# Exploit Dev/Buffer Overflow

* [Justin Steven - dostackbufferoverflowgood](https://github.com/justinsteven/dostackbufferoverflowgood)
* [The Cyber Mentor - Buffer Overflows Made Easy](https://www.youtube.com/playlist?list=PLLKT\_\_MCUeix3O0DPbmuaRuR\_4Hxo4m3G)
* [Brainpan: 1 - superkojiman](https://www.vulnhub.com/entry/brainpan-1,51/)

## **Guides**

* [https://kalitut.com/exploit-development-resources/](https://kalitut.com/exploit-development-resources/)
* [https://github.com/johnjhacking/Buffer-Overflow-Guide](https://github.com/johnjhacking/Buffer-Overflow-Guide)
* [https://www.corelan.be/index.php/2009/07/19/exploit-writing-tutorial-part-1-stack-based-overflows/](https://www.corelan.be/index.php/2009/07/19/exploit-writing-tutorial-part-1-stack-based-overflows/)
* [https://www.corelan.be/index.php/2009/07/23/writing-buffer-overflow-exploits-a-quick-and-basic-tutorial-part-2/](https://www.corelan.be/index.php/2009/07/23/writing-buffer-overflow-exploits-a-quick-and-basic-tutorial-part-2/)
* [https://www.sans.org/reading-room/whitepapers/threats/buffer-overflows-dummies-481](https://www.sans.org/reading-room/whitepapers/threats/buffer-overflows-dummies-481)
* [https://www.vortex.id.au/2017/05/pwkoscp-stack-buffer-overflow-practice/](https://www.vortex.id.au/2017/05/pwkoscp-stack-buffer-overflow-practice/)
* [https://www-inst.eecs.berkeley.edu//\~cs161/fa08/papers/stack\_smashing.pdf](https://www-inst.eecs.berkeley.edu/\~cs161/fa08/papers/stack\_smashing.pdf)
* [https://samsclass.info/127/proj/lbuf1.htm](https://samsclass.info/127/proj/lbuf1.htm)
* [https://github.com/D4mianWayne/PwnLand](https://github.com/D4mianWayne/PwnLand)
* [https://github.com/johnjhacking/Buffer-Overflow-Guide](https://github.com/johnjhacking/Buffer-Overflow-Guide)
* [https://tc.gts3.org/cs6265/2019/tut/tut01-warmup1.html](https://tc.gts3.org/cs6265/2019/tut/tut01-warmup1.html)
* [https://www.reddit.com/r/ExploitDev/comments/7zdrzc/exploit\_development\_learning\_roadmap/](https://www.reddit.com/r/ExploitDev/comments/7zdrzc/exploit\_development\_learning\_roadmap/)
* [https://github.com/ashemery/exploitation-course](https://github.com/ashemery/exploitation-course)
* [https://pwn.college/modules/intro](https://pwn.college/modules/intro)
* [https://www.hackingarticles.in/a-beginners-guide-to-buffer-overflow/](https://www.hackingarticles.in/a-beginners-guide-to-buffer-overflow/)
* [https://breaking-bits.gitbook.io/breaking-bits/exploit-development/linux-kernel-exploit-development](https://breaking-bits.gitbook.io/breaking-bits/exploit-development/linux-kernel-exploit-development)
* _Penetration Testing: Stack based Buffer Overflow in Linux - pg. 361_
* _Penetration Testing: Stack based Buffer Overflow in Windows- pg. 379_
* _Penetration Testing: Structured Exception Handler Overwrites- pg. 401_

## Reference

* [https://owasp.org/www-community/attacks/Buffer\_overflow\_attack](https://owasp.org/www-community/attacks/Buffer\_overflow\_attack)
* [https://owasp.org/www-community/attacks/Buffer\_Overflow\_via\_Environment\_Variables](https://owasp.org/www-community/attacks/Buffer\_Overflow\_via\_Environment\_Variables)
* [https://github.com/m0chan/h4cks/tree/master/Buffer%20Overflow%20Stuff](https://github.com/m0chan/h4cks/tree/master/Buffer%20Overflow%20Stuff)
* _Attacking Network Protocols: Memory Corruption Vulnerabilities - pg. 210_

