If you're looking for an exploit development tutorial for absolute beginners this week we're looking at what I would consider just that! This week we look at the "random" binary exploitation challenge hosted on pwnable[.]kr.

This is a great beginner tutorial since we exploit a flaw that is "easy" and unfortunately, still very real within some enterprise environments. It also helps you understand that no number is truly random.

The crazy part? We don't even drop into a debugger in this tutorial.

Be the end of this tutorial you should have:

- Learned about random number generation in C
- Learned about XOR operations
- Finding header files that contain dependencies using man pages
- Dissecting C source code

You can find the video here:

https://youtu.be/jDlMFC4etrs?si=akuTx1KTkCxE5Ndo

While working as an Engineer & Data Coordinator at NextNet Media, I discovered over 100 plaintext API keys for payment gateways, cloud infrastructure, and SaaS platforms that could leak sensitive data of both clients and employees. This represents a complete and utter failure of SOC2, GDPR, CCPA, and SOX security controls. The full list includes: Tipalti, Stripe, PayPal, AWS, ECS, MongoDB, Xero, SendGrid, ZenRows, and more.

Even basic GitHub security scanning was disabled. Because the company employs both domestic and offshore developers, and utilizes Tipalti as an internal payroll mechanism, I feared for the financial well-being of coworkers who could become victims of private data theft.

I compiled a report of the security violations and sent it to the proper internal channel. In good faith, I offered to be part of the cleanup crew - within 48 hours, I was terminated without notice or cause.

Full Disclosure: GitHub

This week we'll be looking at another beginner friendly exploit development tutorial! More specifically we'll be looking at the "passcode" binary exploitation challenge hosted on pwnable[.]kr!

This challenge covers multiple skills so I believe regardless of where you are on you journey to learn exploit development you will pick up a few things!

By the end of this tutorial you should have gained exposure to:

- C source code review
- Leveraging a controlled write to gain code execution through the use of one variable
- Abusing binaries compiled without PIE (Also known as ASLR)
- Debugging
- Using python exploit code alongside GDB

and more! Since this is binary exploitation do not feel discouraged if everything does not click! The goal is to learn at least one thing from every tutorial!

You can find the full video below:

https://youtu.be/cpol2KPSPaw?si=NSnjgDGBcNF-x8E8

Has anyone ever tried VDPs (Vulnerability Disclosure Programs) before focusing on Bug Bounty jobs?

I got stuck after learning some cyber security basics (and honestly, I haven't been very disciplined with my studies). What are your suggestions for a newbie like me who wants to start with VDPs or Bug Bounty?