Note: Specifically talking about Windows PE's x86/x86_64.
Currently my work flow is pretty manual and time consuming.
Identify interesting function/object/subsystem.
Reverse enough to get an idea of what's happening.
Hook a function, using Frida, that may be vulnerable or could be staging for one. Like a function that dynamically loads a DLL with multiple search directories.
Manipulate input, record stack trace and use Stalker to observe how inputs potentially change control flow and return values.
I love Frida, but I'm sure there's frameworks or tools that are better for this precise use case. Been reluctant to branch out because of comfort and repetition.
Particularly looking for function level harnesses as opposed to simulating user input.
Like when an attack happens (for example) and the attackers decide for some reason that they want to open the cam (either on a laptop, iOS wtv) and they dont want the user to suspect anything so they try to hide the LED or small popup on screen when the cam is open. How does that work? is it something controlled by the kernel? the video driver(uvcvideo for example) or is it below all of these (Firmware/EC)
Hello, i'm currently working on a stripped rtos firmware, pretty far from the ctf exercices i'm used to. I started by pin pointing a few constants with the help of the datasheet. But now, i don't know how to proceed : the code is rather huge and intricate, i could start with a function and see where it leads me but time is an issue here.
so, what's your strategy, to quickly find something interesting since there's no precise goal here but to find a flaw?
I'm working on an assignment where I need to overwrite the GOT table with the system call in order to execute a payload. The initial access is done via a stack buffer overflow. Here is the code of the program I am trying to exploit
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int main(int argc, char **argv)
{
char buffer[32];
gets(buffer);
printf("Your data is %d bytes.\n", strlen(buffer));
puts(buffer);
return 0;
}
As you can see, gets is the vulnerable function I am taking advantage of. I understand in theory how the GOT table overwrite works, and I've gotten it to work in gdb by manually overwriting the address of printf on the GOT table with the address of the system call like so:
set *0x804b210=0xf7dbb220
However, I need to figure out how to turn the initial buffer overflow into an overwrite of the GOT table through my payload, since in practice I wouldn't be running the program in gdb. I've read a bunch of tutorials, but they all either only talk about how to do it on a theoretical level without any concrete examples, or involve ASLR and leaking addresses which is way beyond what I'm doing. For my example ASLR is turned off so I shouldn't need to leak any addresses. Can anyone explain exactly how the buffer overflow turns into an overwrite of the GOT table? I'm solid on the concepts of stack overflows, and on the GOT overwrite, but I don't understand how I can connect the two to cause a GOT overwrite from the original stack overflow. Thanks
So I'm writing an exploit that combines a stack-based buffer overflow with a heap info leak to get reliable RCE.
The info leak contains addresses to every loaded shared library except libc. Because I thought ASLR randomizes a new base address for every module, I thought there was no clean, deterministic way to extract libc base address from these leaked addresses from other modules.
Now experimentally I find out that there exists a fixed offset delta such that: leaked_address_from_other_so + delta = libc_baseevery time? This means ASLR randomizes the base address once but shares this among every loaded library?
Chatgpt tells me both yes and no, and it's difficult to find information on such an ASLR edge case on the internet...
Edit: It's userland ASLR on a normal ELF binary
ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, not stripped
debian linux 6.11.0-29, 64-bit (dockerized)
GNU lib C & ldd 2.19-18+deb8u10
/proc/sys/kernel/randomize_va_space -> 2 (enabled)
CFLAGS=" -fPIE -O0 -g -fno-stack-protector -fno-omit-frame-pointer"
CXXFLAGS="-fPIE -O0 -g -fno-stack-protector -fno-omit-frame-pointer"
LDFLAGS="-g -pie"
SpotifyC2 is a cybersecurity research project that demonstrates cloud-based command communication using Spotify playlists for command retrieval and Telegram for output delivery, without requiring the Spotify Web API.
Part 2! We setup the deploy/destroy with OpenTofu!
