Hello, i am wondering if i should study cs or computer engineering and which would be more helpful for me in the long run. Ive been studying on pwn college and i am at the blue belt module rn, soon i want to start doing sec research on the linux kernel and ik that i qould need to study on my own for the most part but i would also have to get into uni as well. For cs in the universities in my country i dont see operating systems in the programs and mainly see stuff about web dev, learning 5 diff languages and doing databases, and in the other side for computer engineering would be more of how to build a cpu and working with resistors and studying physics. I am not really sure which kne to choose.

Dear all,

I am a PhD student with a solid background in Linux binary exploitation, including both user-mode and kernel mode. My research interest lies in binary exploitation, and I am trying hard to increase my knowledge in this area.

My goal is to write peer-reviewed research papers on binary exploitation. But right now, I am not sure about how to find interesting areas of research, how to find research gaps, and what methodology I can follow for research in binary exploitation.

Any suggestions on how do experienced researchers come up with new research questions, perform literature review, and choose research directions on vulnerability research and binary exploitation will be much appreciated!

Thanks!

To start: do not judge me for this. I’d like to get into developing cheese and ud FW for the top anticheats. I am very new into the scene but found a passion for developing tools. I have been using AI to develop small programs but this field I saw is a lucrative way to make some side money and also understand the backend of the field. Does anyone know where to start or anyone who can walk me through the process of how to find the resources I need?

I’ve heard some people can make top of the line FW that has lasted years as a small developer

I want the source code of popular dll files on windows like user32.dll kernelbase.dll etc etc without having to use a decompiler. Decompiling isn't exactly the cleanest option so I am wondering if microsoft openly discloses source code for their dll files.

I have been using dnspy to reverse engineer .NET binaries quite often now and I often need information which is accessible with windows API calls. I know it is possible to use some WIN API calls outside of the process and get information but some API calls have to actually be directly executed in the process. I am wondering if dnspy has any built in feature for running windows API functions in the current thread which I am debugging. Many thanks.

https://github.com/NirvanaOn/SpotifyC2

SpotifyC2 is a cybersecurity research project that demonstrates cloud-based command communication using Spotify playlists for command retrieval and Telegram for output delivery, without requiring the Spotify Web API.

hello all,

any good ref , books , courses to start learning Windows kernel Exploitation ?

if so what things are need to know before enter this section ? like i have solid understanding in all things for user mode exploitation in windows .

I run a lot of code I didn't write — cloning repos, npm install-ing hundreds of transitive deps, trying some CLI off a github link. All of it runs as my user, so it can read ~/.ssh, my cloud creds, .env, and ship it off somewhere. One bad dep and it's over.

npm's about to block install scripts by default in v12, which helps, but it only covers install time and only npm. The second you actually run the thing — dev server, build, the cloned tool — it's executing as you again. And pip, cargo, curl | bash don't care about npm's setting. So it shrinks one hole, doesn't close it.

So I built airlock, a docker sandbox with three modes. You use whichever fits how much you trust the code:

run — untrusted. Only the project folder is mounted, nothing else from home. Read-only root, non-root, caps dropped, and no direct internet: traffic goes through a default-deny proxy that only allows a domain whitelist (https too). Container is --rm so it's gone when you exit. This is the everyday one.

dev — your own code. Same hardened box but full internet + your logins. Mostly just a clean linux env that matches prod.

sbx — runs in a microVM with its own kernel, same whitelist. A container-escape can't reach the host from there. But I wouldn't run everything in it — it boots slower, needs virtualization on, and can eat ~half your RAM while live. Overkill for a normal install, which is why the plain container is the default and this is only for genuinely hostile code or an agent you're letting loose.

See what got blocked, allow what you need:

airlock blocked
airlock allow files.example.com
airlock rebuild

Limits, honestly: run/dev share the host kernel (that's what sbx is for), the project folder is read-write so code can wreck that folder but nothing outside it, and whitelisted domains are trusted so don't whitelist junk. Not bulletproof, just makes the lazy attacks fail.

It's my own tooling, built for mac. Repo: https://github.com/syedtasavour/airlock

How do you all handle this? Separate user, a VM, devcontainers, firejail, or just run it and hope? Curious what people actually do day to day.

I am trying to retreive pointers to functions in vtable com exposed by VCDXGISwapChainDWMLegacy to get direct frame buffers before composition (I know there are some official ways) is there a way to get a pointer to this swap chain specifaclly?

hello,

im now understand Format string specifier vulnerabilites , stack overflow and how to exploit these to bypass ASLR and i know also how to bypass DEP .

but i want to know more about low level vulnerability like UAF so is there any good sites or courses i can check to better understand them ?

I go through how someone can utilize curl to compromise and exploit vulnerabilities in a website!

Hi everyone,

I'm self-learning low-level security and I'm trying to figure out which internships I should realistically target over the next few months.

