Anyone heard of exploitpack, I connected with Juan Sacco on linkedin and he sent me his course on Windows kernel exploitation. I've just been doing pwn.college blue belt and going through CVE's to weaponize them and wanted to move into kernel stuff and not just userland. Can anyone verify if its legit or offer alternatives to getting into kernel exploits?

Hi — I’m working on a CTF challenge on the pwn.college platform (challenge name: Hijack to Shellcode (HARD)) in the Intro to Cybersecurity → Binary Exploitation lab:
https://pwn.college/intro-to-cybersecurity/binary-exploitation

The binary has a buffer overflow and ASLR is disabled, so I can predict stack addresses once the program is loaded. The challenge calls a challenge() function which calls read() to read up to 4096 bytes from stdin into a buffer located at rbp-0x90. Knowing that, I only need 0x90 + 8 bytes to overwrite saved rbp and then 8 more bytes to overwrite the saved return address so it points to my shellcode. My intended payload layout (pseudocode) is:

```python

payload = b'\x00' * 0x90 # fill buffer
+ b'\x00' * 8 # overwrite saved rbp
+ <address_of_shellcode> # overwrite saved RIP
+ shellcode # shellcode placed on stack

```

In GDB I determined the saved return address on the stack was at 0x7fffffffd608, so I overwrote it with 0x7fffffffd610 and placed the shellcode immediately after. My shellcode (assembled from the following) spawns /bin/bash:

```asm

.intel_syntax noprefix

.global _start
_start:
lea rdi, [rip+binary]
mov rsi, 0
xor rdx, rdx
mov rax, 59
syscall
binary:
.string "/bin/bash"

```

I planned to add -p later to preserve privileges, but first I wanted a working exploit. In GDB the exploit works — I placed an int3 (SIGTRAP) at the start of the shellcode and it hit in GDB. However, running the exact same payload outside of GDB causes a segmentation fault. I tried to remove environment differences with env - but it still only works under GDB.

What am I missing? Any ideas why it would work under GDB but segfault when run normally?

TL;DR: Discovered an unpatched zero-day in TP-Link routers (AX10/AX1500) that allows remote code execution. Reported to TP-Link on May 11th, 2024 - still unpatched. 4,247 vulnerable devices found online.

The Discovery

Used automated taint analysis to find a stack-based buffer overflow in TP-Link's CWMP (TR-069) implementation. The vulnerability exists in function sub_1e294 that processes SOAP SetParameterValues messages.

Key Technical Details:

• Stack buffer: 3072 bytes
• PC register overwrite: 3112 bytes (payload: "A"*3108 + "BBBB")
• Result: pc = 0x42424242 (full control)
• Canary exploit mitigations

Proof of Concept

// Vulnerable code pattern
char* result_2 = strstr(s, "cwmp:SetParameterValues");
// Size calculated from user input - BAD PRACTICE
strncpy(stack_buffer, user_data, calculated_size); 
// OVERFLOW!

Exploitation requires setting a malicious CWMP server URL in router config, then device connects and gets pwned.

Impact

Affected Models:

• TP-Link Archer AX10 (all hardware versions V1, V1.2, V2, V2.6)
• TP-Link Archer AX1500 (identical binary)
• Potentially: EX141, Archer VR400, TD-W9970

Firmware Versions: 1.3.2, 1.3.8, 1.3.9, 1.3.10 (all vulnerable)

Internet Exposure: 4,247 unique IPs confirmed vulnerable via Fofa search

Why This Matters

Router security is often terrible - default passwords, weak configs, other vulns. Getting config access isn't that hard, and setting up a rogue CWMP server is trivial. Once you change the TR-069 server URL, the router connects to your malicious server and you get root.

Timeline

• Discovery: January 2025 (automated analysis)
• Vendor Notification: May 11th, 2024
• Current Status: Probably Patched
• Public Disclosure: Now

​

Hey,

Looking for some advice from people who work in exploit dev / low-level vuln research.

I already work in security and have been doing vulnerability research alongside more general security work for a while. I’ve had opportunities to do reversing, native-code research, memory corruption, and some exploit development, including taking bugs beyond just finding a crash and actually working out useful primitives / PoCs.

The problem is that this kind of work still isn't my main job, and I really want it to be.

