Exploitation

1. How to use this wiki

... or several advices for beginners

1.1. Required knowledge

At least the basic knowledge of assembly, OS internals, C/C++ languages are needed to get the most value from this wiki. Also you will need to know how to work with tools like debuggers, disassemblers, etc. Knowledge of some scripting language (like Python, Perl, Ruby) will help to develop exploits faster and some handy tools you might need. Tutorials works just like a glue that ties together theoretical knowledge and gives you a boost in a practical usage. Links that covers these requirements are not listed here - it is assumed that you will find them yourself, this is exploitation wiki. However, you can look for that what you need to get required knowledge here: "From 0x90 to 0x4c454554, a journey into exploitation".

1.2. What to start with

Most simple vulnerabilities from the point of view of exploitation are stack-based buffer overflows. Obviously, for novice exploit writers this is good start point.

Peter Van Eeckhoutte's (corelanc0d3r) series of tutorials are right thing to start with - those structure is well-formed, explained step-by-step and covers most exploitation topics starting from those easy, continuing with more and more complex.

Another great reading that definitely will help novice exploit writers to warm up is the "Smashing the stack in 2010" by Andrea Cugliari and Mariano Graziano. These papers covers both Windows and Linux environments, explains assembly, and contains real-world vulnerabilities exploitation examples.

And for all those who are assuming long prospective roadmap: "How do I become a Ninja?".

1.3. Actual and outdated topics

Keep in mind that old articles (or new, that focused on old OS) might confuse you. In recent years there had appeared several mitigation techniques across the OS's, different kernel changes were applied, API's were broadened, etc. So, be careful when trying to reproduce tutorial steps. Most likely, you will need to disable mitigations or setup some older operating system to make your exploits work. It is worth to go through the section "Timeline and history" first.

Another suggestion for beginners in the field of exploitation - do not hurry with covering complex topics like ALSR, DEP bypassing, heap exploitation, etc. Is is better to devote time for learning that what is mentioned in subject 1.1 and follow tutorials.

Introducing new obstacles step by step is good strategy not only in learning, but in overall exploit development.

1.4. Types of references

As you might have noticed, in table there is a column called Type. Those types means following:

Tutorial - explanation of subject in detail, with real vulnerability examples;
Article - explanation of subject in detail, more theoretically-oriented;
Blog post - brief explanation of subject, might include subjective opinion;

All other types should be clear from their names. Sometimes references points directly to downloadable PDF files, those links are in italic.

1.5. About classification

Sometimes it is hard to determine where to put the reference in. It happens because topic can cover multiple items at once. However, references are placed under the category where the author wanted to make attention to. Another thing to take into mind is that OS/Arch are related here only to an exploitation or explanation discussed in topic, not to possible affected systems/software.

