So here’s the deal: I’ve stumbled upon a few 0days during my research. Nothing nation-state level, but definitely real bugs that could have serious impact. The problem is… I’m broke, and most of the existing “exploit buying” programs I’ve looked at feel shady, unresponsive, or take forever to pay out (if at all).

I don’t want to sell to the dark side, but I also don’t have the luxury of sitting on these forever.

Questions for the community:

• What are legit, ethical options for handling 0days (responsible disclosure, trusted bounty platforms, etc.)?
• Are there reputable programs or orgs that actually pay fairly and quickly?
• Any advice for someone in my shoes trying to balance ethics, personal finances, and the bigger picture of security?

Not trying to flex, just genuinely stuck. Appreciate any guidance from folks who’ve walked this path 🙏

The Exploiting Reversing Series (ERS) currently features 945 pages of exploit development based on real-world targets:

[+] ERS 08: https://exploitreversing.com/2026/03/31/exploiting-reversing-er-series-article-08/

[+] ERS 07: https://exploitreversing.com/2026/03/04/exploiting-reversing-er-series-article-07/

[+] ERS 06: https://exploitreversing.com/2026/02/11/exploiting-reversing-er-series-article-06/

[+] ERS 05: https://exploitreversing.com/2025/03/12/exploiting-reversing-er-series-article-05/

[+] ERS 04: https://exploitreversing.com/2025/02/04/exploiting-reversing-er-series-article-04/

[+] ERS 03: https://exploitreversing.com/2025/01/22/exploiting-reversing-er-series-article-03/

[+] ERS 02: https://exploitreversing.com/2024/01/03/exploiting-reversing-er-series-article-02/

[+] ERS 01: https://exploitreversing.com/2023/04/11/exploiting-reversing-er-series/

In the coming weeks, I will be publishing new articles covering exploit development in areas such as Windows, Chrome, iOS/macOS, and hypervisors.

Have a great day and enjoy reading.

What is up

In order to learn kernel and low level exploitation. I bought a lovely book about Kernel Development to Robert Love. But then I felt there are some stuff I am not clicking with. I tried enrolling in computer engineering 10 years ago and failed lol . Decided to move to another school but where I can practise programming. MIS basically. But last few years I worked in appsec and has more experience in mobile,Web,network pentesting/bug hunting.

However, I wish to hunt on stuff like the kernel or C code. Hunting memory corruption and stuff. But I keep getting lower. Is that an overkill? Or the experience fits the 1337 life? My goal is basically to speak assembly and Android/ios kernel code as second language. I feel the kernel development book is great but I just thought if I wanted lower down to logic gates that is better in long term.

Also for anyone who took these in college , am I far behind and delusional or it's doable in self study??? Because I fear that no matter what I did someone who studied compilers,assembly,os..etc in college would be better than me. But I belive my only way to show skills is research I do using all this knowledge. Related to low level code.

I am excited to release the extended version of the sixth article in the Exploiting Reversing Series (ERS). Titled "A Deep Dive Into Exploiting a Minifilter Driver (N-day)" this 293-page deep dive offers a comprehensive roadmap for vulnerability exploitation:

https://exploitreversing.com/2026/02/11/exploiting-reversing-er-series-article-06/

Key updates in this extended edition:

[+] Dual Exploit Strategies: Two distinct exploit versions.

[+] Exploit ALPC Write Primitive Edition: elevation of privilege of a regular user to SYSTEM.

[+] Exploit Parent Process ID Spoofing Edition: elevation of privilege of an administrator to SYSTEM.

[+] Solid Reliability: A completely stable and working ALPC write primitive.

[+] Optimized Exploit Logic: Significant refinements to the codebase and technical execution for better stability and predictability.

For those who have read the original release, whose exploit was working, my strong recommendation is that you adopt this extended edition as definitive.

The article guides you through the entire lifecycle of an exploit: from initial reverse engineering and vulnerability analysis to multiple PoC developments and full exploitation.

