Hacking to the Bone
The low-level offensive path: reverse engineering, binary exploitation, kernel exploitation, weaponized files, networks, malware and C2, and defeating modern defenses. This is your assembly and C, turned into a weapon.
Practice only on systems you own or are explicitly authorized to test: your own VMs, deliberately-vulnerable targets, and CTF platforms (picoCTF, pwnable.kr, pwn.college, OverTheWire). Unauthorized access is a crime. Skill without ethics is a liability.
Foundations & the Lab
0/8A professional lab, Linux to the bone, scripting your own tools, and the network stack you'll attack.
How attackers think, and building a safe place to practice
VMs, snapshots, isolated networks, and a workflow you trust
Filesystem, permissions, processes, and the way in
The shell, pipes, redirection, and job control as weapons
Automate recon and glue your tools together
Sockets, packets, and writing your own exploits
The stack, frames to packets, and reading them in Wireshark
TCP/IP, routing, NAT, and the protocols attackers live in
Networks & Interception
0/5Living inside the network: crafting packets, intercepting traffic, attacking protocols, and pivoting deeper.
Forging any packet by hand with Scapy — the network is just bytes
ARP spoofing, capturing traffic, and sitting in the middle
Abusing DNS, DHCP, and the trust built into the stack
Pulling secrets, files, and structure out of a packet capture
Reaching the network behind the network
Reverse Engineering
0/3Reading a binary with no source — static in Ghidra, dynamic in gdb, and beating anti-analysis.
Binary Exploitation
0/12Where your assembly and C pay off: from a stack overflow to shellcode, ret2libc, ROP, and the heap.
Not a re-teach: calling-convention abuse, gadget-hunting, and reading disassembly for exploitable primitives
Why mixing data and control is fatal
Overwrite the return address, hijack execution
The payload that turns a crash into a shell
Making your payload survive the journey
NX, ASLR, canaries, PIE, RELRO, CET/shadow stack, and why they exist
Exploiting when the stack isn't executable
Building a program out of the program's own scraps
How %n turns a printf into an arbitrary write
How malloc really works, and where it breaks
Use-after-free and the modern frontier
A full exploit against a remote service
Advanced Exploitation
0/5The deep end of userland: Windows exploit dev, browser exploitation, advanced use-after-free.
Classic Windows memory corruption
Defeating modern Windows mitigations
The most valuable target on earth
Grooming the heap in complex targets
From a crash to a reliable, weaponized exploit
Kernel Exploitation
0/4From user to ring 0: kernel internals, Linux and Windows kernel bugs, and sandbox escapes.
Ring 0, syscalls from the other side, and the kernel's memory
From user to ring 0, past SMEP, SMAP and KASLR
Tokens, pool grooming, SMEP/kCFI, and SYSTEM
Breaking out of the box you're contained in
Vulnerability Research & Fuzzing
0/6Where 0-days come from: source auditing, fuzzing, crash triage, and turning a bug into a CVE.
How professionals hunt unknown bugs
Reading C the way an attacker reads it
AFL++, libFuzzer, and throwing chaos at a target
Fuzzing that actually reaches deep code
Turning a pile of crashes into one real bug
The full lifecycle of a discovery
Weaponization & the Cool Stuff
0/7Turning files and trust into code execution: evil PDFs and documents, malicious images, polyglots, steganography, BadUSB.
Shellcode, stagers, and formats for any target and any channel
Office macros and PDFs that run code when opened
When opening a picture runs code — parsers, polyglots, and abuse
Hiding payloads and data inside images, audio, and plain sight
HTML smuggling, ISO/IMG/LNK/OneNote — how payloads land now
A keyboard that types your payload — Rubber Ducky and friends
The delivery paths people never think to suspect
Malware Development & C2
0/7Build the toolkit yourself: implants, process injection, persistence, in-memory execution, and command-and-control.
The anatomy of an agent that calls home and takes orders
Running your code inside another process
Surviving a reboot, quietly
Never touch disk, never leave a file
Sliver, Mythic, Cobalt Strike — how they really work
Redirectors, domain fronting, and staying reachable
Not getting caught, and not getting reversed
Defeating Modern Defenses
0/6How EDR really works and how it's bypassed: AMSI/ETW, direct syscalls, unhooking, packing, and living off the land.
You cannot evade what you do not understand
Blinding the sensors before you act
Going around the userland hooks entirely
Defeating static detection
Operating with the tools already installed
Measure evasion, don't guess it
Capstone
0/1Chain it all: find a bug, write the exploit, deliver an implant, evade detection — end to end, in your lab.