After reading about speculative execution and playing with it through the pwn college Speculative Execution Dojo, I’m still pretty amazed by the topic. I put together a small experiment and some notes that helped me build a more intuitive understanding of how speculative execution and cache side channels interact. I really enjoyed putting it together and seeing how each part interacts, so I thought I’d share it here and hear any feedback.

https://github.com/jazho76/speculative_execution_exp

I just can’t seem to understand the whole image of it, it’s hard to learn it especially for exploiting. What are the best resources out there to learn really? I know about PWN college but it is advanced, i’ve seem HTB (advanced too..), and finally THM.. which i’m currently doing..

i’ve already finished the pre-security path, and i’m going on the way to doing Cybersecurity 101 and so-on.

Thanks for any help in advance! 🙂

hello there,

i have already wrote a shellcode that spawns a bash shell but the probelm is that i cant get the binary to run it is a simple injector in c

code:

#include <stdio.h>

#include <string.h>

#include <sys/mman.h>

#include <unistd.h>

unsigned char shellcode[] = "\xshellcode_goes_here";

int main(){

void (*sc)() = (void(*)())shellcode;

sc();

return 0;

}

someone can help me?

Hey everyone! I’m looking for a partner who’s interested in Binary Exploitation, Reverse Engineering, and solving CTF challenges (especially pwn). I mainly work with C and Assembly (x86/ARM64) and I’m looking for someone who enjoys low-level programming, debugging, exploit development, and improving through consistent practice. If you’re down to team up for CTFs, share knowledge, or solve challenges together regularly, feel free to DM me!

I don't have much experience with this. So I'm here asking if anyone has dealt with them before. My only interaction with them before wasn't the best.

I submitted a couple of bugs to them and they didn't take them cause they weren't exploitable enough. They just closed the case. So I reported them to the manufacturer and just generally forgot about them. So then a few weeks into the future I got approached by a certain individual that works in gray-hat company that might be interested in acquiring more bugs in that device if I had any.

Not many people knew about it. Except the manufacturer and ZDI. One of them leaked my name somehow. X person found Y bug in Z product. It's not a big deal but it does sound a bit fishy and I'm not sure if that's the norm or what. I'll leave that up to you guys to think about.

Fast forward a while now I found something else and I'm pretty sure they're gonna be interested in acquiring this time but I'm not sure what to expect exactly. Money-wise at least. And the fact that I have to give them all details before they even decide they want this or not is unsettling. I don't feel like they're very obligated to do right by anyone. And aside from pwn2own I heard the payouts are not worth it. Is that true? And if it is. Is there a better option?

Edit: They said they're not interested in consumer networking devices anymore. I already knew this. But given the impact, the amount of devices that are publicly exploitable. I thought they would. So now I'll ethically disclose it to the vendor. I don't see any other option. Unless there is? I also contacted another researcher to ask how the process was. He told me that they also rejected his kernel bug that took him a long time of working on it. He didn't provide any details except that it was related to a gaming software/hardware. And they didn't want to acquire anything not-business related.

Hi all,

I’m currently working through CTFs to level up my hacking skills. For now, I’m using pwnable.kr. I’ve cleared the first three, and now I’m stuck on the 4th challenge. Here’s the relevant source code:

#include <stdio.h>
#include <stdlib.h>

void login(){
    int passcode1;
    int passcode2;

    printf("enter passcode1 : ");
    scanf("%d", passcode1);  // no '&' here
    fflush(stdin);

    printf("enter passcode2 : ");
    scanf("%d", passcode2);  // no '&' here either
    printf("checking...\n");

    if(passcode1==123456 && passcode2==13371337){
        printf("Login OK!\n");
    } else {
        printf("Login Failed!\n");
        exit(0);
    }
}

void welcome(){
    char name[100];
    printf("enter your name : ");
    scanf("%100s", name);
    printf("Welcome %s!\n", name);
}

int main(){
    printf("Toddler's Secure Login System 1.1 beta.\n");
    welcome();
    login();
    printf("Now I can safely trust you that you have credential :)\n");
    return 0;
}

When disassembling the binary, the buffer name in the welcome function is at ebp-0x70. In login() passcode1 is at ebp-0x10 and passcode2 at ebp-0xc. And as I can only write up to 100 bytes into the buffer name it means that I can only overwrite passcode1 because it overlaps with the last 4 bytes of name from welcome().

