Exploit Development
Hands-on exploit development, foundational to advanced — stack overflows, SEH, ROP, shellcoding, and modern mitigations, each built and broken in the lab. Follow it top to bottom — foundational first (22 tutorials).
Exploit DevelopmentShellcode Encoders: XOR Encoding, Custom Decoders, and Avoiding Bad CharsControl EIP but your shellcode dies in transit? This tutorial covers XOR encoding, custom x86 decoder stubs using JMP-CALL-POP, per-chunk keying, and…Read →Exploit DevelopmentEgghunters: Staged Payload Delivery When Buffer Space Is TightWhen your overflow buffer is too small for real shellcode, an egghunter scans process memory for your tagged payload and jumps to…Read →Exploit DevelopmentStructured Exception Handler (SEH) Internals on WindowsTear apart Windows x86 Structured Exception Handler internals - from EXCEPTION_REGISTRATION_RECORD chain layout to a working POP/POP/RET exploit - then see exactly…Read →Exploit DevelopmentSEH Overwrite Exploits: Hijacking Exception DispatchLearn how SEH overwrite exploits corrupt the on-stack exception registration record and use POP/POP/RET gadgets to hijack Windows exception dispatch - with…Read →Exploit DevelopmentFormat String Vulnerabilities: Read/Write Primitives via printf InternalsA user-controlled printf format string is a complete read/write primitive. This tutorial covers stack leaking, %n-based GOT overwrites, pwntools fmtstr_payload, and blue-team…Read →Exploit DevelopmentInteger Overflows and Off-by-One Errors: Turning Arithmetic Bugs into Memory CorruptionA single wrapped multiplication or a fence-post loop error can corrupt heap metadata or pivot a stack frame into shellcode. This tutorial…Read →Exploit DevelopmentStack Canaries and GS Cookies: How They Work and When They FailUnderstand how GCC stack canaries and MSVC /GS cookies protect against stack overflows - then reproduce three practical bypass techniques against a…Read →Exploit DevelopmentData Execution Prevention (DEP/NX): Mechanism, Enforcement, and Bypass MotivationDEP/NX kills classic shellcode injection by marking data pages non-executable at the hardware level. Learn how Windows enforces DEP system-wide and per-process,…Read →Exploit DevelopmentReturn-Oriented Programming (ROP): Gadgets, Chains, and the ROP MindsetLearn Return-Oriented Programming from the ground up: how ROP gadgets and chains bypass DEP/NX, how to build a ret2libc exploit against a…Read →Exploit Developmentret2libc and ret2plt: Leveraging Existing Code Without ShellcodeNX killed shellcode - ret2libc and ret2plt bring it back via code reuse. This tutorial builds a GOT-based libc leak chain defeating…Read →