algoatson.github.io ~/tags/pwn
❯ segfault@algoatson.github.io
all tags

#pwn

50 posts
2026-06-15heapHouse of Apple 2 — FSOP after the hooks died4 min
2026-06-14heapthe House of Spirit4 min
2026-06-14heapthe poison null byte3 min
2026-06-14heaptcache dup3 min
2026-06-14heapthe House of Corrosion3 min
2026-06-14heapthe House of Einherjar3 min
2026-06-14heapthe House of Lore3 min
2026-06-14heapthe House of Orange4 min
2026-06-14heapthe House of Rabbit2 min
2026-06-13heapthe unsorted bin attack4 min
2026-06-12heapunsafe unlink (and the safe-unlink bypass)5 min
2026-06-11heapfastbin dup4 min
2026-06-09heapthe House of Force4 min
2026-06-08heapthe glibc heap, from the chunk up6 min
2026-06-07pwnPTR_MANGLE and hijacking the exit handlers3 min
2026-06-05pwnCET — shadow stacks, IBT, and what still works3 min
2026-06-04heapthe tcache stashing unlink attack3 min
2026-06-03kernelDirty Pipe (CVE-2022-0847): one uninitialised flag4 min
2026-06-02pwnPAC and MTE — how ARM64's new walls fall3 min
2026-05-31pwnthe setcontext gadget — one call to every register4 min
2026-05-30pwnstack pivoting — when the overflow is too small3 min
2026-05-26pwna pwntools cookbook4 min
2026-05-26pwnwriteup: static — no libc, no leak, just SROP3 min
2026-05-22pwnSROP — one syscall, every register3 min
2026-05-19toolingone keybind to checksec everything3 min
2026-05-18pwnwriteup: notekeeper — a UAF from menu to shell3 min
2026-05-14pwnBROP — return-oriented programming without the binary4 min
2026-05-12pwnfinding gadgets: ROPgadget, ropper, one_gadget, pwntools5 min
2026-05-10pwnret2dlresolve — a shell with no libc leak3 min
2026-05-01pwnpwndbg muscle memory4 min
2026-04-30pwnseccomp jails, and the holes in them3 min
2026-04-20kerneluserfaultfd & FUSE — freezing a race until it's deterministic3 min
2026-04-18kernelDirtyCred — swap the object, skip the corruption3 min
2026-04-16kernelcross-cache attacks — reaching the objects in their own cache3 min
2026-04-14kernelkernel heap spray — the elastic objects you allocate on demand4 min
2026-04-12kernelkernel LPE — commit_creds(prepare_kernel_cred(0))3 min
2026-04-05pwnC++ vtable hijacking and type confusion3 min
2026-03-15pwnthe stack canary, from the source4 min
2026-02-22pwnprintf is a write primitive3 min
2026-02-14kernela slab use-after-free, from ioctl to root4 min
2026-02-02pwnshellcoding under constraints — null-free and alphanumeric3 min
2026-01-29pwnret2libc on a warm-up: stack smash to shell4 min
2026-01-22pwnone_gadget — a shell in a single address3 min
2026-01-18heaptcache poisoning, explained like you'll have to use it4 min
2026-01-16pwnfrom OOB to arbitrary R/W (and a shell)4 min
2026-01-15pwnret2csu — the universal gadget hiding in every binary3 min
2026-01-13pwnJIT type confusion — when the optimizer believes a lie3 min
2026-01-11pwnaddrof and fakeobj — the two primitives that own a JS engine3 min
2026-01-08pwnwhen an integer becomes a memory bug3 min
2025-12-25ctfadvent of pwn 20255 min