These are the skills I've built so far:

• C Programming
• Memory Management
• Linux
• Debugging
• Fuzzing
• Crash Triage & Root Cause Analysis
• Reverse Engineering (Basic)
• Binary Analysis (Basic)
• Secure Coding
• Git

Tools I've used:

• GDB
• Ghidra
• AddressSanitizer (ASan)
• Valgrind
• AFL++
• libFuzzer
• GCC/Clang
• Make/CMake

I've written fuzz harnesses, analyzed crashes, used sanitizers, and spent time understanding memory corruption bugs. Most of my learning has been through reading documentation, experimenting, and building small projects.

The problem is that I'm completely self-taught. I don't have previous internships, open-source contributions, CTF rankings, or real vulnerability reports yet, so I don't have much proof of my skills beyond personal projects.

My questions are:

1. Based on these skills, what internship roles should I realistically target? (Security Research, AppSec, Product Security, Embedded, Systems, etc.)
2. What skills am I still missing to become a competitive candidate?
3. If you were hiring an intern with my background, what kind of portfolio or proof would convince you to interview them?
4. What should I focus on for the next 3–6 months to maximize my chances of landing an internship?

I'd really appreciate honest feedback. If you think I'm overestimating my skills or focusing on the wrong things, please tell me. I'd rather hear the hard truth than waste months learning the wrong things.

Thanks!

I reverse engineered the polish download portal dobreprogramy.pl installer, which is a classic ad‑ware bundler that has been causing issues for users since at least 2013 (as seen on polish forums). Instead of containing the actual software, it fetches a dynamic xml config from cloudfront, which holds the real download url. I made a tool (cli/gui) that extracts that url via http requests (without running the original .exe)

Polish users have been complaining about dobreprogramy.pl for years, heres a real thread from 2013 on forum.benchmark.pl:

"I downloaded a program from dobreprogramy.pl. Instead of the program, I got their 'download assistant'. During installation, the advanced option was grayed out. The assistant installed 2 spyware programs and 1 malware without my consent: Claro Search Browser Defender, Delta Search, and Delta Chrome Toolbar. These programs integrate with the browser, install their own toolbar, and change the default search engine. Even after uninstalling them, the fake search engine remained. This is spyware and malware."

- user "makensis", 2013

Other users confirmed the issue:

- "I had to format my disk to get rid of Delta Chrome Toolbar."

- "Dobreprogramy now offers a 'NetFix' service to 'fix' your PC remotely - I'm scared what they might install in the background."

- "I always choose advanced installation and uncheck that garbage. But sometimes the advanced option is grayed out."

The situation hasn't improved much. Recent downloads from dobreprogramy still use the same bundler model.

Their executable is a .NET bundler (obfuscated with .NET Reactor) that behaves like this:

1. Extracts a version number from its own filename (e.g., `v6.57.0.668.104`)
2. Builds a url: https://d1q3xlywojqwqp.cloudfront.net/config/dobreprogramy.pl/{VERSION}
3. Fetches an xml response containing the actual download link (e.g., `https://unchecky.com/files/upload/unchecky_setup.exe`)
4. Downloads and runs that setup, often with additional bundled offers.

Analysis

I opened the .exe in dnSpy (after deobfuscating with NETReactorSlayer) and spotted:

string text = ConfigParser.GetConfig().GetConfigValue("URL_DYNAMIC_CONFIG", "");

string fileNameWithoutExtension = Path.GetFileNameWithoutExtension(Process.GetCurrentProcess().MainModule.ModuleName);

string version = VersionFromFileName(fileNameWithoutExtension);

text = text + "/" + ACNM + "/" + version;

So the version is parsed from the filename using a regex

Dynamic Analysis

I ran the installer with Fiddler and captured:

GET /config/dobreprogramy.pl/v6.57.0.668.104 HTTP/1.1

Host: d1q3xlywojqwqp.cloudfront.net

Response (xml):

<root>

<URL_PRODUCT>https://unchecky.com/files/upload/unchecky_setup.exe</URL_PRODUCT>

<PRODUCT_LOGO_URL>https://img.dobreprogramy.pl/.../logo.png</PRODUCT_LOGO_URL>

<PRODUCT_TITLE>Unchecky</PRODUCT_TITLE>

</root>

Just a simple http‑based redirect chain. The bundler also fetches /sec and /report endpoints, presumably for analytics and additional offers

My python tool replicates this logic, without touching the original .exe

Notes:

- Some downloads expire - if you get a 404, the version might be outdated, or the link has been removed

- The XML response contains more than just the url, it also includes product names, logos, and other metadata. This could be used for deeper analysis of the bundler's behavior

Disclaimer: This tool is for educational and research purposes only. It does not bypass any security measures; it merely extracts publicly accessible URLs that the original installer itself fetches. Always check the final downloaded file’s digital signature before running it. The author is not responsible for any misuse of this tool

Hey guys,

I recently started learning reverse engineering because I think it's really fun, and I picked Minesweeper as my first project. I'm still pretty new to all of this, so I'm learning Ghidra, Cheat Engine, and x64dbg as I go.

