when Easy Install is in progress -- GOOD SOLUTION
Installing VMware Tools in an Ubuntu virtual machine
How to turn OFF (or at least override) syntax highlighting in nano via ~/.nanorc?
Exploit writing tutorial part 11 : Heap Spraying Demystified | Corelan Team
MemGC and Control Flow Guard (May, 2015)
How exploit writers find bugs in Java Machine? - Reverse Engineering Stack Exchange
Mac OS Xploitation (2009)
Modern Binary Exploitation class from RPI
A binary analysis, count me if you can -- VERY USEFUL
picoCTF 2014 Baleful - Solving with Pin -- INTERESTING TECHNIQUE
How to detect a NX stack and other protections against buffer overflows -- VERY USEFUL
ROP for Linux ELF files: finding JMP ESP
Performing a ret2libc Attack (updated 1-25-18, ty B Meixell)
How to disable ASLR in linux permanently.
Python multiprocessing.Pool: -- EXCELLENT EXAMPLE
Rooting Freshly -- GOOD EXAMPLE OF PENETRATING A LINUX WEB SERVER
Exploiting memory corruption bugs in PHP Part 3: Popping Remote Shells
Execute Bash Commands Without Spaces with Brace Expansion
x64dbg: An open-source x64/x32 debugger for windows -- ALTERNATIVE TO IDA PRO
gdb bug on 64-bit ubuntu with fix: No module name libstdcxx - Stack Overflow
gdb - debugging with pipe using mkfifio
Fuzzing on MacOS X -- MANY USEFUL TIPS
Carnegie Mellon - Tools - VulWiki
The Ultimate Disassembly Framework -- Capstone
binjitsu/binjitsu: CTF framework and exploit development library
How To Install VMware Workstation 11 On Ubuntu 14.10
Exploitation of mem-corruptions vulns in remote C/C++ programs without source or binary
Artistic Rendering of Exploit Development Process
Blind Return Oriented Programming (BROP)
Linux Assembly Tutorial - Step-by-Step Guide
A fundamental introduction to x86 assembly programming
RIP ROP: Intel's cunning plot to kill stack-hopping exploits at CPU level with "shadow stack" (June, 2016)
Introductory Intel x86: Architecture, Assembly, Applications - YouTube
Assembly Primer for Hackers (Part 1) System Organization Tutorial.mp4 - YouTube
ARM Exploitation: Return Oriented Programming on ARM (on Linux)
How to read arbitrary RAM with format string vulnerability
The best resources for learning exploit development -- MANY GOOD PROJECT IDEAS
Use The Debugger with Hopper Disassembler/Decompiler - YouTube
Over the Wire Narnia Level 2 -) 3 -- GOOD EXTRA CREDIT PROJECT
Demystifying the Execve Shellcode (Stack Method)
Program exiting after executing int 0x80 instruction when running shellcode
Debugging - Modifying Code At Runtime
How to specify base addresses for sections with gcc -- ESSENTIAL FOR KALI 2017 PROJECTS
Windows Kernel Exploitation Tutorial
[Kernel Exploitation] 2: Payloads
Infosec_Reference/Exploit Development
Requests: HTTP for Humans -- Requests 2.18.4 documentation
PEDA - Python Exploit Development Assistance for GDB
Getting cozy with exploit development
Bypassing NX/DEP -- PoC || GTFO
Simple ASLR/NX bypass on a Linux 32 bit binary
Binary Analysis Tool -- INTERESTING FOR PROJECTS
Linux Kernel Debugging with VMWare Player Free
Force GCC to push arguments on the stack before calling function (using PUSH instruction)
Analyzing Metasploit linux/x86/exec payload
EXPLOITATION PROJECT: HeapSpray, SEH, EggHunter
Vulnserver -- GMON command SEH based overflow exploit
OakSim: ARM Assembly Simulator
ARM Assembly and Exploitation -- USEFUL FOR PROJECTS
VM of Ubuntu with ARM in QEMU
x64dbg -- Recommended by @malwareunicorn

New Unsorted Links

Radare2 Projects: "Practical case : Buffer Overflow 0x01 : https://t.co/rMSdRZFzfv 2)Methods and macros: the call stack : https://t.co/oDNYb0sAsr 3) Practical case: Patch Me 0x01 : https://t.co/Ta2cgWQm4E 4)Conditions and loops : https://t.co/hcZg1yNx3Z cc @LibraAnalysis"
L7r: x86-64 - Wikipedia
Immunity error: pycommands: error importing module -- caused by using 64-bit Python
The Cost of Buffer Security Checks in Visual C
Ch 14h: GS (Buffer Security Check) -- Official Microsoft Documentation
Enable or disable specific mitigations used by Exploit protection | Microsoft Docs
Control Flow Guard | Microsoft Docs
vulnserver/vulnserver.c at master � stephenbradshaw/vulnserver � GitHub
Dangling Pointers Avoid them Strictly!
Wxploiting Format Strings in Windows
6 Best Wireshark Alternatives for Android
DLL Hijacking with Ghidra--USE FOR PROJECT
wntools --CTF framework and exploit development library
Return Oriented Programming on ARM (32-bit)--USE FOR PROJECTS
Reverse Engineering with Ghidra -- USE FOR PROJECTS
Online Courses -- Ghidra
Heap Overflow Exploitation on Windows 10 Explained
Honggfuzz finding a double-free in VLC -- USE FOR PROJECT
How to Compile 32-bit Apps on 64-bit Ubuntu?
Debug 32 bit application with gdb in 64 bit environment
Modern Windows Exploit Development.pdf
Dump TEB/PEB in immunitydbg - Reverse Engineering Stack Exchange
Ch 7r: Maximum addressable memory under the current operating systems
L7r: Maximum addressable memory under the current operating systems
Demystifying Dot NET Reverse Engineering, Part 1: Big Introduction
Demystifying dot NET reverse engineering - PART 2: Introducing Byte Patching
Demystifying dot NET reverse engineering - PART 3: Advanced Byte Patching
Bypassing SEHOP
DEP Bypass using ROP Chains | Garima Sinha - securityresearch - Medium
Linux Kernel ROP - Ropping your way to # (Part 1) | Trustwave | SpiderLabs | Trustwave
Libxml2 Tutorial | AFLplusplus -- FUZZER PROJECT
2020-05-13: Solving Uninitialized Stack Memory on Windows -- INTERESTING CHART OF ROOT CAUSES
Porting VulnServer TRUN /.:/ exploit to Metasploit -- Duncan Winfrey
Bypassing SEHOP (but only 1/512 of the time)
Ch 3o: assembly - How to use sysenter under Linux?
GitHub - johnjhacking/Buffer-Overflow-Guide: This Bufferflow Guide includes instructions and the scripts necessary for Buffer Overflow Exploitation. This guide is a supplement for TheCyberMentor's walkthrough. Please watch his walkthrough if you're confused. Feel free to implement Pull Requests or raise Issues.
Labs | CyberDefenders ® | Blue Team CTF Challenges
2021-12-02: ydkhatri/mac_apt: macOS ( and ios) Artifact Parsing Tool
Learning Linux kernel exploitation - Part 1 - Laying the groundwork
Beginner Reverse Engineering Tutorials
Resources for learning exploit development
OSED - Navigating The Shadows
OSCP Guide
OFFENSIVE SECURITY & REVERSE ENGINEERING (OSRE) Course

          
Back to Top
Last Updated: 1-6-16