Turning a memory-safety bug into control over execution. The free learning here leans Linux/CTF, because that's where the open material is; Windows and kernel are called out where they fit. Read foundations first if stacks, registers, and calling conventions aren't second nature yet.
- pwn.college - ASU's free dojo: structured modules from assembly up to advanced exploitation, each with a live practice environment. The best place to start now.
courseintro - Nightmare - a free exploitation and RE course built entirely from CTF challenges, each worked start to finish.
courseintro - ROP Emporium - learn return-oriented programming through focused challenges, the same puzzle across architectures.
intro - Exploit Education - progressive VMs (Nebula, Phoenix) for practising memory corruption from the ground up.
intro - how2heap - Shellphish's hands-on tour of glibc heap exploitation, one runnable example per technique.
working - ir0nstone's Binary Exploitation Notes - a clean, modern written course: stack, ROP, heap, and the mitigations in the way.
working - Modern Binary Exploitation - RPISEC's university course (lectures + labs). Dated in spots, still one of the best free deep dives.
courseworking - Linux Exploitation Course - slides and labs through Linux userland exploitation.
course - Corelan - Peter Van Eeckhoutte's classic Windows exploit-dev tutorials; where a lot of people first learned SEH overwrites and heap spraying.
working - FuzzySecurity - b33f's classic Windows exploit-development and kernel-exploitation tutorials.
working - LiveOverflow - the binary-exploitation and CTF video series that got a generation started.
videointro - CryptoCat - binary exploitation and CTF pwn walkthroughs, from a first overflow upward.
videointro - Off By One Security - livestreams on exploitation, WinDbg, and vulnerability research with guest researchers.
video - Exploring the Foundations of Software Exploitation - Dr Josh Stroschein's 10-part ground-up path through memory-corruption basics.
videointro - Browser Exploitation - LiveOverflow's 11-part introduction to JavaScript-engine exploitation, from bug class to primitive.
videoworking - CS6265: Tut01 GDB/x86 - Georgia Tech's first exploit-lab warmup: GDB, x86 state, stack layout, and a small control-flow target.
intro - Ret2 WarGames - Ret2 Systems' browser-based binary-exploitation curriculum; interactive challenges with nothing to install.
coursepaid - OffSec EXP-301 (OSED) - Windows user-mode exploit development: reverse engineering, custom shellcode, and DEP/ASLR bypass, toward the OSED cert.
coursepaiddeep - SANS SEC760 - advanced exploit dev: patch diffing, Chrome V8, and Windows kernel exploitation. The step after OSED.
coursepaiddeep
- pwntools - the CTF exploitation framework: packing, ELF parsing, process and socket tubes, ROP. The docs double as the tutorial.
tool - ROPgadget - finds gadgets and can auto-assemble a ROP chain.
tool - Ropper - gadget search and chain building across formats and architectures.
tool - one_gadget - locates the single-call "magic" execve gadgets inside a libc.
tool - libc-database - identifies the exact libc from a couple of leaked symbol offsets, then hands you the other offsets.
tool - pwninit - sets up a downloaded pwn challenge: patches the loader and libc, writes a starting template.
tool - checksec - reports which mitigations (NX, PIE, RELRO, stack canary) a binary was built with.
tool
- Linux Kernel Exploitation - Andrey Konovalov's curated collection of articles, talks, and tools for kernel exploitation. The map of the territory.
deep - HackSys Extreme Vulnerable Driver - a deliberately vulnerable Windows driver for practising kernel exploitation.
toolworking - Linux Kernel Defence Map - vulnerability classes plotted against the mitigations that stop them. Orient here before going deep.
deep - Exploit Mitigations - NCC Group's matrix of mitigations by OS, architecture, runtime, and application version.
deep - scudo-exploitation - artifacts for HexHive's Android Scudo allocator exploitation paper, including a GDB heap plugin.
paperdeep - vmware-exploitation - Andrey Konovalov's collection of VMware escape research, exploit writeups, and hardening references.
deep
- h0mbre - deep fuzzing and exploitation writeups; long, build-along posts.
blog - santaclz - vulnerability research on system internals, reversing, and exploitation.
blog - 7Rocky - pwn and RE challenge writeups (Hack The Box, CTFs).
blog - abatchy - exploit development and kernel exploitation, including OSCE-style prep.
blog - wetw0rk - exploit development writeups.
blog - 0xNinjaCyclone - binary exploitation writeups.
blog - PWNophrenia - binary exploitation and pwn writeups.
blog - Med's Blog - CTF pwn writeups and security notes.
blog - retr0 - binary exploitation challenge writeups.
blog - Zero Day Initiative - ZDI's advisories and deep exploitation writeups.
blog - Project Zero - Google's elite bug-hunting team; the deepest public 0-day analyses. The old blogspot address now redirects here.
blog - watchTowr Labs - full teardowns of enterprise-appliance n-days, usually with the patch diff that gave the bug away and a working PoC.
blog - Zero Day Engineering - Alisa Esage on the methodology of vulnerability research: how a target gets picked apart and how a bug turns into an exploit.
