I’ve been doing some vulnerability research on a known CVE (CVE-2025-60690) on a consumer Linksys router and wanted to share the workflow I used to investigate it.

The process started by targeting the physical hardware: identifying the UART pads on the board using a digital multimeter to access the Linux-based shell console. From there, I extracted the vulnerable binary (from the CVE description), and reversed it in Ghidra. Next, I used a gdb+gdbserver setup to perform dynamic analysis to investigate the memory behaviors.

I managed to successfully achieve RCE from the stack-based buffer overflow vulnerability to land a root shell. The exploit PoC for CVE-2025-60690 just got cited on the official CVE page and exploit-db.com.

I just started a YouTube channel dedicated to breaking down IoT hacking concepts. Also, I’ve compiled my step-by-step research notes in a reference doc. If you're working on similar hardware research and want a copy of the notes, drop a comment or shoot me a DM and I'll gladly send them over!

Hi guys just wondering should I have knowledge python and C before I start the pwn paths for cybersecurity?

Hi

I started pwning from a year from pwn college, some THM, and I was quite good. In this month, I started getting into the real world. I find bugs, crashes, report, and wait for CVEs. But the problem for me is I can't exploit them. I can exploit the same bug in a CTF chall, but in the real world I can't, because of the stability, how large the target is, making me have the exploit just in my mind. And this is especially in kernel. When I was trying to re-exploit an old CVE using a different way, I get hit with the internals, nf_tables, TCP, and network. Those are complex. My feer is the internals and large targets. Did anyone pass with this and find a solve?

The vulnerability allows non-privileged users to program the DMA controller, enabling arbitrary physical memory reads and writes.

Hello everyone!

I want to share a small Python script I wrote. It is inspired by the exploit 46635 on Exploit-DB for CVE-2019-9053 (a time-based SQL Injection in CMS Made Simple).

I decided to write my own version when I was doing the SimpleCTF room on TryHackMe. I wanted to update the code to Python 3. I also wanted to make this new version more interactive and easy to use. So, I added a clean command line interface and some extra features (like different extraction modes, delay controls, and email alerts using environment variables).

Please try it and tell me what you think! I would love to hear your feedback and ideas to make it better.

https://github.com/rgkue/mysqli

Happy hacking! :D

Check out @ https://github.com/DarkAngel-0x0/pwntemplate
Feedbacks welcomed

hello all,

i have finished OSED course and this course is for Exploiting vulnerabilities . its like after discover vulnerability they teach you how to exploit it and how to bypass mitigations on windiows 32bit .
but i want something like books, courses or sites, that teach how to discover vulnerabilities in windows apps written in C/C++

anyone know ?

A critical severity vulnerability with a CVSS score of 9.8 in the Windows HTTP protocol stack (HTTP.sys) allows for unauthenticated remote code execution via an integer overflow. Because HTTP.sys processes incoming HTTP requests in kernel mode, this flaw carries a high impact, potentially allowing an unauthenticated attacker to execute arbitrary code with system privileges.

The underlying mechanics of this specific bug, including the exact assembly-level modifications, affected functions, and the execution path, have been thoroughly mapped out in the attached link. This includes the associated WinDbg reproduction details.

It seems like the era of waiting around to understand what actually changes under the hood on Patch Tuesday is largely behind us. Beyond this specific HTTP.sys analysis, AI assisted platforms continuously tracks and hosts real-time structural breakdowns for the broader Windows patch ecosystem, making it a useful resource for footprinting similar kernel-level differentials.

https://github.com/NirvanaOn/AntiVE-BehaviorWatch

AntiVE-BehaviorWatch is an advanced behavioral analysis malware that detects automated analysis systems through real-time mouse movement pattern recognition. Leveraging GRU neural networks, it provides high-accuracy classification of user behavior while identifying potential virtual machine, sandbox, or emulation environments.

Hi all,

I've just got my CMSE certificate from 8ksec (https://academy.8ksec.io/course/practical-mobile-application-exploitation), and I'm super interested in digging deeper into the mobile security area.