## **Training Platforms/Tools**

### Linux Userland Exploitation

Stack

* [pwn.college](https://pwn.college)
* [Rop Emporium](https://ropemporium.com/)
* [Nightmare](https://guyinatuxedo.github.io/)
* [CTF-Wiki](https://ctf-wiki.org/pwn/readme/)
* [Ret2 Systems](https://wargames.ret2.systems/) (paid)
* [Ironstone](https://ir0nstone.gitbook.io/notes)
* [PWN Practice](https://github.com/seal9055/PWN\_Zero2Hero) (mine)

Heap

* [azeria](https://azeria-labs.com/heap-exploitation-part-1-understanding-the-glibc-heap-implementation/)
* [Heaplab Udemy](https://www.udemy.com/course/linux-heap-exploitation-part-1/) (paid)
* [Shellphish How2Heap](https://github.com/shellphish/how2heap)
* [Starcross](https://github.com/StarCross-Tech/heap\_exploit\_2.31)
* [Faith](https://faraz.faith/2019-10-12-picoctf-2019-heap-challs/)
* [Dhavalkapil](https://heap-exploitation.dhavalkapil.com/)

### **L**inux Kernel Exploitation

Kernel basics/dev

* [Linux Device Drivers](https://lwn.net/Kernel/LDD3/)
* [Linux Kernel Labs](https://linux-kernel-labs.github.io/refs/heads/master/)
* [Understanding the Linux Kernel](https://www.amazon.com/Understanding-Linux-Kernel-Third-Daniel/dp/0596005652)
* [Linux Kernel Programming P1](https://www.amazon.com/Linux-Kernel-Development-Cookbook-programming/dp/178995343X)
* [Linux Kernel Programming P2](https://www.amazon.com/Linux-Kernel-Programming-Part-Synchronization-ebook/dp/B08ZSV58G8)

Exploitation

* [lkmidas](https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/)
* [Kernel ROP](https://seal9055.com/blog/kernel/return\_oriented\_programming) (mine)
* [ptr-yudai](https://ptr-yudai.hatenablog.com/entry/2020/03/16/165628#LeakAARAAWRIP%E5%88%B6%E5%BE%A1%E3%81%AB%E4%BD%BF%E3%81%88%E3%82%8B%E6%A7%8B%E9%80%A0%E4%BD%93%E4%B8%80%E8%A6%A7)
* [Lexfo](https://blog.lexfo.fr/cve-2017-11176-linux-kernel-exploitation-part1.html)
* [Kernel Heap Exploitation](https://argp.github.io/2012/01/03/linux-kernel-heap-exploitation/)
* [Pr0cf5](https://pr0cf5.github.io/ctf/2019/10/10/balsn-ctf-krazynote.html)

### Windows Userland Exploitation

* [Windows Internals](https://www.amazon.com/Windows-Internals-Part-architecture-management/dp/0735684189)
* [Corelan](https://www.corelan.be/index.php/articles/)
* [Fuzzysecurity](https://www.fuzzysecurity.com/tutorials.html)
* [OSED Prep](https://github.com/r0r0x-xx/OSED-Pre#DEP-Bypass)
* [Epi052](https://epi052.gitlab.io/notes-to-self/blog/)

### Browser Exploitation

* [seal9055\_Complete Introduction](https://seal9055.com/blog/browser/browser\_architecture) (mine)
* [Official V8 Blog](https://v8.dev/blog)
* [pwnbykenny V8 Objects](https://pwnbykenny.com/2020/07/05/v8-objects-and-their-structures/)
* [Jayconrod V8 Objects](https://www.jayconrod.com/posts/52/a-tour-of-v8--object-representation)
* [Doar](https://doar-e.github.io/blog/2019/01/28/introduction-to-turbofan/)
* [Saelo Phrack](http://www.phrack.org/issues/70/9.html)
* [Faith](https://faraz.faith/2019-12-13-starctf-oob-v8-indepth/)
* [MGP25](https://mgp25.com/browser-exploitation/)
* [Ret2](https://blog.ret2.io/2018/06/05/pwn2own-2018-exploit-development/)
* [Google Project Zero](https://googleprojectzero.blogspot.com/2020/09/jitsploitation-one.html)

