2026.08.18basic_heap_overflowNo PIE fixes the address of get_shell, so a 28-byte heap overflow is enough to redirect execution.Pwn2026.08.18awesome-basicsA textbook stack overflow: an 80-byte buffer read with 0x80, overwriting RIP to jump into shellcode.Pwn2026.08.18Sigreturn-Oriented Programming (SROP)Notes on SROP: forging a sigcontext frame so a single sigreturn sets every register at once.Pwn2026.08.18cherrystrncmp only checks the first six bytes, so the rest of the overflow is free to reach the return address.Pwn2026.08.18mmappedOverflow the length argument to mprotect so the real flag page is never protected before it is written out.Pwn2026.08.18validatorNX disabled and a writable GOT, so the shellcode is written directly into the GOT and jumped to.Pwn2026.08.18off_by_one_000A single byte past the end of the buffer is enough to shift the saved frame pointer and take control.Pwn2026.08.18ssp_000Stack canary present, so the exploit reads it out first and writes it back in place during the overflow.Pwn2026.08.18memory_leakageA struct read back without clearing it first leaks adjacent heap memory field by field.Pwn2026.08.18basic_exploitation_003A 32-bit binary with no canary and no PIE, exploited by overflowing into the return address.Pwn2026.08.18Exploit Tech: __environFull RELRO and PIE, so the stack address is leaked through the environ pointer in libc instead.Pwn2026.08.18hookThe binary is linked with -z norelro, leaving the init/fini arrays writable and hijackable.Pwn2026.08.18sintA signed comparison lets a negative length through, which then becomes a huge unsigned size in the copy.Pwn2026.08.18Return to Library (RTL)NX blocks shellcode, so the return address goes to a libc function instead. PIE is off, so the offsets hold.Pwn2026.08.18Return to ShellcodeA canary blocks a direct return overwrite, but the stack is executable, so the shellcode goes there.Pwn2026.08.18oneshot46 bytes into a 16-byte buffer, with a leaked stdout address turning a one-gadget into a working shell.Pwn2026.08.18dreamhack.io Reversing Basic Challenge #6Static analysis in IDA of a routine that checks user input character by character.Reversing2026.08.18send_sigThe program forwards a signal number straight to the kernel; the exploit is choosing the right one.Pwn2026.08.18cmd_centerA 24-byte name buffer read with 100 bytes, overflowing into the command string passed to system().Pwn2026.08.18dreamhack.ioprintf(buf) instead of printf("%s", buf) - a format string bug turned into a GOT overwrite.Pwn2026.07.17tcache_dupA double free puts the same chunk in the tcache list twice, so a later malloc hands back a pointer we control.Pwn