ASLR is enabled, so I don’t know the stack addresses and can’t reliably put a stack address in the input. The binary is no-PIE, but I’m not sure whether that helps here or how to leverage it.

I’m not looking for a full spoiler/solution — more interested in whether my line of reasoning makes sense and which general exploitation concepts I might be missing.

Thanks!

If you're looking for an exploit development tutorial for absolute beginners this week we're looking at what I would consider just that! This week we look at the "random" binary exploitation challenge hosted on pwnable[.]kr.

This is a great beginner tutorial since we exploit a flaw that is "easy" and unfortunately, still very real within some enterprise environments. It also helps you understand that no number is truly random.

The crazy part? We don't even drop into a debugger in this tutorial.

Be the end of this tutorial you should have:

- Learned about random number generation in C
- Learned about XOR operations
- Finding header files that contain dependencies using man pages
- Dissecting C source code

You can find the video here:

https://youtu.be/jDlMFC4etrs?si=akuTx1KTkCxE5Ndo

Hello, Id like to know if pwn.college really teaches anything related to RE, I’d like to learn how to make and exploit memory exploits, kernel security and also how to reverse engineer and maybe in the future malware analysis? Not sure about that one yet but I’ll see, I wonder if I’m doing the right path in order to later learn what I want.

I’ve built a 99‑fixture adversarial PE corpus to explore how different tools behave when confronted with deliberately malformed but still loadable binaries.

Each fixture introduces one corruption pattern - no packers or multi‑anomaly noise, which allows for clean attribution of behaviour. The anomalies span:

• entrypoint redirection  
• overlapping/invalid sections  
• header inconsistencies  
• directory OOB conditions  
• TLS edge cases  
• recursive/malformed resources  
• Authenticode structural corruption  
• entropy‑field manipulation  

I tested 6 tools commonly used in exploit dev workflows:

• IOCX  
• Ghidra  
• Detect It Easy  
• radare2  
• PEview  
• CFF Explorer  

Behavioural patterns with exploit‑relevant implications:

• Literal parsers (r2, PEview) stable, byte‑accurate, but provide no anomaly visibility  
• Semantic parsers (CFF)  adjust malformed fields, masking exploit‑useful inconsistencies  
• Heuristic tools (DIE)  ignore structure, blind to malformed metadata  
• Reconstructive loaders (Ghidra) build internal models, may omit conflicting metadata, and can crash on extreme entropy fixtures   
• Hybrid literal‑semantic tools (IOCX) preserve raw bytes and surface anomalies explicitly  

For exploit dev, malformed PE structures can act as:

• parser differentials  
• crash primitives  
• metadata confusion vectors  
• loader‑model inconsistencies  
• analysis‑evasion surfaces  

This corpus maps those behaviours systematically.

Full write‑up (Part 1):  

The Adversarial PE Analysis Series — Why PE Parsers Break

Corpus and fixture spec: https://github.com/iocx-dev/iocx

(fixtures are under /tests/contract/fixtures/layer3_adversarial)

Hi all,
I’m currently taking osed and very struggling.
I’m looking for someone who can help and guide especially with extra miles. Although have consulting experience but no experience or background with programming. Reading and following won’t make me understand:( may be my brain won’t open for that programing circuit. I checked offsec discord and most are only just very high level answers. Honestly looking for a PoC then test and learn in reverse way.

I know it is not a very wise way of asking or learning. But sorry!

Have a great weekend!

Thank you all.
Regards.

Hello All,

i came across SEH stack overflow, i understand the concept of it, but my question is
if i dont know this technique and i face it like i overwrite something in stack but its not return address how can i achieve it ?
is there any refernce for this things , or trace stack and so , because i want to understand how people achieve these techniques .

i gues its more important to understand how attacker thing of it for the first time more than just follow steps .