### Embedded Security

* [Embedded Intro Videos](https://www.youtube.com/watch?v=LSQf3iuluYo\&list=PLoFdAHrZtKkhcd9k8ZcR4th8Q8PNOx7iU)
* [&>/dev/null](https://www.thirtythreeforty.net/posts/)
* [Debugmen Enabot](https://debugmen.dev/hardware-series/2022/02/18/enabot\_series\_part\_1.html)
* [Embedded Bits](https://embeddedbits.org/introduction-embedded-linux-security-part-1/)
* [Sans Whitepaper Router Hack](https://www.sans.org/reading-room/whitepapers/testing/paper/34022)
* [Grimm](https://blog.grimm-co.com/)
* [Car Hacking Paper](http://www.autosec.org/pubs/cars-oakland2010.pdf)
* [Flashback Team](https://www.youtube.com/channel/UCBrKPoIYCS7BlT7Q\_UiBwAQ)
* [Printer Hacking Stream](https://www.youtube.com/watch?v=qti5\_NOLE8M\&list=PLSkhUfcCXvqGGQN8ATgWI0XYGvU-jq0uG)
* [Hardware Hacking Handbook](https://nostarch.com/hardwarehacking)

## **Training Videos**

* [https://www.youtube.com/watch?v=1S0aBV-Waeo](https://www.youtube.com/watch?v=1S0aBV-Waeo)
* [http://www.securitytube.net/groups?operation=view\&groupId=5](http://www.securitytube.net/groups?operation=view\&groupId=5)
* [http://www.securitytube.net/groups?operation=view\&groupId=4](http://www.securitytube.net/groups?operation=view\&groupId=4)
* [http://www.securitytube.net/groups?operation=view\&groupId=7](http://www.securitytube.net/groups?operation=view\&groupId=7)
* [https://www.youtube.com/playlist?list=PLLKT\_\_MCUeix3O0DPbmuaRuR\_4Hxo4m3G](https://www.youtube.com/playlist?list=PLLKT\_\_MCUeix3O0DPbmuaRuR\_4Hxo4m3G)

## **Examples**

* [https://www.exploit-db.com/exploits/636](https://www.exploit-db.com/exploits/636)
* [https://www.exploit-db.com/exploits/10434](https://www.exploit-db.com/exploits/10434)
* [https://www.exploit-db.com/exploits/40673](https://www.exploit-db.com/exploits/40673)
* [https://www.exploit-db.com/exploits/39480](https://www.exploit-db.com/exploits/39480)

## **Tools**

* [Frida](https://github.com/frida) - Inject arbitrary code into other applications!
  *  [Frida • A world-class dynamic instrumentation framework | Inject JavaScript to explore native apps on Windows, macOS, GNU/Linux, iOS, Android, and QNX](https://frida.re/) 
  * [Awesome Lists Collection: Frida](https://github.com/dweinstein/awesome-frida)
  * _Operator Handbook: Frida - pg.67_
* [buffer-overflow](https://github.com/the-c0d3r/buffer-overflow) - This tool is created in order to allow penetration testers / researchers to quickly test out simple buffer overflows, without having to write a line of code.
* [peda](https://github.com/longld/peda) - PEDA - Python Exploit Development Assistance for GDB
* [pwntools](https://github.com/Gallopsled/pwntools) - Pwntools is a CTF framework and exploit development library. Written in Python, it is designed for rapid prototyping and development, and intended to make exploit writing as simple as possible.
* [gef](https://github.com/hugsy/gef) - A set of commands for x86/64, ARM, MIPS, PowerPC and SPARC to assist exploit developers and reverse-engineers when using old school GDB.
* [pwndbg](https://github.com/pwndbg/pwndbg) - Exploit Development and Reverse Engineering with GDB Made Easy
* [bed](https://www.kali.org/tools/bed/) - BED is a program which is designed to check daemons for potential buffer overflows, format strings et. al.
  * [doona](https://www.kali.org/tools/doona/) - Doona is a fork of the Bruteforce Exploit Detector Tool (BED).
* Immunity Debugger: [https://www.immunityinc.com/products/debugger/](https://www.immunityinc.com/products/debugger/)
* Vulnserver: [http://www.thegreycorner.com/p/vulnserver.html](http://www.thegreycorner.com/p/vulnserver.html)
* Bad Chars: [https://www.ins1gn1a.com/identifying-bad-characters/](https://www.ins1gn1a.com/identifying-bad-characters/)
* [https://github.com/fkie-cad/cwe\_checker](https://github.com/fkie-cad/cwe\_checker) - cwe\_checker finds vulnerable patterns in binary executables