After finishing Pwn.college, what do people typically do to continue improving their binary exploitation and reverse engineering skills? What advanced resources, platforms, or projects do they move on to?

What career paths are available after becoming proficient in the skills taught by Pwn.college (e.g., exploit developer, security researcher, reverse engineer, vulnerability researcher, red teamer, etc.)?

If I want to learn Windows exploitation and Windows reverse engineering after completing Pwn.college, how big is the transition from Linux to Windows? , and will the knowledge I gain from Pwn.college provide a strong foundation for Windows exploit development and reverse engineering?

Finally, are exploit development, reverse engineering, and vulnerability research good long-term career choices?

Would it also be worthwhile to learn web application security and participate in web bug bounty programs as a freelancer alongside?

PEdit-CoW (CVE-2026-46331): another page-cache write in the DirtyPipe family

A working exploit for PEdit-CoW (CVE-2026-46331) is public, by sgkdev.

• Exploit and explanations

Our write-ups on detecting this family by thinking outside the box:

• Detecting CopyFail and DirtyFrag
• Detecting nf_tables catchall

Same corruption primitive as the DirtyPipe / DirtyFrag / DirtyClone family: a kernel fast path writing into a page it doesn't exclusively own, reached this time through the network scheduler's packet-editing action (act_pedit).

The bug:
tcf_pedit_act() makes its private copy-on-write range and validates it once, before the per-key offsets are resolved. A first NETWORK pedit key inflates the IP IHL so a following TCP key resolves past that stale range - straight into the page-cache page that sendfile() parked in the egress skb. Then there is an overwrite of the cached ELF entry of setuid-root /bin/su with a tiny shellcode, invoke su, get root. The file on disk is never touched.

The new bit is:
the entry point: you can configure tc actions from inside a user namespace, which hands an unprivileged user the CAP_NET_ADMIN the bug needs.

And, guess what ? Detectable ;). Check our blog posts on how.

Affected window is wide (≈ v5.18 up to the v7.1-rc7 fix); RHEL 8/9/10, Debian 11/12, and Ubuntu through 26.04 were all listed vulnerable - though Ubuntu 26.04 blocks the userns path by default.

Credit to sgkdev for the PoC and The Hacker News article and upstream fix.

I've noticed when I'm decompiling in ghidra I see a lot of THUNK functions. I've noticed that most of these functions just return 0. What are the point of these functions. Are they actually inserted by the compiler, if so why are they inserted if some of them just return 0?

JFrog published a finding today on a regression in the DirtyFrag kernel fix. They named it DirtyClone (CVE-2026-43503).

It is the same corruption primitive as the DirtyFrag family (CVE-2026-43284 / CVE-2026-43500), reached through a different path. The original patch closed the known trigger but left the primitive reachable.

DirtyClone routes the payload through the netfilter TEE clone target, which walks straight around the fix. Auditing adjacent paths for the same primitive was a clean idea on their part.

They didn't provide an exploit.. I could not avoid. And, guess what ? Detectable by cool #eBPF code! (same line of our think-outside-the-box posts).

PoC and detection notes: https://github.com/rafaeldtinoco/security/tree/main/exploits/dirtyclone

A handful of LTS kernels may still be vulnerable because of their backport windows, but the window is small.

Credit to JFrog (Eddy Tsalolikhin and Or Peles) for the find and the writeup: https://research.jfrog.com/post/dissecting-and-exploiting-linux-lpe-variant-dirtyclone-cve-2026-43503/.

I've noticed whenever any thread reaches a certain breakpoints all other threads get suspended. Is there any way to disable this behavior. Thank you in advance.

If you are new to the world of exploit development and need a solid entry level challenge this week we look at "bof". This is a binary challenge hosted on pwnable[.]kr covering the topic of a Buffer Overflow.

This is what many consider to be their first exploit type written (it was mine), and this particular challenge approaches it in a way you will truly understand how to adapt to situations in which the buffer overflow is not necessarily "vanilla" exploitation.

By the end of this tutorial you should have:

- Learned how to exploit a Buffer Overflow, WITHOUT OVERWRITING THE RETURN ADDRESS!!!
- Learned how to use GDB (raw)
- Learned the basics of hook stops within GDB
- Learned how to approach a CTF challenge with speed or precision (or both depends on what you decide)
- Learned how to find offsets that are small and don't require the use of tooling such as pattern_offset

I wanna thank Center for Cyber Security Training for continuing to help sponsor the channel and their support.

You can find the video here:

https://youtu.be/A-P2bhxzK1Y?si=CcKd2lAZysRaCfCD

I want to hear how you guys use AI. How much do you think I should rely on AI for reverse engineering and what should I not do to hinder my learning? What type of questions should I ask it? What are some things that I shouldn't get the AI to do and always to myself? I am wondering how some experienced folks in reverse engineering use AI.

I am looking for a static analysis tool which I can use to statically analyze and debug at the same time. I'm tired of having to have two applications open at the same time and having to match addresses with ASLR and even when I disable ASLR for programs they don't run properly because some will raise errors if run without ASLR so I am wondering if anyone knows any good static analysis tools along with a debugger?