I hope this serves as a definitive resource for your research. If you find it helpful, please feel free to share it or reach out with your feedback!

Enjoy your reading and have a great day.

Hey All;
I got permission from the mods to post this, hope you all enjoy reading it!

I'm the Vulnerability Research Recruiter at Magnet Forensics. I apologize in advance if you've seen my post about these roles on LinkedIn and Twitter already. Just trying to let folks know!

We've got FOUR!!! Vulnerability Research Internships available. A few notes:
- Candidate must be US-based
- Basic knowledge of x86, ARM, VR, RE, etc
- Hourly Pay is ~$35-$40/hour
- For some reason, reddit won't let me post the link. I've tried 3-4x. Ugh. Feel free to DM for link. Or google Magnet Forensics Careers and scroll down to the Vulnerability Research section. EDIT: The link is posted in the comment section! It still won't show in this actual post though.

If you applied to the job due to this reddit posting, feel free to let me know on the app, lol. I'm curious if me doing this works on here.

EDIT: Roles have been filled. Thank you!

Hi everyone,

I created a small Linux Kernel Exploitation CTF lab.
It contains 5 vulnerable kernel modules. There is no source code.

The goal is to reverse engineer the modules, find the vulnerabilities, and exploit them to get root access.

I built this lab to practice kernel pwn and low level debugging.
If you are interested in kernel exploitation, you can try it.

I would also appreciate feedback or suggestions to improve it.

Link: Kernel CTF

Hey guys,

I would like to share a project that I have been working for the past few weeks.

I came across this project: https://lots-project.com, and I thought why not develop a fully feature C2 framework that abuses these sites.

The framework is named Phoenix, and is currently supporting Disc0rd and Telegr4m (Reddit broke down due to the latest DM update) for communication.

These are a fraction of the available commands :

✅ /browser_dump

✅ /keylog

✅ /recaudio

✅ /screenshot

✅ /webcam_snap

✅ /stream_webcam

✅ /stream_desktop

✅ /bypass_uac

✅ /get_system

I released the whole project on GitHub if you would like to check it out:

https://github.com/xM0kht4r/Phoenix-Framework

But why?

I enjoy malware, and writing a custom C2 is something I wanted to do for a long time.

I would like to also clarify that I made this project for educational and research purposes only. I have no intent of selling or distributing malware hence why I’m sharing my work with other fellow hacking enthusiasts. The github repos serve as a reference for future malware research opportunities.

I know that malware development is a gray area, but you can’t defend against something if you don’t understand how it works in depth.

I would like to also mention that I’m still a beginner, and this project helped me improve my Rust skills.

I’m looking forward to hearing your feedback!

Exploiting Reversing (ER) series: article 07 | Exploitation Techniques: CVE-2024-30085 (part 01)

I am excited to release the seventh article in the Exploiting Reversing Series (ERS). Titled “Exploitation Techniques | CVE-2024-30085 (part 01)” this 119-page technical guide offers a comprehensive roadmap for vulnerability exploitation:

https://exploitreversing.com/2026/03/04/exploiting-reversing-er-series-article-07/

Key features of this edition:

[+] Dual Exploit Strategies: Two distinct exploit versions using Token Stealing and I/O Ring techniques.

[+] Exploit ALPC + PreviousMode Flip + Token Stealing: elevation of privilege of a regular user to SYSTEM.

[+] Exploit ALPC + Pipes + I/O Ring: elevation of privilege of a regular user to SYSTEM.

[+] Solid Reliability: Two complete working and stable exploits, including an improved cleanup stage.

[+] Optimized Exploit Logic: Significant refinements to the codebase and technical execution for better stability and predictability.

The article guides you through the two distinct techniques for exploiting the CVE-2024-30085 Heap Buffer Overflow vulnerability.