2. Exploiting vulnerabilities

2.1. Stack based buffer overflow

CWE-121: Stack-based Buffer Overflow

Nr	URL	Description	Date	Type	OS/Arch	Info
1	http://blogs.securiteam.com/index.php/archives/638	Heap Spraying: Exploiting Internet Explorer VML 0-day	23-09-2006	Tutorial	Windows, x86-32	CVE-2006-4868
2	http://sysc.tl/2009/07/04/cve-2008-3531-exploit/	CVE-2008-3531: FreeBSD kernel stack overflow exploit development	04-07-2009	Article	FreeBSD	CVE-2008-3531
3	http://www.i-hacked.com/freefiles/EasyChat_SEH_exploit_v1.3.pdf	Understanding SEH (Structured Exception Handler) Exploitation	06-07-2009	Article	Windows, x86-32	CVE-2004-2466
4	http://www.corelan.be:8800/index.php/2009/07/19/exploit-writing-tutorial-part-1-stack-based-overflows/	Exploit writing tutorial part 1 : Stack Based Overflows	19-07-2009	Tutorial	Windows, x86-32	EDB-ID-9177
5	http://www.corelan.be:8800/index.php/2009/07/23/writing-buffer-overflow-exploits-a-quick-and-basic-tutorial-part-2/	Exploit writing tutorial part 2 : Stack Based Overflows – jumping to shellcode	23-07-2009	Tutorial	Windows, x86-32	N/A
6	http://www.corelan.be:8800/index.php/2009/07/25/writing-buffer-overflow-exploits-a-quick-and-basic-tutorial-part-3-seh/	Exploit writing tutorial part 3 : SEH Based Exploits	25-07-2009	Tutorial, video	Windows, x86-32	N/A
7	http://www.corelan.be:8800/index.php/2009/07/28/seh-based-exploit-writing-tutorial-continued-just-another-example-part-3b/	Exploit writing tutorial part 3b : SEH Based Exploits – just another example	28-07-2009	Tutorial	Windows, x86-32	EDB-ID-9298
8	http://grey-corner.blogspot.com/2010/01/seh-stack-based-windows-buffer-overflow.html	SEH Stack Based Buffer Overflow Tutorial	07-01-2010	Tutorial	Windows, x86-32	OSVDB-61386
9	http://grey-corner.blogspot.com/2010/01/beginning-stack-based-buffer-overflow.html	Stack Based Buffer Overflow Tutorial	07-01-2010	Tutorial	Windows, x86-32	CVE-2004-2271
10	http://www.phreedom.org/research/vulnerabilities/ani-header/	Windows ANI header buffer overflow	29-03-2010	Article, slides, video	Windows, x86-32	CVE-2007-0038
11	http://www.ethicalhacker.net/content/view/309/2/	Tutorial: SEH Based Exploits and the Development Process	04-05-2010	Tutorial	Windows, x86-32	OSVDB-62779
12	https://docs.google.com/viewer?a=v&pid=explorer&chrome=true&srcid=1tioiVT1jjM-xCzYc-2EPTcATOZ07gUcMshqKf8GHNp47vLvn5yT7wprAUpkb&hl=en	Debugging an SEH 0day	29-05-2010	Tutorial (PDF)	Windows, x86-32	CVE-2010-0688
13	http://www.offensive-security.com/vulndev/evocam-remote-buffer-overflow-on-osx/	Evocam Remote Buffer Overflow on OSX	04-06-2010	Tutorial	Mac OS X (Leopard 10.5.8), x86-32	CVE-2010-2309
14	http://turkeyland.net/projects/overflow/index.php	Buffer Overflows and You	04-08-2010	Article	Linux x86-64	N/A
15	http://www.vupen.com/blog/20100909.Adobe_Acrobat_Reader_0_Day_Exploit_CVE-2010-2883_Technical_Analysis.php	Criminals Are Getting Smarter: Analysis of the Adobe Acrobat / Reader 0-Day Exploit	09-09-2010	Article	Windows, x86-32	CVE-2010-2883
16	http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/	Bypassing UAC with User Privilege under Windows Vista/7 – Mirror	26-11-2010	Article, video	Windows, x86-32	CVE-2010-4398
17	http://www.exploit-db.com/wp-content/themes/exploit/docs/16030.pdf	Non-Executable Stack ARM Exploitation	23-01-2011	Whitepaper	ARM	N/A