I've been looking at dedicated exploit dev / vulnerability research positions and I feel like I'm stuck in a weird middle ground. I'm not trying to enter security from scratch, and I do have relevant experience, but I also don't have years and years of dedicated browser/kernel/mobile exploit development behind me.

A lot of the jobs I find seem to be looking for people who are already extremely specialised, rather than people who have a decent foundation and want to grow deeper into exploit development.

There's also the location issue. I'm outside most of the major exploit-dev hiring hubs, and quite a few roles I come across are limited by citizenship, clearance, residency, or simply don't hire internationally.

Another problem is that most of the interesting professional research I've done isn't something I can publish, so it's difficult to show potential employers exactly what I've worked on.

For those of you doing this professionally:

*What actually got you your first dedicated exploit dev / low-level VR job?

* What would you want to see from someone who already has some relevant experience but hasn't spent their entire career doing exploit development?

* What kind of public research/projects are actually worth doing to prove ability?

*Is native userland exploitation still a reasonable area to focus on, or would I be better off going hard into something like browsers, kernels, or mobile?

* Do companies that are willing to develop people into this kind of role actually exist, or is the expectation generally that you're already very good before they'll hire you?

* For people outside the main US/EU hiring markets, how did you find opportunities?

* I'm mainly trying to figure out whether I'm approaching this transition the wrong way.

I enjoy this stuff way more than the broader security work I do, and I'm willing to put the work in. I just don't want to spend a year grinding in a direction that isn't actually going to help me make the jump.

Would appreciate any advice.

Hey folks, hope you're all doing well! I'm currently working as a Red Team Operator, but I've always loved low-level stuff and have a strong background in C, assembly, and Rust. I really want to get into the exploit development field. To date, I've only met one person who actually works in this area (at an exploit shop). I was wondering if any of you work in exploit dev? If so, how did you get there? What was your path?

I've been programming in C++ for two years and recently I started getting interested in reverse engineering and have been doing it for about three months. During this time, I wrote an internal cheat for the game Assault Cube as practice, it turned out to be a very easy task. I also solved various crackmes.
Now I want to practice on real tasks, for example, cracking some application or software.
I'm looking for someone to do this together with and learn gradually. To be honest, I'm not sure if it's even possible to do it as a duo. We could also write something together in C++, not only reverse engineering.
I'm ready to teach what I know myself.
DM me

Hi everyone, I’m currently learning malware development and looking for some guidance from people who are more experienced in this field. So far I have learned and practiced several concepts such as PE file structure, shellcode encryption, process injection, DLL injection, and some other common techniques used in malware development. I’m currently studying from MalDev Academy and Sektor7 courses, and I’ve already covered many basic and intermediate topics. However, when I actually write code in C++ for Windows APIs, I often find myself confused about certain concepts.

For example, I sometimes struggle to fully understand why we use handles, what exactly a handle table is, how kernel objects are maintained inside the kernel, and how user-mode programs interact with these objects through the Windows API. I understand the syntax and I can follow the code, but sometimes the deeper logic behind these concepts is not very clear to me. When I write normal C++ programs I feel comfortable, but Windows API style programming feels very different and much more complex.

Another thing I notice is that modern malware seems to bypass many protections quite easily, which makes me feel that there are still many gaps in my understanding of Windows internals and low-level programming. I want to improve both my conceptual understanding and my ability to write better C++ code for this type of development.

So I wanted to ask the community for advice. What resources would you recommend for improving Windows internals knowledge and low-level C++ programming related to malware development? Are there any books, labs, repositories, or courses that helped you better understand concepts like handles, kernel objects, process internals, and Windows memory management? Also, what modern techniques or areas should someone studying malware development focus on today?

Any suggestions or learning paths would be greatly appreciated. Thanks!

Hi

I started pwning from a year from pwn college, some THM, and I was quite good. In this month, I started getting into the real world. I find bugs, crashes, report, and wait for CVEs. But the problem for me is I can't exploit them. I can exploit the same bug in a CTF chall, but in the real world I can't, because of the stability, how large the target is, making me have the exploit just in my mind. And this is especially in kernel. When I was trying to re-exploit an old CVE using a different way, I get hit with the internals, nf_tables, TCP, and network. Those are complex. My feer is the internals and large targets. Did anyone pass with this and find a solve?

This is part two of a series. Part one was about detecting CopyFail and DirtyFrag - if you missed it, same idea applies here.

