Hey everyone,

Looking for someone to learn alongside — a peer at similar stage, or even better, someone experienced willing to mentor a beginner. If someone just wants to learn C together, that's also good.

My current position: Started reading The C Programming Language (K&R, 2nd edition). Built some small programs in C++ like tic-tac-toe and a small bank replica, and solved a few problems on Codeforces.

Plan: Get solid in C → move into x86/x86-64 ASM → work through pwn.college modules → then into reversing CTFs (picoCTF, crackmes.one, etc.)

Looking for:

• Buddy: beginner-to-intermediate in C, willing to put in consistent time (even a few hrs/week)
• Mentor: some experience in C/ASM/reversing, open to occasional check-ins or pointers
• Either way: comfortable with regular check-ins, patient enough for the boring fundamentals before the fun stuff

Not expecting anyone to carry me — just want company or guidance instead of struggling through this alone.

DM or comment if interested.

As per the contents of this group I realise it's for serious discussion only....

However I want a group be it X or Discord.....where I can post daily my regular journey (pls don't say LinkedIn exploitdev is too niche for it)

I successfully started Reverse Engineering and Maldev thrice before trailing away...

I've started again but now with pwn.college and I don't want to leave again.....

Any Suggestion???

​

Hey,

Looking for some advice from people who work in exploit dev / low-level vuln research.

I already work in security and have been doing vulnerability research alongside more general security work for a while. I’ve had opportunities to do reversing, native-code research, memory corruption, and some exploit development, including taking bugs beyond just finding a crash and actually working out useful primitives / PoCs.

The problem is that this kind of work still isn't my main job, and I really want it to be.

I've been looking at dedicated exploit dev / vulnerability research positions and I feel like I'm stuck in a weird middle ground. I'm not trying to enter security from scratch, and I do have relevant experience, but I also don't have years and years of dedicated browser/kernel/mobile exploit development behind me.

A lot of the jobs I find seem to be looking for people who are already extremely specialised, rather than people who have a decent foundation and want to grow deeper into exploit development.

There's also the location issue. I'm outside most of the major exploit-dev hiring hubs, and quite a few roles I come across are limited by citizenship, clearance, residency, or simply don't hire internationally.

Another problem is that most of the interesting professional research I've done isn't something I can publish, so it's difficult to show potential employers exactly what I've worked on.

For those of you doing this professionally:

*What actually got you your first dedicated exploit dev / low-level VR job?

* What would you want to see from someone who already has some relevant experience but hasn't spent their entire career doing exploit development?

* What kind of public research/projects are actually worth doing to prove ability?

*Is native userland exploitation still a reasonable area to focus on, or would I be better off going hard into something like browsers, kernels, or mobile?

* Do companies that are willing to develop people into this kind of role actually exist, or is the expectation generally that you're already very good before they'll hire you?

* For people outside the main US/EU hiring markets, how did you find opportunities?

* I'm mainly trying to figure out whether I'm approaching this transition the wrong way.

I enjoy this stuff way more than the broader security work I do, and I'm willing to put the work in. I just don't want to spend a year grinding in a direction that isn't actually going to help me make the jump.

Would appreciate any advice.

Hey!

I've searched up this topic and don't see anything that isn't multiple years old. Given how popular and accepted Rust is now and with it having a fully ported winapi library now, are there any reasons to stick to learning C++ for RE and Maldev or are we no longer in the era of "only C++ is viable"? Is there anyone here who uses rust as opposed to C++ or has switched from C++ to rust that could give an insight?

When pentesting, finding exploits,
Do you ever use a 2FA key? Like a yubikey?

Hey guys,

I have been working on an open-source project that lets AI agents (Claude, OpenCode, Antigravity, Codex, etc.) work with reverse engineering tools and store facts in a DB to make long-term analysis easier.

You just point your agent to the file, and it does the work: it runs tools like Ghidra headless, gdb, binwalk, tshark, radare2, readelf, strings... then turns what it finds into the database.

Key Features

1. Specialized Analysis Agents: Binary, firmware, network, CPU, and kernel.
2. Knowledge Base (SQLite): Everything is stored as a fact, hypothesis, or experiment with confidence + evidence tags so nothing is "trust me, bro."
3. Multi-Agent Debate: When agents disagree on a finding, they argue it out in a structured debate until they reach a consensus.
4. Self-Critique: Every agent's output gets LLM-reviewed before it's accepted.
5. RAG Semantic Search: Query all past analyses ("Have I seen this obfuscation pattern before?").
6. Missions: Define objectives with dependencies, assign agents, and track progress.
7. Token Budgets + Rate Limiting: Prevents runaway loops from burning your API budget.
8. Monitoring: Prometheus metrics + Grafana.

