Posts by Tag

• pwn 7
• heap 6
• downunderctf 4
• tcache 3
• dicectf 2
• glibc-2.32 1
• safelinking 1
• tcache_perthread_struct 1
• misc 1
• discord 1
• mongodb 1
• osint 1
• image 1
• rust 1
• uaf 1
• initialization 1
• doublefree 1
• glibc-2.27 1
• rop 1
• ret2dl 1
• ret2csu 1
• volgactf 1
• unsortedbin 1
• easy 1
• google 1
• googlectf 1
• bufferoverflow 1
• stack 1
• bof 1
• compression 1

pwn

GoogleCTF 21 - Compression

9 minute read

A fun multi-stage buffer overflow exploit in a compression algorithm

Volga Qualifiers 21 - penny wise

8 minute read

Exploiting an ‘off by one’ in a small string optimization struct

DiceCTF 2021 - babyrop (ret2csu, ret2dl)

8 minute read

Learning about two advanced ROP techniques

DiceCTF 2021 - flippidy

5 minute read

Exploiting a tcache double free in glibc 2.27

DownUnderCTF 2020 - VECC

3 minute read

Exploiting uninitialized struct members

DownUnderCTF 2020 - Zombie

2 minute read

Exploiting a soundness bug in Rust

PoseidonCTF 2020 - Cards

6 minute read

Dealing with glibc 2.32’s new safety measure, safelinking

Back to Top ↑

heap

Volga Qualifiers 21 - penny wise

8 minute read

Exploiting an ‘off by one’ in a small string optimization struct

DiceCTF 2021 - babyrop (ret2csu, ret2dl)

8 minute read

Learning about two advanced ROP techniques

DiceCTF 2021 - flippidy

5 minute read

Exploiting a tcache double free in glibc 2.27

DownUnderCTF 2020 - VECC

3 minute read

Exploiting uninitialized struct members

DownUnderCTF 2020 - Zombie

2 minute read

Exploiting a soundness bug in Rust

PoseidonCTF 2020 - Cards

6 minute read

Dealing with glibc 2.32’s new safety measure, safelinking

Back to Top ↑

downunderctf

DownUnderCTF 2020 - VECC

3 minute read

Exploiting uninitialized struct members

DownUnderCTF 2020 - Zombie

2 minute read

Exploiting a soundness bug in Rust

DownUnderCTF 2020 - Off the Rails 2

1 minute read

Finding the train station from an image

DownUnderCTF 2020 - Disconfigured

4 minute read

Exploiting a bad privilege configuration in a Discord bot

Back to Top ↑

tcache

Volga Qualifiers 21 - penny wise

8 minute read

Exploiting an ‘off by one’ in a small string optimization struct

DiceCTF 2021 - flippidy

5 minute read

Exploiting a tcache double free in glibc 2.27

PoseidonCTF 2020 - Cards

6 minute read

Dealing with glibc 2.32’s new safety measure, safelinking

Back to Top ↑

dicectf

DiceCTF 2021 - babyrop (ret2csu, ret2dl)

8 minute read

Learning about two advanced ROP techniques

DiceCTF 2021 - flippidy

5 minute read

Exploiting a tcache double free in glibc 2.27

Back to Top ↑

glibc-2.32

PoseidonCTF 2020 - Cards

6 minute read

Dealing with glibc 2.32’s new safety measure, safelinking

Back to Top ↑

safelinking

PoseidonCTF 2020 - Cards

6 minute read

Dealing with glibc 2.32’s new safety measure, safelinking

Back to Top ↑

tcache_perthread_struct

PoseidonCTF 2020 - Cards

6 minute read

Dealing with glibc 2.32’s new safety measure, safelinking

Back to Top ↑

misc

DownUnderCTF 2020 - Disconfigured

4 minute read

Exploiting a bad privilege configuration in a Discord bot

Back to Top ↑

discord

DownUnderCTF 2020 - Disconfigured

4 minute read

Exploiting a bad privilege configuration in a Discord bot

Back to Top ↑

mongodb

DownUnderCTF 2020 - Disconfigured

4 minute read

Exploiting a bad privilege configuration in a Discord bot

Back to Top ↑

osint

DownUnderCTF 2020 - Off the Rails 2

1 minute read

Finding the train station from an image

Back to Top ↑

image

DownUnderCTF 2020 - Off the Rails 2

1 minute read

Finding the train station from an image

Back to Top ↑

rust

DownUnderCTF 2020 - Zombie

2 minute read

Exploiting a soundness bug in Rust

Back to Top ↑

uaf

DownUnderCTF 2020 - Zombie

2 minute read

Exploiting a soundness bug in Rust

Back to Top ↑

initialization

DownUnderCTF 2020 - VECC

3 minute read

Exploiting uninitialized struct members

Back to Top ↑

doublefree

DiceCTF 2021 - flippidy

5 minute read

Exploiting a tcache double free in glibc 2.27

Back to Top ↑

glibc-2.27

DiceCTF 2021 - flippidy

5 minute read

Exploiting a tcache double free in glibc 2.27

Back to Top ↑

rop

DiceCTF 2021 - babyrop (ret2csu, ret2dl)

8 minute read

Learning about two advanced ROP techniques

Back to Top ↑

ret2dl

DiceCTF 2021 - babyrop (ret2csu, ret2dl)

8 minute read

Learning about two advanced ROP techniques

Back to Top ↑

ret2csu

DiceCTF 2021 - babyrop (ret2csu, ret2dl)

8 minute read

Learning about two advanced ROP techniques

Back to Top ↑

volgactf

Volga Qualifiers 21 - penny wise

8 minute read

Exploiting an ‘off by one’ in a small string optimization struct

Back to Top ↑

unsortedbin

Volga Qualifiers 21 - penny wise

8 minute read

Exploiting an ‘off by one’ in a small string optimization struct

Back to Top ↑

easy

Volga Qualifiers 21 - penny wise

8 minute read

Exploiting an ‘off by one’ in a small string optimization struct

Back to Top ↑

google

GoogleCTF 21 - Compression

9 minute read

A fun multi-stage buffer overflow exploit in a compression algorithm

Back to Top ↑

googlectf

GoogleCTF 21 - Compression

9 minute read

A fun multi-stage buffer overflow exploit in a compression algorithm

Back to Top ↑

bufferoverflow

GoogleCTF 21 - Compression

9 minute read

A fun multi-stage buffer overflow exploit in a compression algorithm

Back to Top ↑

stack

GoogleCTF 21 - Compression

9 minute read

A fun multi-stage buffer overflow exploit in a compression algorithm

Back to Top ↑

bof

GoogleCTF 21 - Compression

9 minute read

A fun multi-stage buffer overflow exploit in a compression algorithm

Back to Top ↑

compression

GoogleCTF 21 - Compression

9 minute read

A fun multi-stage buffer overflow exploit in a compression algorithm

Back to Top ↑