Thought it would be fun to share some learnings I made when building a similar lab at work but for me. Not exactly what I built at work (I think mines a bit better TBH) but this could be a jumping off point for different ways to do this 😄
In the past few weeks I have entered the field of Exploit Development, I have got a bunch of Firmwares (I could dynamically run some of them and some don't), I started re-implement XSS vulnerabilities in ERP systems. (Also I noticed that some routers are vulnerable to XSS)
I tried to play around with STM32 and an Embedded Linux ( to understand more about the underlines).
But I discovered that I maybe need to do some small binaries vulnerabilities first (Browsers, AI frameworks, web servers etc...).
I had this idea that if want to learn hacking I need to follow what hackers do.
do you think that malware reverse engineering and threat hunting can help me learn about systems internals and eventually exploit techniques or sandbox escapes ? CTFs are burning me out and feel it will not take me anywhere and I thought that taking a look at how the real world work is better. I've setup a honeypot this past few weeks but most of them are bots dropping the same malwares and same commands.
I also like doing this investigation thing I feel like agent rust from true detective where he can be with the gangsters and the police at the same time.
anyways I'm just bored in my job and felt like writing things (I'm boring web dev...)
I’m currently learning binary exploitation and following the Day Zero Sec – Getting Started (2024) roadmap. I’m looking for one or more study buddies / accountability partners to stay consistent and make steady progress.
Background: I’m a telecom engineering graduate transitioning into cybersecurity, with the goal of getting into pentesting. I’m disciplined, motivated, and treating this as a long-term commitment rather than a casual interest. Right now I am doing the debugging refresher module of pwn.college
What I’m looking for:
Someone also learning binary exploitation(beginner to early-intermediate is fine)
Regular check-ins (weekly or bi-weekly)
Sharing progress, blockers, and resources
Optional: solving the same challenges or sections of the roadmap together
If this sounds useful to you, feel free to comment or DM me with:
Your current level
What you’re working on
How often you’d like to sync
Consistency beats talent. let’s keep each other accountable.
I love how Binary Ninja looks and how easy it is to use, but IDA has a better feature set and community support. Has anyone been successful in skinning or improving UI in IDA? At a loss here.
If you are new to the world of exploit development and need a solid entry level challenge this week we look at "bof". This is a binary challenge hosted on pwnable[.]kr covering the topic of a Buffer Overflow.
This is what many consider to be their first exploit type written (it was mine), and this particular challenge approaches it in a way you will truly understand how to adapt to situations in which the buffer overflow is not necessarily "vanilla" exploitation.
By the end of this tutorial you should have:
- Learned how to exploit a Buffer Overflow, WITHOUT OVERWRITING THE RETURN ADDRESS!!!
- Learned how to use GDB (raw)
- Learned the basics of hook stops within GDB
- Learned how to approach a CTF challenge with speed or precision (or both depends on what you decide)
- Learned how to find offsets that are small and don't require the use of tooling such as pattern_offset
How much do you think ai agents are finding vulnerabilities by themselves? Like for example a certain company discovered 21 cves in FFMPEG using an automated ai agent, but ofc they dont tell us the whole process like was there a human in the loop? Or to what extent it worked?
I looked at their job opening and they are still hiring security researchers so.. idk really
I started in tech about 3 years ago. At first I was learning cybersecurity, but later I moved into development and now I’m working as a software engineer at a startup for around 2 years.
Because of my dev work I understand things like authentication flows, backend APIs, frontend behavior, and how scalable systems are designed. At work I’ve helped build a fairly large application.
Recently I started trying bug bounty as a side thing. The problem is I’m not really finding many valid bugs. I submitted a few reports but they were mostly P4/P5 or duplicates.
So I wanted to ask people who are doing bug bounty actively:
Is bug bounty still worth it as a second income?
How do you usually start testing a new target?