blogdeep - ret2 systems - modern exploitation and RE, including browser and CTF deep dives.
blog - chompie - Windows and Exchange exploitation research (ProxyLogon-era RCE work).
blogdeep - Will's Root - kernel and CTF binary-exploitation writeups.
blog - Samuel Groß (saelo) - elite JavaScriptCore and V8 browser-exploitation research.
blogdeep - phoenhex - a CTF and browser-exploitation team's writeups on JS engines and sandbox escapes.
blogdeep - STAR Labs - Pwn2Own-grade vulnerability research and exploitation writeups.
blogdeep - Exodus Intelligence - n-day and 0-day vulnerability research and exploitation.
blogdeep - Duasynt - Vitaly Nikolenko on Linux kernel exploitation and internals.
blogdeep - pwning.systems - Apple kernel bugs, privileged container escapes, and variant analysis.
blogdeep - Klecko - Windows kernel, exploitation, and low-level security research.
blogdeep - Low Level Software Security - compiler and hardware security mitigations and their bypasses.
blogdeep - Breaking Bits - exploit development, kernel, and cloud-exploitation notes.
blogdeep - u1f383 - Linux kernel exploitation deep-dives.
blogdeep - pacbypass - CTF-grade kernel and browser exploitation writeups.
blogdeep - sizzop - kernel exploitation writeups, heavy on HackSys Extreme Vulnerable Driver and fuzzing.
blogdeep - Syst3m Failure - Linux kernel exploitation in depth: page allocator internals, a kernelCTF first blood, and the 16-year-old 6pack driver bug.
blogdeep - Pwning Tech - ksmbd fuzzing and remote Linux kernel exploits, alongside IoT device CVEs.
blogdeep - Brendon Tiszka - V8 and Chromium bug hunting from a Project Zero researcher, including CVE-2021-21225 and WebGPU work.
blogdeep - ctf.gg - the .;,;. team's own blog; SMM bootkits and Windows kernel ALPC race conditions, not the usual challenge recaps.
blogdeep - Project Sekai - team writeups plus real coordinated disclosures, including a NASM heap use-after-free driven to RCE.
blogdeep - Never Stop Exploiting - NeSE's own site; pwn writeups from N1CTF and HITCON at full depth.
blogdeep - Plaid Parliament of Pwning - CMU's PPP publishing member-written pwn writeups, including the 35C3 krautflare speculative-execution challenge.
blogdeep - RPISEC - RPI's student security club; tcache internals and Mach code injection on 32-bit processes.
blogdeep - idek - team blog with out-of-bounds-write to page-UAF chains and Windows RE challenges.
blog - Tower of Hanoi - Politecnico di Milano's team archive, heap exploitation and obfuscation challenges going back a decade.
blog - Dragon Sector - the Polish team of Gynvael Coldwind and j00ru; member-written writeups across pwn and RE.
blogdeep - ptr-yudai - zer0pts member on kernel and heap internals; the Dirty Pagetable writeup is the clearest account of the technique.
blogdeepja - Gergely Kalman - macOS local privilege escalation, including the badmalloc bug, written up with the reasoning intact.
blogdeep - zhodiac - Fermin J. Serna's personal site, still up from before he co-founded Project Zero.
blogdeep - 0xdeadbeef - Marco Ivaldi (raptor) and two decades of Unix and Solaris exploit work.
blogdeep - Quentin Kaiser - embedded exploit development, including patch-diffing Cisco firmware without the vendor's symbols.
blogdeep - Source Incite - Steven Seeley's small offensive-research shop; long bug-hunting writeups on enterprise software.
blogdeep - ege.sh - Ege Balci, Phrack author, on shellcode and evasion engineering.
blogdeep - kileak - detailed heap and ROP pwn writeups, worked rather than summarised.
blogworking - Zero Science Lab - an independent Macedonian vulnerability lab publishing its own advisories and PoCs.
blogdeep - chompie.rip - Valentina Palmiotti on kernel exploitation and bug hunting, including the BlueKeep-era SMB work.
blogdeep
- A deep dive into modern Windows SEH (x64) - how structured exception handling really works on 64-bit Windows.
writeupdeep - Early Exception Handling - a subtlety in how exceptions get dispatched early.
writeup - A Brief Analysis of the SEH Mechanism in 64-bit Windows - from the Kanxue RE community.
writeup - SEH Overwrite (CanSecWest 2010) - the classic paper on SEH-based exploitation.
paperdeep - Linux kernel exploitation: CVE-2017-11176 - Lexfo's four-part, ground-up kernel exploitation walkthrough.
writeupdeep - A deep dive into a V8 sandbox escape - Theori dissects an in-the-wild V8 exploit.
writeupdeep - Exploiting the libwebp vulnerability, part 2 - dissecting the BLASTPASS-era libwebp heap overflow.
writeupdeep - Phrack - the legendary hacking and exploitation zine; decades of foundational articles.
zine - Smashing the Stack for Fun and Profit - Aleph One's 1996 paper that taught the world stack overflows.
paperintro - Once upon a free() - the classic Phrack article on heap and malloc exploitation.