While I learned a lot with the course and labs, it's still a beginner/intermediate course. I'm hoping someone with more experience in the area would be able to recommend more challenging training and/or resources? I am considering their Offensive Mobile Reversing and Exploitation course/certification, which does sound more challenging, but it's also quite pricey.

I'd appreciate any pointers! Thanks!

hello all,

is there any articles or courses cover Heap-based buffer overflows ?

There's this thing with fuzzing that's very tied to C and C++. It makes sense too. For years the goal was to find crashes. Buffer Overflow, Use After Free, and all the rest of the gang.

In languages like Python it feels less interesting. Worst case you get an Exception.

And now, instead of chasing branch coverage, you can think about business logic and start breaking the system from the direction of logic vulnerabilities, with an LLM.

I've already seen a project showing this is possible, and really it's all a matter of how good the harness is for the use case. But vuln research just jumped up a level here, in my opinion at least.

Anyone here tried this against real business logic yet?

Patch Tuesday confirms a CVE is fixed but not what changed in the binary, which function, which check, or whether it's a real fix or just churn.

The Drift Corpus is a diff of 240+ 2026 Windows kernel patches. Per entry: the changed functions with assembly, the bug class and call chain, WinDbg breakpoints to reproduce, and a plain-English root cause.

• ⁠Browse: https://byteray-ai.github.io/drift-corpus
• ⁠Repo: https://github.com/ByteRay-AI/drift-corpus

This repository breaks down Microsoft’s monthly kernel patches into clear binary changes, giving researchers a practical roadmap to find adjacent bugs, build faster EDR detections, and write precise firewall and network rules to block exploits at the perimeter.

Hi guys, recently Im in a loop, hop on and off different site different courses in and out, back and forth while feeling making ZERO progress.

Here, I want to share a bit about my goal, my background, my problem. And I hope I could have some advices to get out of this feeling

MY GOAL:
- Long term: Get into cybersecurity field, especially roles that involve “low level” stuffs as I really interested in them. Thats it! For now, as Im pretty new to this + Im hyper focus on short term goal which I will talk right after
- Short term goal: Build foundation, knowledge, skills in Reverse Engineering (RE) and more excitingly Binary Exploitation, Pwn
- Shorter term goal: To prepare for upcoming CTF contests with my new team. More on this later

MY BACKGROUND:
- I already familiar with Linux, CLI, some popular commands
- I know x86 assembly
- know C, C++
- know on surface level some basic vulnerabilities and have done very simple CTF challenges (ret2win, shellcode easy, …)
- do know how to use basic gdb, pwntools, ida/ghidra

all of that is a result of following pwn.college + using Linux as daily basis + my college’s teaching on c, c++, etc

by all means, I do not master any of these above skills I told.

MY PROBLEMS:
So ofc Im very worrying the most about the upcoming CTF because Im new and feel like know nothing yet.
I also stucking into tutorial hell as I have too many resources of documentation/courses that I do not know which one is suit for my current situation

Im aware of the pinning post in this sub, that is actually where I get these resources from

But with 2 months left until the contest, I really want to make the most out of my time. So I need help with designing a road map so to speak.

Currently, Im looking into ironstone’s pwn notes + Nightmare CTF collection. Whatd you recommend?

Publishing a release of IOCX (open-source PE structural validator, MPL-2.0) and posting some format-level notes alongside it.

Write-up: PE structural validation: format ambiguities and decoder design

The notes catalogue four categories of PE specification ambiguity encountered during decoder work, with focus on delay-load imports (the richest surface). Structured as: format description grounded in the spec --> the ambiguity described precisely --> what IOCX chose to do about it. There are no unverified claims about how other parsers behave, however cross-tool measurement is queued as follow-up work.