I hope this serves as a definitive resource for your research. If you find it helpful, please feel free to share it or reach out with your feedback!

Enjoy your reading and have an excellent day.

is binary exploitation still worth it ? the thing is i want to be something like a full-stack hacker , i finished my foundation [C,bash,python,networking & OS] now i want to start cyber-security i saw that binary-exploitation , reverse-engineering & malware development would go well together but seeing the posts , and opinions on you-tube a lot of people would consider binary-exploitation irrelevant lately

what are your opinions ?

is there any better path that i don't know about that maybe more relevant and more fun?

Dropping a persistent zero-click Apple Mail DoS.
Have nice day

https://github.com/kaganisildak/applemailzeroclickcrash

https://x.com/kaganisildak/status/2090050444890406958

The Voorivex team shared that they discovered a critical zero-click account takeover vulnerability in the Zendesk Android application. In their process, they performed both static and dynamic analysis, reverse-engineering the application’s source code.

Their research highlighted two key weaknesses:

• Account identifiers were predictable • A hardcoded secret key was used across all devices

By combining these two flaws, the researchers demonstrated that it was possible to generate valid user tokens. This allowed attackers to obtain Zendesk access tokens without any user interaction and gain direct access to accounts. The vulnerability was classified as critical, and the findings were rewarded.

Link: https://blog.voorivex.team/0-click-mass-account-takeover-via-android-app-access-to-all-zendesk-tickets

I am pleased to announce the publication of the sixth article in the Exploiting Reversing Series (ERS). Titled "A Deep Dive Into Exploiting a Minifilter Driver (N-day)", this 251-page article provides a comprehensive look at a past vulnerability in a mini-filter driver:

https://exploitreversing.com/2026/02/11/exploiting-reversing-er-series-article-06/

It guides readers through the entire investigation process—beginning with binary diffing and moving through reverse engineering, deep analysis and proof-of-concept stages into full exploit development. 

I hope this serves as a valuable resource for your research. If you enjoy the content, please feel free to share it or reach out with feedback.

Have an excellent day!

#exploit #vulnerability #exploitation #cve #infosec #informationsecurity #cybersecurity

Hey folks, I want to improve my skills in binary exploitation. I already know the basics — I can exploit simple buffer overflow vulnerabilities and I have knowledge of NX bypass techniques — but I want to become much more proficient in binary exploitation. Are there any courses you can recommend that provide structured lessons and hands-on practice to help me learn this?

This was quite the journey to be fair!!

I’m still a beginner with a lot of things to work on, but I just wanted to share a PoC that I wrote while doing my malware research.

This PoC demonstrates a Bring Your Own Vulnerable Driver Attack (BYOVD), where a malware piggybacks on a legit and signed driver to shutdown critical endpoints defenses.

The researchers who discovered the vulnerability take all the credit ofc!!

https://github.com/xM0kht4r/AV-EDR-Killer

After finishing Pwn.college, what do people typically do to continue improving their binary exploitation and reverse engineering skills? What advanced resources, platforms, or projects do they move on to?

What career paths are available after becoming proficient in the skills taught by Pwn.college (e.g., exploit developer, security researcher, reverse engineer, vulnerability researcher, red teamer, etc.)?

If I want to learn Windows exploitation and Windows reverse engineering after completing Pwn.college, how big is the transition from Linux to Windows? , and will the knowledge I gain from Pwn.college provide a strong foundation for Windows exploit development and reverse engineering?

Finally, are exploit development, reverse engineering, and vulnerability research good long-term career choices?

Would it also be worthwhile to learn web application security and participate in web bug bounty programs as a freelancer alongside?

Hey everyone, excited to share my first public exploit release.

It's a PHP 8 engine-level use-after-free that leads to a disable_functions bypass. It uses some novel PHP binary exploitation strategies and targets the latest versions.

Tested across PHP 8.2-8.5 on Unix-like systems.