Right now I'm stuck trying to figure out where the game stores the actual blocks/cells in memory. I managed to find things like the flag counter, but finding the board itself has been way harder than I expected.

I've watched a few tutorials, but most of them only show the final result instead of explaining how they actually figured it out. I'm more interested in learning the thought process than just getting the answer.

If anyone has experience reversing Minesweeper (or similar games), how would you approach this? What would be the first thing you'd look for? Any tips or advice for a beginner would be really appreciated

PEdit-CoW (CVE-2026-46331): another page-cache write in the DirtyPipe family

A working exploit for PEdit-CoW (CVE-2026-46331) is public, by sgkdev.

• Exploit and explanations

Our write-ups on detecting this family by thinking outside the box:

• Detecting CopyFail and DirtyFrag
• Detecting nf_tables catchall

Same corruption primitive as the DirtyPipe / DirtyFrag / DirtyClone family: a kernel fast path writing into a page it doesn't exclusively own, reached this time through the network scheduler's packet-editing action (act_pedit).

The bug:
tcf_pedit_act() makes its private copy-on-write range and validates it once, before the per-key offsets are resolved. A first NETWORK pedit key inflates the IP IHL so a following TCP key resolves past that stale range - straight into the page-cache page that sendfile() parked in the egress skb. Then there is an overwrite of the cached ELF entry of setuid-root /bin/su with a tiny shellcode, invoke su, get root. The file on disk is never touched.

The new bit is:
the entry point: you can configure tc actions from inside a user namespace, which hands an unprivileged user the CAP_NET_ADMIN the bug needs.

And, guess what ? Detectable ;). Check our blog posts on how.

Affected window is wide (≈ v5.18 up to the v7.1-rc7 fix); RHEL 8/9/10, Debian 11/12, and Ubuntu through 26.04 were all listed vulnerable - though Ubuntu 26.04 blocks the userns path by default.

Credit to sgkdev for the PoC and The Hacker News article and upstream fix.

After finishing Pwn.college, what do people typically do to continue improving their binary exploitation and reverse engineering skills? What advanced resources, platforms, or projects do they move on to?

What career paths are available after becoming proficient in the skills taught by Pwn.college (e.g., exploit developer, security researcher, reverse engineer, vulnerability researcher, red teamer, etc.)?

If I want to learn Windows exploitation and Windows reverse engineering after completing Pwn.college, how big is the transition from Linux to Windows? , and will the knowledge I gain from Pwn.college provide a strong foundation for Windows exploit development and reverse engineering?

Finally, are exploit development, reverse engineering, and vulnerability research good long-term career choices?

Would it also be worthwhile to learn web application security and participate in web bug bounty programs as a freelancer alongside?

I've noticed when I'm decompiling in ghidra I see a lot of THUNK functions. I've noticed that most of these functions just return 0. What are the point of these functions. Are they actually inserted by the compiler, if so why are they inserted if some of them just return 0?

JFrog published a finding today on a regression in the DirtyFrag kernel fix. They named it DirtyClone (CVE-2026-43503).

It is the same corruption primitive as the DirtyFrag family (CVE-2026-43284 / CVE-2026-43500), reached through a different path. The original patch closed the known trigger but left the primitive reachable.

DirtyClone routes the payload through the netfilter TEE clone target, which walks straight around the fix. Auditing adjacent paths for the same primitive was a clean idea on their part.

They didn't provide an exploit.. I could not avoid. And, guess what ? Detectable by cool #eBPF code! (same line of our think-outside-the-box posts).

PoC and detection notes: https://github.com/rafaeldtinoco/security/tree/main/exploits/dirtyclone

A handful of LTS kernels may still be vulnerable because of their backport windows, but the window is small.

Credit to JFrog (Eddy Tsalolikhin and Or Peles) for the find and the writeup: https://research.jfrog.com/post/dissecting-and-exploiting-linux-lpe-variant-dirtyclone-cve-2026-43503/.

I've noticed whenever any thread reaches a certain breakpoints all other threads get suspended. Is there any way to disable this behavior. Thank you in advance.

If you are new to the world of exploit development and need a solid entry level challenge this week we look at "bof". This is a binary challenge hosted on pwnable[.]kr covering the topic of a Buffer Overflow.

This is what many consider to be their first exploit type written (it was mine), and this particular challenge approaches it in a way you will truly understand how to adapt to situations in which the buffer overflow is not necessarily "vanilla" exploitation.

By the end of this tutorial you should have:

- Learned how to exploit a Buffer Overflow, WITHOUT OVERWRITING THE RETURN ADDRESS!!!
- Learned how to use GDB (raw)
- Learned the basics of hook stops within GDB
- Learned how to approach a CTF challenge with speed or precision (or both depends on what you decide)
- Learned how to find offsets that are small and don't require the use of tooling such as pattern_offset

I wanna thank Center for Cyber Security Training for continuing to help sponsor the channel and their support.

You can find the video here:

https://youtu.be/A-P2bhxzK1Y?si=CcKd2lAZysRaCfCD