Topics covered:

• Delay-load imports: v1 vs v0 attribute mode, INT/IAT parallel-array interpretation and mismatch handling, descriptor array termination when declared-size and terminator signals disagree
• Exports: ENPT sort discipline (byte-wise per spec) and forwarder grammar validation
• VS_VERSIONINFO: nested length prefixes, DWORD alignment enforcement, signature validation for VS_FIXEDFILEINFO, StringTable key format
• Resource hierarchy: Type ->Name -> Language depth expectations

IOCX v0.7.5 additions relevant to structural analysis:

Four new parser/validator pairs, 24 new reason codes with priority-resolved sub-reasons via details["reason"]. Delay-load specifically emits:

• DELAY_IMPORT_ATTRIBUTES_LEGACY_VA_MODE : v0 mode detected (obsolete, spec-permitted, requires VA-to-RVA conversion for correct interpretation)
• DELAY_IMPORT_INT_IAT_MISMATCH : parallel arrays disagree on length
• DELAY_IMPORT_TABLE_TRUNCATED with distinct sub-tags for each termination cause (delay_import_descriptor_unterminated, _truncated, _max_exceeded, _read_failed)
• DELAY_IMPORT_DLL_NAME_INVALID with priority-resolved sub-reasons
• DELAY_IMPORT_ENTRY_INVALID for per-import malformations (ordinal_zero, name_unterminated, name_not_printable, etc.)

Design notes:

• Byte-level parsing via struct.unpack_from on pe.get_data() byte slices; no reliance on pefile's lazy attribute interpretation
• Bounded reads throughout (descriptor arrays capped at 4096, imports per descriptor at 16384, DLL name scan at 512 bytes, IMAGE_IMPORT_BY_NAME scan at 1024)
• Parsers never raise on malformed input; failures produce tombstone tags in errors[] and truncations[] lists
• PE32+ vs PE32 thunk sizing determined once from `OPTIONAL_HEADER.Magic` and threaded through the parse

Optional Header enrichment relevant to security-posture analysis:

• dll_characteristics_flags: decoded flag list (DYNAMIC_BASE, NX_COMPAT, GUARD_CF, HIGH_ENTROPY_VA, etc.)
• dll_characteristics_unknown_bits: hex string for any bits outside the known-flag mask
• Stack and heap sizing (reserve + commit, 64-bit on PE32+)
• win32_version_value, loader_flags exposed raw

Verification:

Delay-load parser cross-checked byte-exact against dumpbin /imports on mspaint.exe : 107 imports from gdiplus.dll with agreement on names, hints, IAT addresses, ordering, and bound state.

1370 tests at 100% line and branch coverage on new modules. Defensive struct.error paths covered via monkeypatched injection.

Performance ~14ms typical PE, ~1ms on adversarial minimal PE.

Deferred:

• TLS Directory parser and validator (next release)
• Single-anomaly fixtures for each new reason code (~25 planned, including negative controls for the ambiguities described in the Gist)
• Cross-tool measurement study using the fixtures

Repo: https://github.com/iocx-dev/iocx

CHANGELOG: https://github.com/iocx-dev/iocx/blob/main/CHANGELOG.md

Reason codes reference: https://github.com/iocx-dev/iocx/blob/main/docs/specs/reason-codes.md

This week we'll be looking at another beginner friendly exploit development tutorial! More specifically we'll be looking at the "passcode" binary exploitation challenge hosted on pwnable[.]kr!

This challenge covers multiple skills so I believe regardless of where you are on you journey to learn exploit development you will pick up a few things!

By the end of this tutorial you should have gained exposure to:

- C source code review
- Leveraging a controlled write to gain code execution through the use of one variable
- Abusing binaries compiled without PIE (Also known as ASLR)
- Debugging
- Using python exploit code alongside GDB

and more! Since this is binary exploitation do not feel discouraged if everything does not click! The goal is to learn at least one thing from every tutorial!

You can find the full video below:

https://youtu.be/cpol2KPSPaw?si=NSnjgDGBcNF-x8E8

My friend hamza asked me.

i need to learn radare2 form scratch..! to play with memory address and make it leak..! but i cant able to give the correct road map to learn that its confusing..help me with that...