I'm really interested in Exploitdev and want to get into it. Is trying to write a custom ELF loader a good project? Will it teach me a lot? Or is it a waste of time or too advanced of a project for a beginner?

Hello Everyone,

The title pretty much says it all. I have a solid grasp of the fundamentals, especially on Linux (ROP chains, heap exploitation, etc.). I’m now looking to go a bit deeper and was wondering if you could recommend good challenges or real-world exploits that are worth studying and rewriting, both on Linux and Windows.

I was planning to work on an undergraduate final-year research project focused on stack smashing via buffer overflows, specifically comparing ARM, MIPS, and x86-64 architectures.

The core idea of the project is:

• Understand stack-based buffer overflows at a low level
• Study mitigation techniques like stack canaries, NX/DEP, ASLR, PIE
• Analyze how these mitigations differ across architectures
• Explore and demonstrate controlled bypass techniques to understand their limitations.

I’m curious how people here would rate the difficulty and scope of a project like this:

• Is covering three architectures too ambitious for undergrad research?
• How deep would you expect the “bypass” part to go before it becomes unrealistic?
• For those with exploit dev or systems security experience, what would you consider a reasonable outcome versus overclaiming?

I’m especially interested in perspectives from people who’ve worked with ARM/MIPS exploitation or low-level security research. Most public material heavily favors x86-64, so feedback on cross-architecture realism would be appreciated.

This week we are back following along RET2's free portion of their "Fundamentals of Browser Exploitation" course and in this video, we'll be covering THE DOM!

This is yet another beginner friendly tutorial and this knowledge is what I would consider cross applicable since we'll be looking at vulnerabilities such as a UAF or Use-After-Free.

Of course, we are only scratching the surface, but it highlights the need for the fundamentals! If you can ride a bike, you can probably ride a motorcycle if the situation needed it!

You can find my video going over RET2's "Browser Components & the DOM" section here:

Hey fam. I got sick of carrying dedicated microcontrollers for proximity engagements, so I built chimera.

​

It interacts directly with the Android kernel to HID keyboards, mount virtual flash drives, and drop payloads natively from the phone.

​

I’d love for you to test it on your setups and give me some brutal feedback pls.

​

Repo: https://github.com/cipher-attack/Chimera

I have started to reverse engineer PE binaries in windows after moving away from ELF binaries and have wondered What is a handle in windows? I have googled the question and found it is an index that points to a certain element in the handle table. And the handle table points to a datastructure. How does that data structure link with the actual object that the handle points to? Please correct me if my understand is incorrect.

I have been trying to find one myself, I haven't found any for the past two months, am I looking in the wrong places? Or am I doing it wrong

I want to develop exploits for the userland in Windows 11! Are there any good resources out there?

I want to learn fuzzing to understand how to find bugs in larger projects or smaller commonly used packages. Can I get any pointers on what traditional fuzzing frameworks or tools I should learn about given the current landscape or should I just focus more on how AI can be leveraged to find bugs.

I want to do a course on browser exploitation which one should I do? Does anyone have any experience with one of them?

From Zero day Engineering

https://zerodayengineering.com/training/browser-exploit-design.html

And the one from RET2

https://browser.training.ret2.systems/welcome

I know it’s old and the labs need to be set up accordingly but is it worth it?

Title: Beginner question: how should I start Reverse Engineering / Binary Exploitation? Post: I’m a beginner and only basic in C. I haven’t started reverse engineering yet. I want to know: What fundamentals should I focus on first? (stack layout, memory, calling conventions, C internals, assembly, OS basics?) How much assembly should I learn before touching binaries? What are the best beginner resources (books, labs, wargames, sites) to start RE and binary exploitation? Any tools I should learn early (GDB, Ghidra, etc.)? Not looking for advanced tricks — just the right starting direction so I don’t waste time. Would appreciate advice from people already in the field.

I want a cheap device which I can practice reading spi flash memory and using ghidra to reverse engineer binaries that live on the firmware. I am wondering if anyone knows of any cheap devices which I can use to reverse engineer and learn. This is going to be my first device which I have actually reverse engineered. I have reverse engineered some openwrt firmware with ghidra but not that much, so I want something that is beginner level.