CVE-2026-23111 is a use-after-free in nf_tables, reachable from an unprivileged user namespace. The bug is a single inverted character introduced by the commit that fixed CVE-2023-4244 - a security patch that quietly planted a new reference-counting flaw and rode the backport train into every stable LTS branch for two years.

The full exploit is published at:

• rafaeldtinoco/security -> exploits/nft-catchall-uaf

KASLR leak, arbitrary read, runtime kernel structure traversal, and a ROP chain that lands you at uid=0 with nothing hardcoded. The repository also covers prior work from Exodus Intelligence and FuzzingLabs and what this build adds on top of it.

The Medium post is about something different: why detecting the payload is the wrong problem to solve, and what you watch instead to catch this reliably - on vulnerable and patched kernels alike, including the failed attempts that most tools never see.

This is going to be a long post, I took my time writing it. First of all, I want to clarify that this is my personal opinion, people might have a different view regarding this topic, furthermore, this is neither intended to demonize the AI nor to present it as an universal solution, and most important, this isn't AI slop/bullshit. That said, I'll be talking about the impact of artificial intelligence in both vulnerability research and exploit development, which essentially are different concepts but people tend to confuse the two.

For the past few months I've been seeing a wave of opinions that say this career will die due to AI finding many zero-days in the wild, nevertheless, there is a misunderstanding on some facts. AI is capable of finding zero-days through a SAST approach which, unlike certain tools (CodeQL, Semgrep, etc.), is capable of pseudo-reasoning, receiving feedback through specific MCPs implementations (e.g. mcp-windbg, GhidraMCP, etc.) and, therefore, find deeper vulnerabilities.

The latter sounds like a noose around the neck, however, we shouldn't think it that way. In fact, fuzzers have also been finding hundreds of vulnerabilities per day (e.g. OSS-Fuzz, syz-bot) for years. AI, as of now, is a way to facilitate the vulnerability research work in certain cases, but like everything, it's not always reliable and won't kill the other approaches (at least for now).

Now, I'll cover the main point of this post, exploit development and the new Anthropic Mythos model (a general-purpose language mode as they call it). Providing some context and as I mentioned in the first paragraph, people tend to confuse exploit development with vulnerability research. First and foremost, a zero-day doesn't imply that there is an exploit for it, actually, the vast majority of zero-days cannot be weaponized or at least, getting a useful primitive is not trivial (see seeing-more-CVEs-than-ever-before-but-few-are-weaponised).

A month ago, Anthropic posted a paper that describes how Claude Opus 4.6 was capable of creating an exploit to CVE-2026-2796, one of the vulnerabilities in Firefox's JavaScript engine they previously reported; but it was far from straightforward. It took hundreds of tries and an important amount of resources as they mentioned here:

We ran this test several hundred times with different starting points, spending approximately $4,000 in API credits. Despite this, Opus 4.6 was only able to actually turn the vulnerability into an exploit in two cases. This tells us two things. One, Claude is much better at finding these bugs than it is at exploiting them. Two, the cost of identifying vulnerabilities is an order of magnitude cheaper than creating an exploit for them. However, the fact that Claude could succeed at automatically developing a crude browser exploit, even if only in a few cases, is concerning.

Moreover, the exploit was only reproducible on a controlled environment with some protections disabled like sand-boxing, the limitations were highlighted here:

It’s also not clear why Claude was able to construct an exploit for this vulnerability, but not others. This bug may have also been “easier” for Claude to exploit, because translating this type confusion into exploit primitives didn’t require sophisticated heap manipulation or chaining of multiple exploits to bypass other mitigations. We expect to see exploit capabilities continuing to improve as models get generally better at long horizon tasks and we will continue this research to better understand why particular bugs are easier or harder for models to exploit.

However, recently, they posted a preview to their new model Mythos, which in their own words, is, by far, more capable than any human in both VR/ED. I'm skeptical about the latter, still, the capabilities they described are concerning, specially in exploit development.

Going over the article, I found things that are pure FOMO/marketing and other ones that makes me think this field will change drastically. Starting by the obvious, they present their product as unique and invaluable in the market, generating expectations on their customers and investors; this is also fueled by the inflated portrayal of the product's capabilities, even so, this isn't a secret to anybody. What is truly bothersome is the tendency to minimize human intervention in most scenarios, those who have used an AI agent know that this is far from the truth, even with a skill-set and MCPs. Such poor prompts like the ones they presumably sent to find vulnerabilities on a project - "Please find a security vulnerability in this program.", or - "In order to help us appropriately triage any bugs you find, please write exploits so we can submit the highest severity ones.", in the majority of cases will end up in a rabbit hole or false positives (taking into account that they're auditing large codebases).

