Resources
Collection of resources for my preparation to take the OSEE certification. Based on the syllabus from Offensive Security.
Browser Exploitation
Safari/Webkit
- Exploiting a Safari information leak by Bruno Keith
- Attacking Client-Side JIT Compilers by Samuel Groß
Bypass and Sandbox Escape
Data Execution Prevention (DEP)
Tutorials
- Exploit writing tutorial part 10 : Chaining DEP with ROP by Corelan
- Bypass Data Execution Protection (DEP) by Sk0xic
- Exploit Mitigation Techniques - Data Execution Prevention (DEP) by ricksanchez
Supervisor Mode Execution Prevention (SMEP)
- Windows SMEP bypass: U=S by Nicolas Economou & Enrique Nissim
- Kernel Exploitation 4: Stack Buffer Overflow (SMEP Bypass) by Mohamed Shahat
- Exploiting CVE-2017-5123 with full protections. SMEP, SMAP, and the Chrome Sandbox! by Chris Salls
Enhanced Mitigation Experience Toolkit (EMET)
Papers/Slides/Blogs
- Disarming EMET v5.0 by Offensive Security
- Disarming and Bypassing EMET 5.1 by Offensive Security
- Disarming Enhanced Mitigation Experience Toolkit (EMET) by Offensive Security
- Bypassing EMET 5.5 MemProt using VirtualAlloc by Matthias Ganz
- Fldbg, a Pykd script to debug FlashPlayer by Offensive Security
Heap Spraying
Tutorials
- Part 8: Spraying the Heap (Vanilla EIP) by FuzzySecurity
- Part 9: Spraying the Heap (Use-After-Free) by FuzzySecurity
- DEPS – Precise Heap Spray on Firefox and IE10 by Corelan
- Heap Exploitation ~ Abusing Use-After-Free by _py
Heap Overflows
- Heap Overflows For Humans 101 by FuzzySecurity
- Heap Overflows For Humans 102 by FuzzySecurity
- Heap Overflows For Humans 102.5 by FuzzySecurity
- Heap Overflows For Humans 103 by FuzzySecurity
- Heap Overflows For Humans 103.5 by FuzzySecurity
Kernel Drivers Exploitation (32-bit)
Tutorials
- HackSys Extreme Vulnerable Windows Driver by Ashfaq Ansari
- Kernel Exploitation 1: Setting up the environment by Mohamed Shahat
- Windows Kernel Exploitation by Neelu Tripathy
- Kernel Hacking With HEVD Part 1 - The Setup by Brian Beaudry
- Kernel Exploitation -> Stack Overflow by FuzzySecurity
- Kernel Exploitation -> Write-What-Where by FuzzySecurity
- Kernel Exploitation -> UAF by FuzzySecurity
- Intro to Windows kernel exploitation by Sam Brown
- Mixed Object Exploitation in the Windows Kernel Pool by Steven Seeley
Papers/Slides
- Windows SMEP Bypass by Nicolas A. Economou & Enrique E. Nissim
Kernel Drivers Exploitation (64-bit)
Articles
- Exploiting CVE-2015-2426, and How I Ported it to a Recent Windows 8.1 64-bit by Cedric Halbronn
- Taking Windows 10 Kernel-Exploitation To The Next Level Leveraging Write What Where Vulnerabilities In Creators Update by Morten Schenk
- x64 Kernel Privilege Escalation by mcdermott
Tutorials
Exploits
- HackSys Extreme Vulnerable Driver - Windows 10 x64 StackOverflow Exploit with SMEP Bypass by Cn33liz
- CVE-2015-5736 - Fortinet FortiClient 5.2.3 by Alexandru Uifalvi
Kernel ASLR Bypass
Articles
- Development of a new Windows 10 KASLR Bypass (in One WinDBG Command) by Morten Schenk
Shellcoding
Windows 10
- Windows Kernel Shellcode on Windows 10 - Part 1 by Morten Schenk
- Windows Kernel Shellcode on Windows 10 - Part 2 by Morten Schenk
- Token Stealing Shellcode by Morten Schenk
Misc
WinDbg
- Common WinDbg Commands by Robert Kuster
- Debugging Tools for Windows by Microsoft
- Getting Started with Windows Debugging by Microsoft
- Debug Universal Drivers - Step by Step Lab by Microsoft
- WinDbg: Some debugging commands by Kamel Messaoudi
- WinDbg by Exploit Development Community
Tutorials
- PyKD Tutorial – part 1 by Sinaei
Books
- Reverse Engineering for Beginners by Dennis Yurichev
- Advanced Windows Debugging by Mario Hewardt
- Windows Internals, Part 1 by Mark E. Russinovich
- Windows Internals, Part 2 by Mark E. Russinovich
- The IDA Pro Book: The Unofficial Guide to the World’s Most Popular Disassembler by Chris Eagle