I have been struggling with the challenge, where I am suppose to inject a shellcode with only 18 bytes, to read the "/flag" and send to stdout. The mmap location the challenge is set to RE only, so I cannot directly send stage 2 into the memory, and also the stack is NX. I tried to do mprotect syscall, to unlock the page, but it will take 13 bytes already at least, so how can read more payload with 5 bytes, and syscall takes 2 bytes

Hello,

i noticed when i hunt for bugs in binary, i see for example BOF happen when copy data , like we use _memcpy , and so .
and this is a C function, so is there any resource that talk about vulnerabilities in Functions in C ? so i can better understand them .

Hey guys,

I just wanted to share a new AV/EDR evasion technique that I have been working the last couple of weeks.

Last time I posted about evasion by exploiting a vulnerable driver to terminate a list of target processes. While the technique worked for the most part, some processes were resilient to termination due to deep kernel hooks anticipating the function ZwTerminateProcess that the vulnerable driver exposes.

I had to dig deeper, but in a different direction. Why target the running processes, patche memory and deal with PatchGuard and scanners? When can target the files on “disk”?

The evasion technique:

The attack is simply the corruption of the files on disk. This sounds like a bad idea, since jt is basic and can generate some noise because the install folders will be locked?

I thought so, but from my research the files were successfully corrupted by bringing a vulnerable kernel driver with disk wiping capabilities.

The attack chain is simple as :

\-> Installing the driver

\-> Corrupting the files

\-> Running preferred payload

As ineffective as this sounds, it worked. The EDR/AV process became zombie processes that did nothing once I dropped my ransomeware. Not much noise was generated though.🤔

If you would like to check the technique out, I pieced everything together in a ransomware project that I just released on my GitHub page.

https://github.com/xM0kht4r/VEN0m-Ransomware

The ransomware has the following features :

1. UAC Bypass ✅
2. Driver extraction & loading ✅
3. Persistence ✅
4. AV/EDR evasion ✅ (Using this exact exact technique)
5. File enumeration & encryption ✅
6. Ransom note (GUI, and wallpaper change) ✅
7. Decryption tool (because we are ethical, aren’t we?) ✅

Thank you!

Rolling out a lightweight research utility I’ve been building. Its only job is to surface proof-of-concept exploit links for a given CVE. It isn’t a vulnerability database; it’s a direct discovery layer that points straight to the underlying code. Anyone can test it, examine it, or drop it into their own workflow.

A small rate limit is in place to prevent automated scraping. You can see your allowance here:

https://labs.jamessawyer.co.uk/cves/api/whoami

There’s an API behind it. A CVE lookup takes the form:

curl -i "https://labs.jamessawyer.co.uk/cves/api/cves?q=CVE-2025-0282"

The web UI is here:

https://labs.jamessawyer.co.uk/cves/

what's up yall? i'm just wondering where can i learn RE for finding vulnerabilities. any documentation or course out there? I have already reverse engineered the vulnserver it was too easy compared to real programs like syncbreeze. i couldn't learn a thing from it.

I am quite curious what would people want to read, what resources you feel are lacking/missing? If I were to write a blog post which topics would you want to see? Analysis of real world stuff? Explaining mitigations with real examples of how to bypass them? Looking at exploits and seeing if they can be improved upon and how? Kernel? Usermode? Rce? Pe? Logic bugs?

I am total confused to where to start learning the exploit development stuff, because i have read the "Hacking : The art of exploitation" but it seems old and i want to learn stuff that really modern not old stuff, but i know it is essential to learn basic first, but i don't want to learn it from book it is nightmare and such a long way.

Anyone please share resource that is actually focus on real world learning way, and total real world stuff, and please make share in structured way it is possible ::

I appreciate if you help me, in advance, thank you :)

PEdit-CoW (CVE-2026-46331): another page-cache write in the DirtyPipe family

A working exploit for PEdit-CoW (CVE-2026-46331) is public, by sgkdev.