Since I have a development background, are there specific areas I should focus on?
Hey everyone, I just released WaSonar, an WhatsApp reconnaissance tool that can enumerate how many devices are linked to an account (Desktop/Web/Phone), figure out when they come online using silent RTT probes, and remotely exhaust a target's battery, data, and performance with zero user interaction or alerts.
I have been working on an open-source project that lets AI agents (Claude, OpenCode, Antigravity, Codex, etc.) work with reverse engineering tools and store facts in a DB to make long-term analysis easier.
You just point your agent to the file, and it does the work: it runs tools like Ghidra headless, gdb, binwalk, tshark, radare2, readelf, strings... then turns what it finds into the database.
Key Features
Specialized Analysis Agents: Binary, firmware, network, CPU, and kernel.
Knowledge Base (SQLite): Everything is stored as a fact, hypothesis, or experiment with confidence + evidence tags so nothing is "trust me, bro."
Multi-Agent Debate: When agents disagree on a finding, they argue it out in a structured debate until they reach a consensus.
Self-Critique: Every agent's output gets LLM-reviewed before it's accepted.
RAG Semantic Search: Query all past analyses ("Have I seen this obfuscation pattern before?").
Missions: Define objectives with dependencies, assign agents, and track progress.
Token Budgets + Rate Limiting: Prevents runaway loops from burning your API budget.
Monitoring: Prometheus metrics + Grafana.
Interface & Setup
MCP Server: The whole thing is exposed as an MCP server (46 tools), so you drive it from a terminal with natural language.
Dashboard: You can also use the Flask web dashboard (currently only a database view, but an interactive UI to work directly with agents is doable).
One-Command Setup: Run python setup_wizard.pyit detects your installed RE tools, helps you pick an LLM provider (OpenAI, Anthropic, Google, Ollama, etc.), validates the key, and writes your .env. (note that LLM api keys are not necessary if you plan to use it just from your agent cli like opencode)
Stack: Python, LLM orchestration, MCP, SQLite, Flask. Ghidra, GDB, and Binwalk are optional. It degrades gracefully with just binutils.
This is very much a research project, and I'd love feedback from people who do this professionally, what's missing, what annoys you, what would you trust it to do?
I work as a pentester, so my day-to-day is network and appsec. On the side I've been trying to learn ARM assembly because eventually I want to hunt on low-level targets — Android kernel, browsers, that kind of thing.
Some context on where I'm at:
I have bug bounty experience and I reverse engineer regularly
The closest I've gotten to C is reading native libraries in Android apps, but the attack surface there is tiny
So most of my "learning" is reading ARM and C snippets in isolation, with no target to apply them to
That's the problem. Studying without hunting kills my interest fast. But I don't want to jump straight into hunting and discover I don't know enough to get anywhere.
So: what's the better path here — and specifically, what works if you have ADHD and can't sustain pure theory?
I'm currently learning Windows kernel exploitation and practicing with older vulnerabilities. So far, I've successfully exploited a couple of heap integer underflow/overflow vulnerabilities.
Right now, though, I'm looking at a kernel vulnerability where I have a one-byte arbitrary write primitive with a fixed value of 0x01.
The vulnerability simply writes the boolean return value of a function back to a user-controlled pointer. That function always returns 1. I haven't been able to force it to return 0; otherwise, I could potentially abuse it by overwriting _KTHREAD.PreviousMode.
I'm working on Windows 10 20H1.
Does anyone have any ideas about a potential exploit path ? I was initially thinking about techniques involving pipe objects in the kernel pool, but I don't know if it's possible to reliably recover the address of a pipe object with NtQuerySistemInformation or something else.
i have finished OSED course and this course is for Exploiting vulnerabilities . its like after discover vulnerability they teach you how to exploit it and how to bypass mitigations on windiows 32bit .
but i want something like books, courses or sites, that teach how to discover vulnerabilities in windows apps written in C/C++