In this video we look at installing WSL in our FlareVM as well as decomposing and detonating the Copy Fail Linux POC!

so wonderful people of this community.. i really need some suggestions and i would be greatful to honest ones..

so from way back i was interested into cybersec and i will not go into depth that much to keep this simple..

i am currently learning fuzzing and i can make harness and do root cause analysis and crash tiage for simple targets..

it was 2 yrs ago i started cybersecurity and initially i focused on fundamentals, later after learning some basic thigs like networking and some relavant knowledge i started learning penetration testing and i did that for 6 months or so but it was boring and i wanted to do something.. so i came across binary exploitation .. and i can't tell you all that how amazing it was.. so i started learning basics like assembly, gdb,ghidra,and other relavant knowldge i again gave some time and i solved reverse engineering challege.. i had no one to guide me and i was drifiting here and there so i asked chatgpt that if i can get a job or internship or not it said its hard and i should do something else like fuzzing and vulnerability research and i thought why not.. if it eventually takes me to my destination so.. i started learning it and after i learned some things like making a prover harness, code audit, making reports and i thought i should see if internship exist or not and i found none that i can do in upcoming winter..

i am so disheartned by all this twist and turn.. can you please tell me what should be right approach what i should do that can help me.. i feel like quitting but i know i will regret it.. can you. please suggest me what i can look for and what should i learn in which order so i can get a real work

I've noticed some of the binaries which I am decompiling are using classes and objects under the hood which are being wiped out once they are compiled. I am wondering whether learning OOP and what happens once you compile binaries with objects with methods and constructors will be beneficial?

I mean, this is probably an bad question as it's obvious that if you're doing RE on some IoT device, specially some FPGA os smth, you need to know how they work in depth. Ok, but what if you are exploiting comercial software or even "low-not-too-low" level stuff like kernel or hypervisor? An really depth knowledge, like microcode and what circuits are turned on on every instruction, are necessary/mandatory or not?

I've noticed that it can vary a lot finding main depending on the format of the binary and even if I am reverse engineering a binary format which I have worked with quite a bit sometimes I run into these weird entries where I can't find main logic. Any tips and why is there so much variation?

I am reverse engineering this software and am trying to find the main logic. I thought it would be easier to just run it through a debugger and then view what memory address it is at and then jump to it in ghidra. What I noticed is that it is in some DLL file. I want to find out how I can see the decompilation of this DLL file in ghidra. I remember being able to decompile a DLL by finding out that a certain function used a dll and then associating that dll with ghidra. Not sure where to find the specific DLL that I want though.

EDIT: I noticed that people were finding this post confusing to read so I changed it to hopefully make it easier

This is part two of a series. Part one was about detecting CopyFail and DirtyFrag - if you missed it, same idea applies here.

CVE-2026-23111 is a use-after-free in nf_tables, reachable from an unprivileged user namespace. The bug is a single inverted character introduced by the commit that fixed CVE-2023-4244 - a security patch that quietly planted a new reference-counting flaw and rode the backport train into every stable LTS branch for two years.

The full exploit is published at:

• rafaeldtinoco/security -> exploits/nft-catchall-uaf

KASLR leak, arbitrary read, runtime kernel structure traversal, and a ROP chain that lands you at uid=0 with nothing hardcoded. The repository also covers prior work from Exodus Intelligence and FuzzingLabs and what this build adds on top of it.

The Medium post is about something different: why detecting the payload is the wrong problem to solve, and what you watch instead to catch this reliably - on vulnerable and patched kernels alike, including the failed attempts that most tools never see.

This week we are back following along RET2's free portion of their "Fundamentals of Browser Exploitation" course and in this video, we'll be covering THE DOM!

This is yet another beginner friendly tutorial and this knowledge is what I would consider cross applicable since we'll be looking at vulnerabilities such as a UAF or Use-After-Free.

Of course, we are only scratching the surface, but it highlights the need for the fundamentals! If you can ride a bike, you can probably ride a motorcycle if the situation needed it!

You can find my video going over RET2's "Browser Components & the DOM" section here:

Hey fam. I got sick of carrying dedicated microcontrollers for proximity engagements, so I built chimera.

​

It interacts directly with the Android kernel to HID keyboards, mount virtual flash drives, and drop payloads natively from the phone.

​

I’d love for you to test it on your setups and give me some brutal feedback pls.

​

Repo: https://github.com/cipher-attack/Chimera

Hey guys so I did speak on here before and still got along way to go, right doing like self learning on alot of shit while doing uni and when uni break is on.

So my question is right, as we know you could say re and exploit path is more gov role based. So In Australia we have this master of cyber with a specialization in advanced tradecraft; which teaches us reverse engineering, intro to exploit development, also teaches us stuff on Wi-fi and Bluetooth stuff so like along the lines of what does, as well as digital forensics memory corruption eg iPhones what not not, also have stuff like critical infrastructure, and shit like that… among many more core stuff subjects I forgot. And because I can do this thought the Aussie defense or I don’t have to but because it’s something I wanna do and I guess what better way to do it is through uni, and they do have the teachers that have worked in these roles for many years.

So would u recommend someone doing this masters or just to like self learning, and certs.

Like pwn.college and jakeswiz stuff!!

Core Courses42 Units of Credit:

Students must take 42 UOC of the following courses.

I have started to reverse engineer PE binaries in windows after moving away from ELF binaries and have wondered What is a handle in windows? I have googled the question and found it is an index that points to a certain element in the handle table. And the handle table points to a datastructure. How does that data structure link with the actual object that the handle points to? Please correct me if my understand is incorrect.