paperdeep - Uninformed - the archived journal (2005-2008) of deep Windows internals, exploitation, and anti-detection research.
zine - Exploiting Format String Vulnerabilities - the canonical scut/team-teso paper on format-string bugs.
paperdeep - The Geometry of Innocent Flesh on the Bone - Shacham's paper that introduced return-oriented programming.
paperdeep - Blind Return Oriented Programming (BROP) - the Stanford paper and site on building ROP chains without the target binary.
paperdeep - Exploit Programming: from Buffer Overflows to Weird Machines - Bratus et al. framing exploitation as programming the target's "weird machine".
paperdeep - 0-days In-the-Wild - Project Zero's tracker and root-cause analyses of exploited-in-the-wild 0-days.
writeupdeep - Chrome Browser Exploitation, Part 1 - introduction to V8 objects, JavaScript internals, and browser-exploit setup.
writeup - Chrome Browser Exploitation, Part 2 - V8 Ignition, Sparkplug, TurboFan, and JIT compilation background for browser exploitation.
writeup - Chrome Browser Exploitation, Part 3 - applies the series to CVE-2018-17463, from bug analysis to a working Windows exploit.
writeup - An Introduction to Chrome Exploitation - Maglev Edition - V8 Maglev pipeline notes tied to CVE-2023-4069 root cause and exploit adaptation.
writeupdeep - Exploiting V8 at openECSC - beginner-friendly path from a V8 memory-corruption bug to a working browser pwn.
writeup - Privilege escalation using the XAML diagnostics API - Windows CVE-2023-36003 writeup: abusing XAML diagnostics to inject into elevated processes.
writeup - DirtyCred Remastered - turns a Linux kernel use-after-free into privilege escalation with DirtyCred-style object reuse.
writeupdeep - DirtyClone - JFrog's Linux LPE writeup for a DirtyFrag-family residual bug, including patch diffing and object-reuse exploitation.
writeupdeep - 4 exploits, 1 bug - exploits MediaTek wappd CVE-2024-20017 four ways, from plain stack smash to mitigated arm64 router target.
writeupdeep - Writing Hardcoded Windows Shellcodes - 32-bit Windows shellcode tutorial that resolves APIs by fixed addresses for a constrained lab target.
writeupintro - ElectricChrome - CVE-2020-6418 in V8, driven all the way to code execution on a Tesla Model 3 infotainment browser.
writeupdeep - Trigon - Alfie Cleveland's deterministic iOS kernel exploit, written up in full.
writeupdeep - Hacking the PS4, part 3 - cturt on kernel exploitation of the console, the part where it gets hard.
writeupdeep - Exploiting AF_VSOCK - a Linux kernel bug in the virtio socket family taken to privilege escalation.
writeupdeep - Dabbling with Linux kernel exploitation - 0x434b learning kernel pwn through CTF challenges, with the dead ends kept in.
writeupworking - Dirty Pagetable - the page-table corruption primitive explained from first principles.
writeupdeepja - Reviving the modprobe_path technique - Theori getting a killed Linux LPE primitive working again after the upstream patch.
writeupdeepko - RCU race condition in TCP-AO - CVE-2024-27394 taken apart at the RCU level.
writeupdeepko - CVE-2022-32250 with mqueue - netfilter bug driven to root using message queues for the heap groom.
writeupdeepko - A new era of macOS sandbox escapes - Mickey Jin on an overlooked attack surface that yielded ten-plus bugs.
paperdeep - Pardus 21 remote code execution - Mehmet Ince's 0-day in Turkey's national Linux distribution.
writeupdeeptr - Introduction to SpiderMonkey exploitation - the standard on-ramp to Firefox JS engine bugs.
writeupdeepfr - Introduction to TurboFan - V8's optimising compiler explained well enough to attack it.
writeupdeepfr - Spectre Returns! Speculation Attacks using the Return Stack Buffer - SpectreRSB mispredicts through the return stack buffer instead of the branch predictor, sidestepping the mitigations of the day.
paperdeep - Spring: Spectre Returning in the Browser - VUSec leak data out of a JS engine using speculative load queuing and deep call stacks.
paperdeep - SoK: Make JIT-Spray Great Again - Gawlik and Holz systematise JIT-spray and JIT code reuse against browser compilers.
paperdeep - Hunting the Haunter - Haunted RelSE finds Spectre v1 and v4 gadgets in binaries by tracking only the divergences that matter.
paperdeep - On the Insecurity of Vehicles Against Protocol-Level Bluetooth Threats - Antonioli and Payer unlock and start a car by impersonating a paired phone, breaking no crypto at all.
paperdeep - CVE-2026-64582 - n4sm's RDMA local privilege escalation, disclosed and explained by the finder.
writeupdeep
- awesome-exploit-development - a deeper, topic-specific exploit-dev resource list.
reference - awesome-browser-exploit - browser-exploitation tutorials and papers grouped around V8, JavaScriptCore, Chakra, and sandbox escapes.
reference - WindowsExploitationResources - Windows exploit-dev resources heavy on kernel internals, mitigations, talks, and papers.
reference
Links verified 2026-07-06. Found rot? Open an issue or PR.