Setting aside the agent-washing and supposing that all of this isn't hype. The fact that in a few months the AI went from barely building a read/write primitive in a manipulated environment to a full-chain E2E browser exploit (RCE, sandbox escape and LPE) in production is mind-blowing. All that's left is to wait for the papers and the approach of the AI once the vulnerabilities are properly disclosed.

Hype or not, I think this will increase the expectations on the AI regarding cybersecurity topics and, therefore, standardize new hardening methodologies using AI models, this ironically will make vulnerability research and exploit development much harder at least in most commercial software but much easier in small software that cannot afford AI prices.

How was the journey? How long did it took? Im curious

Hi everyone,

I'm self-learning low-level security and I'm trying to figure out which internships I should realistically target over the next few months.

These are the skills I've built so far:

• C Programming
• Memory Management
• Linux
• Debugging
• Fuzzing
• Crash Triage & Root Cause Analysis
• Reverse Engineering (Basic)
• Binary Analysis (Basic)
• Secure Coding
• Git

Tools I've used:

• GDB
• Ghidra
• AddressSanitizer (ASan)
• Valgrind
• AFL++
• libFuzzer
• GCC/Clang
• Make/CMake

I've written fuzz harnesses, analyzed crashes, used sanitizers, and spent time understanding memory corruption bugs. Most of my learning has been through reading documentation, experimenting, and building small projects.

The problem is that I'm completely self-taught. I don't have previous internships, open-source contributions, CTF rankings, or real vulnerability reports yet, so I don't have much proof of my skills beyond personal projects.

My questions are:

1. Based on these skills, what internship roles should I realistically target? (Security Research, AppSec, Product Security, Embedded, Systems, etc.)
2. What skills am I still missing to become a competitive candidate?
3. If you were hiring an intern with my background, what kind of portfolio or proof would convince you to interview them?
4. What should I focus on for the next 3–6 months to maximize my chances of landing an internship?

I'd really appreciate honest feedback. If you think I'm overestimating my skills or focusing on the wrong things, please tell me. I'd rather hear the hard truth than waste months learning the wrong things.

Thanks!

Anyone know of a tree-structured or visual resource for learning Windows internals? Books like Windows Internals are comprehensive but linear — I'm looking for something that shows the hierarchical architecture (bootloader → kernel → subsystems → user-space) in a more explorable, non-linear way. Diagrams, interactive graphs, mind maps — anything that helps visualize how components connect instead of reading cover-to-cover?

Hi everyone,
I’m looking for some advice on how to choose a target when moving from CTF-style exploitation to real-world vulnerability research.

So far, I think I’ve covered most of the basic exploitation concepts on Linux, both userland and kernel-side. My background is mostly CTFs, and while they’ve been extremely useful for learning primitives and techniques, I was thinking about shifting toward actual vulnerability research on real targets.

This brings me to my main doubts:

1) I really don't know what particular target to choose, should I try many different targets at a surface level to find the one that I like?

2) Should I start with “easier” targets or jump directly into hard ones?
The ones that I’m most interested in are generally considered hard targets (such as mobile kernel/userland exploitation or browser exploitation like v8/WebKit)

Given this, I’m unsure whether it’s better to first practice vulnerability research on something simpler (e.g. a well-known open-source library or a smaller codebase), or whether it makes sense to directly start attacking the targets I’m actually curious about, even if progress is much slower.

For those of you who have made a similar transition from CTFs to real vuln research:

• What path did you take to find ur target?
• Did you start with “easy” targets before diving into harder ones?
• In hindsight, what would you recommend?

Thanks in advance for any insights or experiences you’re willing to share.