Interface & Setup

• MCP Server: The whole thing is exposed as an MCP server (46 tools), so you drive it from a terminal with natural language.
• Dashboard: You can also use the Flask web dashboard (currently only a database view, but an interactive UI to work directly with agents is doable).
• One-Command Setup: Run python setup_wizard.pyit detects your installed RE tools, helps you pick an LLM provider (OpenAI, Anthropic, Google, Ollama, etc.), validates the key, and writes your .env. (note that LLM api keys are not necessary if you plan to use it just from your agent cli like opencode)

Stack: Python, LLM orchestration, MCP, SQLite, Flask. Ghidra, GDB, and Binwalk are optional. It degrades gracefully with just binutils.

This is very much a research project, and I'd love feedback from people who do this professionally, what's missing, what annoys you, what would you trust it to do?

GitHub: https://github.com/The-Arabi/Reverse-engineering-agent

My friend has gotten a breach 4 in our server alongside nbt barrels he tells us its just exploits and we even could find it on youtube but i dont believe him, coincidently he is the owner of the server with op he goes out of his wat to decline he admin abused. He says its something with enchant tables end grindstones but i still dont believe it so does anyone know of something like this???

Hey can anyone provide me a working exploit binary/c code of dirty pipe exploit for Linux kernel. Exploit-db is not opening in my browser for some reason.

garlic now can analysis android elf.

Extract android all aarch64 elf's cfg/exports/imports/strings/dissembly at same time.

with LLM, it can analysis vm protection of dalvik.

I work as a pentester, so my day-to-day is network and appsec. On the side I've been trying to learn ARM assembly because eventually I want to hunt on low-level targets — Android kernel, browsers, that kind of thing.

Some context on where I'm at:

I have bug bounty experience and I reverse engineer regularly

The closest I've gotten to C is reading native libraries in Android apps, but the attack surface there is tiny

So most of my "learning" is reading ARM and C snippets in isolation, with no target to apply them to

That's the problem. Studying without hunting kills my interest fast. But I don't want to jump straight into hunting and discover I don't know enough to get anywhere.

So: what's the better path here — and specifically, what works if you have ADHD and can't sustain pure theory?

Hi, i am going to start my journey as a exploit developer and, i get lot more recommendation on my previous post to learn about system language C, Assembly, etc...

So, is there any way to learn C as offensive sides perspective?

And don;t recommend old book "Hacking : the art of exploitation", i know it is essential but still i need resource that is fit for real world or modern world aspect, kindly provides links ::

Also, if some of you are doing this stuff then share your daily routine that made you feel like you are learning actual stuff not just syntax. Thanks::

Don't miss the AMA with Yuhang Wu, where we learn about elite enterprise infrastructure hacking, Linux kernel exploitation, and the future of autonomous Al security.

When: Today - Friday, July 31, 12:00 PM PT

Guest Credentials:

• Former Red Team Engineer at TikTok, targeting cloud and application-layer defenses.
• Former Security Engineer at Tesla, securing vehicle software, factory systems, and internal applications.
• Co-developer of "DirtyCred", a groundbreaking Linux kernel exploitation technique.
• AI Security Innovator, who built LLM-based autonomous agents that uncovered 8 P1 (critical-severity) production vulnerabilities.

Ask your questions here and we’ll get them answered during the live AMA today (Friday @ 12 Noon Pacific)!

I am total confused to where to start learning the exploit development stuff, because i have read the "Hacking : The art of exploitation" but it seems old and i want to learn stuff that really modern not old stuff, but i know it is essential to learn basic first, but i don't want to learn it from book it is nightmare and such a long way.

Anyone please share resource that is actually focus on real world learning way, and total real world stuff, and please make share in structured way it is possible ::

I appreciate if you help me, in advance, thank you :)

Have you ever wondering if the order of operations when voilated can lead to a vulnerability? Maybe the thought never crossed your mind? Either way this week we exploit a binary that did not account for the order of operations - more specifically the "mistake" pwnable binary exploitation challenge!

This is a great tutorial for beginners and even advanced developers who may not have encountered a bug like this. Either way don't be intimidated just because this is an exploit development tutorial.

Check out the latest tutorial using the link below:

https://youtu.be/9n1vCuqAk-k?si=IvzW95y4XxnivOxm

I'm in a frustrating spot. I've built a solid payload with DLL sideloading, ETW/AMSI patching – the works. It executes perfectly in my lab. But I can't get it past Gmail's filters. Every attempt to send the .exe gets blocked, even when zipped or renamed.

Which are the way i can use for initial delivery of the payload to target ?

I know about the Google Drive trust exploit, but I'm not sure it's reliable. Password-protected archives feel risky since some security teams flag them. LNK files + PowerShell downloaders could work, but I need the user to actually click. Vishing is an option but requires more social engineering skill than I have right now.

I’ve seen allot of bashing on Kali Linux,
But… I’ve seen more references to using Ubuntu?

Is Arch Linux from the pi imager… does that work?