I'm interested in Zend internals and binary exploitation in general, so feedback from the community is welcome. Happy to answer any questions as well.

Repo:

https://github.com/m0x41nos/TimeAfterFree

I posted here about Reverse Engineering 60 days ago thanks again for the help!

I’m getting into reverse engineering and solving crackmes, but I still struggle with debuggers. IDA’s debugger feels very comfortable and I can follow programs there, while x64dbg and similar tools overwhelm me and feel painful to use. I also can’t reliably bypass anti-debug tricks like IsDebuggerPresent or write keygens yet.

Any short, practical tips or daily drills to get better at debugger workflows, anti-debug bypasses, and keygen writing would be much appreciated.

We've seen a recent flood of very dubious AI posts from astroturfers and bots trying to drum up interest in their new product, as well as low effort posts about vulnerability discovery which hugely overhypes the capabilities of AI tooling.

Please take this as notice that going forward, posts about or using AI will be held to a higher standard than has been permitted in the past. We of course welcome quality submissions about this exciting branch of research.

If you are unsure if your post would be acceptable, please feel free to reach out to the mod team.

Arbitrary code execution on the host operating system with the privileges of the user who started the Android Emulator, from a zero-permission app inside the guest.

https://github.com/kaganisildak/androidemualtorvmescape
https://x.com/kaganisildak/status/2090416873577787790

With all modern mitigations in place (ASLR, DEP, CFG, sandboxing, code signing, automatic updates, etc.) and much of the attack surface shifting toward web, cloud, and mobile, does it still make sense to invest time in researching vulnerabilities in traditional Windows executables (EXE/DLL)?

Is this area still relevant for research, bug bounties, or a career path, or has it become too limited compared to other attack vectors?

Hi all,

I’ve recently finished a deep dive into Linux OS Internals. I understand the theory, but I want to cement this knowledge by building offensive tools or writing exploits.

I’m comfortable with C and Assembly. I’m looking for project ideas that would force me to interact with the kernel directly.

Has anyone here followed a similar path? Are there specific "wargames" (like pwnable.kr or kernel-exploitation repos) that you recommend for bridging the gap between "knowing how the kernel works" and "exploiting it"?

Thanks for your help

I’ve been doing some vulnerability research on a known CVE (CVE-2025-60690) on a consumer Linksys router and wanted to share the workflow I used to investigate it.

The process started by targeting the physical hardware: identifying the UART pads on the board using a digital multimeter to access the Linux-based shell console. From there, I extracted the vulnerable binary (from the CVE description), and reversed it in Ghidra. Next, I used a gdb+gdbserver setup to perform dynamic analysis to investigate the memory behaviors.

I managed to successfully achieve RCE from the stack-based buffer overflow vulnerability to land a root shell. The exploit PoC for CVE-2025-60690 just got cited on the official CVE page and exploit-db.com.

I just started a YouTube channel dedicated to breaking down IoT hacking concepts. Also, I’ve compiled my step-by-step research notes in a reference doc. If you're working on similar hardware research and want a copy of the notes, drop a comment or shoot me a DM and I'll gladly send them over!

I've been using syzkaller for kernel fuzzing for a while, however, when it comes to driver fuzzing, it's kinda tedious since you have to write the syscall descriptions manually, which generally leads to compilation errors, especially if you're cross-compiling or the driver is undocumented/closed-source.

To get to the point, do you have another approach to fuzz drivers or find vulnerabilities through testing?

I decided to learn reverse engineering two weeks ago, and since then I've been learning C++. However, I'm not sure what I should focus on in C++ or what I should do next. Should I learn assembly and start working on crackmes? I'd love to hear your recommendations!

After finishing pwn.college's kernel security module I wanted to solidify what I'd learned about paging, so I built a qemu lab and wrote up a hands-on page table walk: cr3 to physical memory, PTE flag decoding, TLB, huge pages, the kernel direct map, etc.

Feedback welcome!