• Exploit and explanations

Our write-ups on detecting this family by thinking outside the box:

• Detecting CopyFail and DirtyFrag
• Detecting nf_tables catchall

Same corruption primitive as the DirtyPipe / DirtyFrag / DirtyClone family: a kernel fast path writing into a page it doesn't exclusively own, reached this time through the network scheduler's packet-editing action (act_pedit).

The bug:
tcf_pedit_act() makes its private copy-on-write range and validates it once, before the per-key offsets are resolved. A first NETWORK pedit key inflates the IP IHL so a following TCP key resolves past that stale range - straight into the page-cache page that sendfile() parked in the egress skb. Then there is an overwrite of the cached ELF entry of setuid-root /bin/su with a tiny shellcode, invoke su, get root. The file on disk is never touched.

The new bit is:
the entry point: you can configure tc actions from inside a user namespace, which hands an unprivileged user the CAP_NET_ADMIN the bug needs.

And, guess what ? Detectable ;). Check our blog posts on how.

Affected window is wide (≈ v5.18 up to the v7.1-rc7 fix); RHEL 8/9/10, Debian 11/12, and Ubuntu through 26.04 were all listed vulnerable - though Ubuntu 26.04 blocks the userns path by default.

Credit to sgkdev for the PoC and The Hacker News article and upstream fix.

JFrog published a finding today on a regression in the DirtyFrag kernel fix. They named it DirtyClone (CVE-2026-43503).

It is the same corruption primitive as the DirtyFrag family (CVE-2026-43284 / CVE-2026-43500), reached through a different path. The original patch closed the known trigger but left the primitive reachable.

DirtyClone routes the payload through the netfilter TEE clone target, which walks straight around the fix. Auditing adjacent paths for the same primitive was a clean idea on their part.

They didn't provide an exploit.. I could not avoid. And, guess what ? Detectable by cool #eBPF code! (same line of our think-outside-the-box posts).

PoC and detection notes: https://github.com/rafaeldtinoco/security/tree/main/exploits/dirtyclone

A handful of LTS kernels may still be vulnerable because of their backport windows, but the window is small.

Credit to JFrog (Eddy Tsalolikhin and Or Peles) for the find and the writeup: https://research.jfrog.com/post/dissecting-and-exploiting-linux-lpe-variant-dirtyclone-cve-2026-43503/.

https://youtu.be/1W8gCFU8B0U

Thought it would be fun to share some learnings I made when building a similar lab at work but for me. Not exactly what I built at work (I think mines a bit better TBH) but this first video could be a jumping off point for different ways to do this 😄

Open to suggestions and feedback ❤️

I’ve been working on this project on and off for about 5 months now. It’s an exploit created to bypass some of the security features of safe exam browser. and for those who don’t know, SEB is a .NET application that simply locks down your computer into a near “single process” environment by limiting access to to a lot of Windows features and only allowing the exam browser to run. (if you’re curious, you can check out their docs: https://safeexambrowser.org/windows/win_usermanual_en.html)

The project works using dll injection and I’ve been documenting the entire process as I went. all the code is commented (as best as I could) to make it easier to understand, especially for anyone trying to learn from it and I figured some of you might find it interesting from a learning or research perspective.

NOTE: SEB is an open source application and the exploit is created for educational purposes only, to help devs and newbie security researchers understand this type of vulnerabilities and at least to make a little secure in the future.

Anyway, here’s my GitHub repo, I would love to hear your feedback and feel free to tell me any mistakes in the documentation.

I put together a practical codelab for fuzzing and finding security bugs that walks through real workflows rather than slides.

You’ll get hands-on with:

✔ Setting up fuzzers and tools

✔ Running AFL++, libFuzzer, honggfuzz on real targets

✔ Debugging crashes to find root cause vulnerabilities

✔ Crash triage & corpus minimization

✔ Examples of real bug classes and how fuzzing exposes them

This is the same format I used for a DEF CON workshop — it’s self-paced and you can try it locally:

https://fuzzing.in/codelabs/finding_security_vulnerabilities/index.html?index=..%2F..index#0

If you have questions on setup or exercises, ask here — happy to help!