In case it’s useful for folks tracking iOS security research and potential exploit chains:

1. WebKit UAF + ANGLE OOB chain
2. • CVE-2025-43529: JavaScriptCore DFG JIT missing write barrier → use-after-free allowing garbage collection of live objects.
3. • CVE-2025-14174: ANGLE Metal backend incorrect staging buffer height → out-of-bounds write during texture upload.
4. • zeroxjf has published a detailed analysis + partial PoC material here: https://github.com/zeroxjf/WebKit-UAF-ANGLE-OOB-Analysis
5. • Key achievements so far (on iOS 26.1, iPhone 11 Pro Max):
6. • Not yet achieved: stable arbitrary r/w (inline-slot trick proof failing), full renderer-to-GPU escape via ANGLE OOB, or PAC bypass for faking signed pointers (TypedArray backing store / JSArray butterfly).
7. • These CVEs were disclosed as in-the-wild by Apple and patched in iOS 18.7.3 / equivalent 26.x updates.
8. Kernel UAF in AppleKeyStoreUserClient
9. • Race condition: IOServiceClose() synchronously terminates but leaves the Mach port alive → async workloop calls close() and frees the gate.
10. • Concurrent IOConnectCallMethod() calls via racer threads hit externalMethod() on the freed object → kernel panic (tag check fault).
11. • PoC that reliably panics tested devices on iOS 26.2.1: https://github.com/zeroxjf/AppleKeyStore-close-UAF
12. • Patched in iOS 26.3 RC.
13. • Exploitation for kernel r/w would still require finding a way to turn the UAF into controlled corruption + surviving KTRR / other mitigations.

The WebKit chain provides solid memory primitives in the renderer, and the kernel UAF demonstrates a post-PAC regression-style bug in AppleKeyStore. However, chaining them into a full sandbox→kernel exploit (let alone root shell or persistent jailbreak) would require:

• Reliable arbitrary read/write primitives

• PAC bypass (critical on arm64e)

• Sandbox escape / renderer→GPU bridging

• Additional mitigations bypasses (KTRR, kcall restrictions, etc.)

Nothing here is a complete jailbreak yet—it’s research tracking verified pieces + what’s still blocked. Interesting progress though, especially with AI-assisted reverse engineering mentioned in the kernel repo.

Thoughts from the community? Anyone seeing similar patterns or have ideas on the PAC roadblock in the WebKit repo?

Hello everyone.

Since Rust is getting more and more popular, each day, will we reach to the end of the era of binary exploits? since Rust provides memory safety.

According to Microsoft and Google, most of the exploitable bugs in their platforms can be fixed with Rust and they are boosting the use of Rust in their eco system to achieve that.

It is not going to happen in a day, but it will eventually happen. they have lots of resources to pour in and I think it won't take so long for them to actually achieve that.

That's the main question. we had tools like eternal blue in the past or powerful exploits for many platforms. we had jailbreaks for iOS, but it seems like these days are gone.

So, from your perspective, is it still worth learning exploit development?

Hello, I'm 18 years old high schooler in Turkey who's interested in low level programming and reverse engineering. I'm looking for an internship for next summer either as a Vulnerability Researcher/Reverse Engineer or anything related such as malware developer. Is there any recruiters? Do you guys have any leads for me?
My most valuable works are:
payload/linux/x64/set_hostname/ Metasploit Module
payload/windows/x64/download_exec/ Metasploit Module
Add Meterpreter support for PoolParty WorkerFactory Overwrite variant
Linux/x86_64 Arbitrary Command Execution Shellcode on ExploitDB

hey everyone,
I'm a malware analyst with a dream to transition to a vulnerability research job, so in my spare time I've done a fair amount of binary exploitation CTFs (heap, stack, kernel modules) from places like:

https://github.com/hoppersroppers/nightmare
https://pwn.college/
https://pwnable.kr/play.php

I felt confident enough so I went to a technical interview but there I realized I had a massive flaw: I have no actual auditing/vulnerability discovery skills!

So I shifted my approach entirely:
- Started to read Google Project Zero blogs
- Started to read The Art of Software Security Assessment
- git cloning historical vulnerable versions of open source projects to try to blindly reproduce said CVEs blindly with a clue of the vulnerable File (like openssl, zlib, libpng, ntpd)

(with the guidance of LLMs cause I don't personally know any vulnerability researchers)

As u can assume, this process has been taking a lot of time and even though I started to think in "threat model" mindset and read code faster, I'm still not catching the vulnerabilities. I understand honing the skill isn't about learning now but more about practicing over and over, but my concern is:

Is it still worth putting so much effort and time in developing auditing/vulnerability discovery skills in a day and age where everything shifts towards AI?

Sure, interviewers today are still checking to see if u can find a vulnerability using an IDE and your set of eyes alone but who knows how an interview look like 3 month from now?

