Needles in heaps, allocator primitives, posts, tutorials, papers, research notes ...

Your search for

resolved the following candidate gadgets:

Corelan Articles | Exploit Writing Tutorials & Cybersecurity Insights

corelanc0d3r March 5, 2026

Active Directory

Certificates

Exploit writing tutorial part 11 : Heap Spraying Demystified

corelanc0d3r December 31, 2011
A lot has been said and written already about heap spraying, but most of the existing documentation and whitepapers focus on IE7 or older versions. Although there are a number of public exploits available that target IE8, the exact technique to do so has not been really documented in detail. Of course, you can probably derive how it works by looking at those public exploits. With this tutorial, I'm going to provide you with a full and detailed overview on what heap spraying is, and how to use it on old and newer platforms. I'll start with some "ancient" techniques (or classic techniques if you will) that can be used on IE6 and IE7. We'll also look at heap spraying for non-browser applications. Next, we'll talk about precision heap spraying, which is a requirement to make DEP bypass exploits work on IE8. I'll finish this tutorial with sharing some of my own research on getting reliable heap spraying to work on IE9. Read more

Exploit writing tutorial part 10 : Chaining DEP with ROP - the Rubik's[TM] Cube

corelanc0d3r June 16, 2010
About 3 months after finishing my previous exploit writing related tutorial, I finally found some time and fresh energy to start writing a new article. In the previous tutorials, I have explained the basics of stack based overflows and how they can lead to arbitrary code execution. I discussed direct RET overflows, SEH based exploits, Unicode and other character restrictions, the use of debugger plugins to speed up exploit development, how to bypass common memory protection mechanisms and how to write your own shellcode. While the first tutorials were really written to learn the basics about exploit development, starting from scratch (targeting people without any knowledge about exploit development) you have most likely discovered that the more recent tutorials continue to build on those basics and require solid knowledge of asm, creative thinking, and some experience with exploit writing in general. Today's tutorial is no different. I will continue to build upon everything we have seen and learned in the previous tutorials. Today I will talk about ROP and how it can be used to bypass DEP (and ASLR)... Read more

Exploit writing tutorial part 9 : Introduction to Win32 shellcoding

corelanc0d3r February 25, 2010

Over the last couple of months, I have written a set of tutorials about building exploits that target the Windows stack. One of the primary goals of anyone writing an exploit is to modify the normal execution flow of Read more

Exploit writing tutorial part 8 : Win32 Egg Hunting

corelanc0d3r January 9, 2010

Introduction

Easter is still far away, so this is probably the right time to talk about ways to hunting for eggs (so you would be prepared when the easter bunny brings you another 0day vulnerability)

In the first parts Read more

Exploit writing tutorial part 7 : Unicode - from 0x00410041 to calc

corelanc0d3r November 6, 2009

Finally ā€¦ after spending a couple of weeks working on unicode and unicode exploits, Iā€™m glad and happy to be able to release this next article in my basic exploit writing series : writing exploits for stack based unicode Read more

Exploit writing tutorial part 6 : Bypassing Stack Cookies, SafeSeh, SEHOP, HW DEP and ASLR

corelanc0d3r September 21, 2009

Introduction

In all previous tutorials in this Exploit writing tutorial series, we have looked at building exploits that would work on Windows XP / 2003 server.

The success of all of these exploits (whether they are based on direct Read more

Exploit writing tutorial part 5 : How debugger modules & plugins can speed up basic exploit development

corelanc0d3r September 5, 2009

In the first parts of this exploit writing tutorial, I have mainly used Windbg as a tool to watch registers and stack contents while evaluating crashes and building exploits. Today, I will discuss some other debuggers and debugger plugins Read more

Exploit writing tutorial part 4 : From Exploit to Metasploit - The basics

corelanc0d3r August 12, 2009

In the first parts of the exploit writing tutorial, I have discussed some common vulnerabilities that can lead to 2 types of exploits : stack based buffer overflows (with direct EIP overwrite), and stack based buffer overflows that take Read more

Exploit writing tutorial part 3b : SEH Based Exploits - just another example

corelanc0d3r July 28, 2009

In the previous tutorial post, I have explained the basics of SEH based exploits. I have mentioned that in the most simple case of an SEH based exploit, the payload is structured like this :

[Junk][next SEH][SEH][Shellcode]

I Read more