Técnicas de explotación

Guías de esta área

1. 01
   Hijacking Control Flow: the ret2win TechniqueInglés

   A complete lab walkthrough: build a vulnerable C program, find the offset to the saved return address, redirect execution with pwntools, then watch each mitigation break the exploit.

2. 02
   Building a ROP Chain Step by StepInglés

   With NX on, injected shellcode is dead — so we reuse the program's own code. A full lab walkthrough: find gadgets, hand-build an execve syscall chain with pwntools, then watch CET and CFI break it.

3. 03
   Returning into libc: the ret2libc TechniqueInglés

   NX is on and the binary is tiny, but libc is mapped and full of useful code. Leak its base past ASLR, then return straight into system("/bin/sh") — a full two-stage pwntools walkthrough.

4. 04
   Format-String Bugs: Arbitrary Read and WriteInglés

   One printf(user_input) is a full read/write primitive. Leak with %p, overwrite with %n via pwntools, then watch -Wformat=2 and FORTIFY_SOURCE shut it down.

5. 05
   Hijacking the GOT: Redirecting a libc CallInglés

   Lazy binding leaves the Global Offset Table writable. Aim an arbitrary write at a GOT entry, turn puts() into system(), then enable Full RELRO and watch the same write fault instantly.

6. 06
   Heap Exploitation: tcache and Use-After-FreeInglés

   The heap's own metadata is the write primitive. Build a use-after-free, poison the glibc tcache to allocate a chunk over a chosen address, and see why safe-linking and ASan raise the bar.

7. 07
   Information Leaks: Defeating ASLR and CanariesInglés

   Modern exploits are leak-then-act. Build an out-of-bounds read, then use it to recover a stack canary, the PIE base and the libc base — the three secrets every mitigation relies on.

8. 08
   SROP: Exploiting with a Fake Signal FrameInglés

   When gadgets are scarce, forge a signal frame. A sigreturn syscall restores every register from the stack at once — build one with pwntools to call execve, then see how seccomp and CET respond.

9. 09
   ret2csu: Borrowing the Runtime's Universal GadgetInglés

   No pop rdx gadget? The C runtime's startup code has a universal sequence that loads several registers and makes a controlled call. Build it with pwntools, and see where it's gone.

10. 10
    Stack Pivoting: Relocating the ROP ChainInglés

    When the overflow gives you only a few bytes past the return address, pivot the stack pointer into a buffer you fully control and run the real chain from there. A pwntools walkthrough.

11. 11
    File-Structure Attacks: Hijacking a FILE ObjectInglés

    When hooks are gone, the FILE object is the target. A stdio call dispatches through a vtable pointer in writable memory — corrupt it and the next fwrite runs your code.

12. 12
    ret2dlresolve: Resolving a Symbol Without a LeakInglés

    No libc leak, no problem: forge the relocation the dynamic linker reads and make it resolve and call system for you. A pwntools walkthrough — and why Full RELRO ends it.

13. 13
    one-gadget: One Address to a ShellInglés

    Sometimes you control just one pointer. A one-gadget is a single libc address that calls execve("/bin/sh") — if its register and stack constraints hold. Find one, check the constraints, and use it.

14. 14
    Seccomp Sandboxes and the open-read-write ChainInglés

    A seccomp policy that bans execve takes the shell off the table, so attackers switch goals: open the flag, read it, write it back. Build the ORW chain, and see what a tighter policy stops.

Las guías se publican primero en inglés. Las traducciones llegarán después.