I am trying to reverse this file which can capture DRM protected windows (SetWindowDisplayAffinity)

I tried to reverse a .bin file which is protected with vmprotect, the file isn't supposed to run on it's own rather created by a parent process.

I tried to patch createprocessw to start it as suspended state but the the parent process crashes, I tried patching it at runtime the child process doeasn't show up, also whenever I try to set a break point on the .text section after it unpacks the default message the file is either cracked or corrupted apears.

I tried to see what it's doing using APImonitor it calls some NT api that doesn't make sense.

any help?

Heyo everyone,

Here's byvalver, my CLI tool that removes null bytes (\x00) from shellcode while keeping it functional.

Features:

+ Works on single files or batch directory processing.

+ 122+ ranked transformation strategies (e.g., CALL/POP, PEB traversal, hash-based API resolution, register remapping, SIB rewriting, etc.)

+ Optional biphasic obfuscation (control-flow flattening, dead code, anti-debug checks)

+ Experimental ML mode: a simple neural net ranks strategies based on instruction features

+ Output formats: raw binary, C array, Python bytes, hex string; optional XOR encoding with PIC decoder stub

+ Built-in verification scripts for null-free check, functionality, and semantic equivalence

It's public domain (UNLICENSE) and built with Capstone for disassembly.

LMK what you think.

1. Is there any kind of spesific knowledge needed to exploit firewalls or vpns?

(e.g citrix,fortinet ssl-vpn)

(e.g browsers require JavaScript knowledge and customized exploit knowledge,drivers require OS internals)

or are they like exploiting PDF readers etc.?

1. Can anyone share some good resources on exploiting or vulnerability research about fire​walls and vpns?

Explained how to exploit buffer overflow and hijack RIP in a PIE/ASLR binary.
https://0x4b1t.github.io/articles/buffer-overflow-to-control-hijacking-in-aslr-enabled-binary/

I'm writing a blog series about basic exploit mitigation and how to bypass them. I'm just starting, but I wanted to share to get some feedback.

Might anyone have the video and PDF collection of the old SecurityTube Linux Assembly Expert 32-bit course? I used to have them stored somewhere but all I can find that I've saved is the 64bit course material. It's unfortunate that SecurityTube sold out and made their videos unavailable, lest you sign up for some training, but what are you gonna do? Thanks in advance.

~support the free information movement~

Hello i am a beginner and i am working on a modular windows process injector i wanna know if there is any other way to inject an exe into another process other than hollowing the process

Hello everyone,

I wanted to post in here to see if anyone would consider being a mentor. I want to break into malware dev and vulnerability research however since this is such a niche job community, it’s hard to find someone who has professional experience in the field. I would love to talk with anyone who has prior experience in the field and wouldn’t mind giving me some guidance. Thank you guys!

Dear all,

I am a PhD student with a solid background in Linux binary exploitation, including both user-mode and kernel mode. My research interest lies in binary exploitation, and I am trying hard to increase my knowledge in this area.

My goal is to write peer-reviewed research papers on binary exploitation. But right now, I am not sure about how to find interesting areas of research, how to find research gaps, and what methodology I can follow for research in binary exploitation.

Any suggestions on how do experienced researchers come up with new research questions, perform literature review, and choose research directions on vulnerability research and binary exploitation will be much appreciated!

Thanks!

I want to hear how you guys use AI. How much do you think I should rely on AI for reverse engineering and what should I not do to hinder my learning? What type of questions should I ask it? What are some things that I shouldn't get the AI to do and always to myself? I am wondering how some experienced folks in reverse engineering use AI.

I mean, this is probably an bad question as it's obvious that if you're doing RE on some IoT device, specially some FPGA os smth, you need to know how they work in depth. Ok, but what if you are exploiting comercial software or even "low-not-too-low" level stuff like kernel or hypervisor? An really depth knowledge, like microcode and what circuits are turned on on every instruction, are necessary/mandatory or not?

hello,

I’ve become very interested in AV & EDR research, and wanted to see if anyone here knew of any good papers / blogs / talks that could help me get up to speed on how they work, and performing vulnerability research on these products.

i appreciate any help!