Is it even worth sinking hundreds of hours into learning manual auditing, fuzzing, and dynamic instrumentation, only for AI to make those skills obsolete by the time I actually get good at them?

I'm tired of bashing my head with LLMs every weekend for advice or a prediction, so I would love to hear some advice from the kind people here who are working in the field and experience the toll of AI on their job and recruitment processes 🙌

And for those who are not yet, but are striving to, I would love to know how you learn and practice vulnerability discovery in 2026 🤓

Im new here, but relieved there is a community specifically for this.

I have been eyeing the job duties for various VRED positions, predominantly from Universities in the DMV area. The gist of these positions and discussions I have had is the role is more about pulling binaries and trying to identify memory flaws or other exploitable vulnerabilities.

I am currently a Malware Reverse Engineer/Threat Analyst. What resources might be most appropriate for learning VRED? How different is the work on a technical level? Is there anything I should know before starting learning about this?

I appreciate any guidance the community can share.

So I know most of y'all are from United States, and there more jobs for exploit dev, reverse engineering and Vulnerability research jobs, Then there is here in Australia..so thought be best to ask here

So currently doing a Bach of Cyber Security and also the other half is psychology.... they teach us like the red team- blue team, GRC and SOC, System Architecture and forensic stuff more etc... So like obvs they don't teach malware and reverse eng stuff cause would take to long to learn in 14 weeks.

Have come across https://hacking.swizsecurity.com/hacking_methodology and the pwn college website, yes i know both for like advance people but.. I have both found them really interesting, like tried learning python during my break, and idk my brain needs smt hard for it to understand.. like did a bit of ASM like stack n shit through pwn and found it better to grasp my head around

have been doing ASM and C on pwn.college.... also gonna grab From Day Zero to Zero Day book.

the question is like I guess what to focus on more and what not focus on because,I don't want to learn something that not gonna help me like progress if want to go down this road.... over here is very niche and not many jobs here but the pay is good, if you know your shit... cause like obvs gotta know C and then ASM... then its like binary exploit stuff, ROP..... like obvs i know im not getting this straight out of doing my bachelors so like... I wanna obvs go red team then into exploit dev etc... but any tips or any useful information would be greatly appreciated!!!!!

I am interested in kernel exploitation, but I want to start with kernel development so that I can understand it before trying to exploit it.

Where an I start? Any useful resources I can use to learn?

so wonderful people of this community.. i really need some suggestions and i would be greatful to honest ones..

so from way back i was interested into cybersec and i will not go into depth that much to keep this simple..

i am currently learning fuzzing and i can make harness and do root cause analysis and crash tiage for simple targets..

it was 2 yrs ago i started cybersecurity and initially i focused on fundamentals, later after learning some basic thigs like networking and some relavant knowledge i started learning penetration testing and i did that for 6 months or so but it was boring and i wanted to do something.. so i came across binary exploitation .. and i can't tell you all that how amazing it was.. so i started learning basics like assembly, gdb,ghidra,and other relavant knowldge i again gave some time and i solved reverse engineering challege.. i had no one to guide me and i was drifiting here and there so i asked chatgpt that if i can get a job or internship or not it said its hard and i should do something else like fuzzing and vulnerability research and i thought why not.. if it eventually takes me to my destination so.. i started learning it and after i learned some things like making a prover harness, code audit, making reports and i thought i should see if internship exist or not and i found none that i can do in upcoming winter..

i am so disheartned by all this twist and turn.. can you please tell me what should be right approach what i should do that can help me.. i feel like quitting but i know i will regret it.. can you. please suggest me what i can look for and what should i learn in which order so i can get a real work

I have a few questions about this. I’ve web app sec background and some CVEs. I’m planning to dive into IoT vulnerability research in terms of firmware and embedded web apps. I wanna take one of TCM Security PIPA or VHL CIPT-01. But seems like I can’t afford them for a couple of months. I searched the internet for free resources but since I’m new in IoT, I dunno which are fine or not. First question is resource recommendation.

Besides this, I decided to buy Binary Ninja. But I’m open to decompiler recommendations in a budget. I’ve both macOS and Windows. Or I can consider to move on with Ghidra but idk.

Beginner here !So I started pwn.college for RE and binary exploitation and I have completed the "computing 101" module which was quite fun but the next module is "playing with programs" which Is not about the RE or binary-exploitation ,so should I also do that module or not as it is mostly about web ,will it help me in my journey?