18	http://resources.infosecinstitute.com/stack-based-buffer-overflow-tutorial-part-1-%E2%80%94-introduction/	Stack Based Buffer Overflow Tutorial, part 1 — Introduction	09-03-2011	Tutorial	Windows, x86-32	N/A
19	http://resources.infosecinstitute.com/stack-based-buffer-overflow-tutorial-part-2-%E2%80%94-exploiting-the-stack-overflow/	Stack Based Buffer Overflow Tutorial, part 2 — Exploiting the stack overflow	09-03-2011	Tutorial	Windows, x86-32	N/A
20	http://resources.infosecinstitute.com/stack-based-buffer-overflow-tutorial-part-3-%E2%80%94-adding-shellcode/	Stack Based Buffer Overflow Tutorial, part 3 — Adding shellcode	09-03-2011	Tutorial	Windows, x86-32	N/A
21	http://resources.infosecinstitute.com/seh-exploit/	SEH Based Overflow Exploit Tutorial	28-04-2011	Tutorial	Windows, x86-32	N/A
22	http://inseclab.org/papers/smashing_w8_stack.pdf	Smashing the stack in Windows 8	xx-09-2011	Article	Windows 8	N/A
23	http://blogs.securiteam.com/index.php/archives/1558	VMware UDF Stack Buffer Overflow	10-10-2011	Blog	Windows, x86-32	CVE-2011-3868
24	http://www.greyhathacker.net/?p=380	RemoteExec Computers List Buffer Overflow ROP Exploit	06-11-2011	Tutorial	Windows, x86-32	http://secunia.com/advisories/38733/
25	http://www.poppopret.org/?p=40	Anatomy of a SCADA Exploit: Part 1 – From Overflow to EIP	07-01-2012	Tutorial	Windows, x86-32	N/A
26	http://blog.ring0.me/2012/01/wireshark-14x-145-cve-2011-1591.html	Wireshark 1.4.X (< 1.4.5) - CVE-2011-1591 2010.05	12-01-2012	Tutorial	Linux	CVE-2011-1591
27	http://blog.carlosgarciaprado.com/?p=1036	x86-64 Exploitation 101. A comparative primer.	29-04-2012	Tutorial	Linux, x86-64	N/A
28	http://www.greyhathacker.net/?p=549	Heap spraying in Internet Explorer with rop nops	19-06-2012	Tutorial	Windows, x86-32	CVE-2007-6387
29	http://www.poppopret.org/?p=141	Anatomy of a SCADA Exploit: Part 2 – From EIP to Shell	21-08-2012	Tutorial	Windows, x86-32	N/A
30	https://community.rapid7.com/community/metasploit/blog/2012/09/06/cve-2012-2611-the-walk-to-the-shell	New Metapsloit Exploit: SAP NetWeaver CVE-2012-2611	06-09-2012	Blog post	Windows, x86-32	CVE-2012-2611
31	http://www.devttys0.com/2012/10/exploiting-a-mips-stack-overflow/	Exploiting a MIPS Stack Overflow	08-10-2012	Article	MIPS	N/A
32	http://shar33f12.blogspot.com.es/2012/10/rop.html	ROP	01-11-2012	Tutorial	Linux, x86-32	N/A
33	http://www.exploit-db.com/papers/24085/	Stack Smashing On A Modern Linux System	21-12-2012	Article	Linux, x86-64	N/A
34	http://www.floyd.ch/?p=629	Automated generation of code alignment code for Unicode buffer overflow exploitation	17-01-2012	Tutorial	Windows, x86-32	N/A
35	http://www.exploit-db.com/wp-content/themes/exploit/docs/27657.pdf	Smashing the stack, an example from 2013	17-08-2013	Article	Linux	N/A
36	http://csmatt.com/notes/?p=96	MIPS Buffer Overflows with Bowcaster	13-10-2013	Tutorial	MIPS	N/A
37	http://funoverip.net/2013/10/watchguard-cve-2013-6021-stack-based-buffer-overflow-exploit/	WatchGuard – CVE-2013-6021 – Stack Based Buffer Overflow Exploit	27-10-2013	Article	Linux	CVE-2013-6021
38	http://dl.packetstormsecurity.net/papers/attack/64bit-overflow.pdf	64 Bits Linux Stack Based Buffer Overflow	09-06-2014	Article	Linux	N/A

2.2. Heap based buffer overflow

CWE-122: Heap-based Buffer Overflow Heap OOB reads and writes also falls into this category.

Nr	URL	Description	Date	Type	OS/Arch	Info
1	http://immunitysec.com/resources-papers.shtml (part 1) (part 2)	Exploiting the MSRPC Heap Overflow	11-09-2003	Tutorial (PDF)	Windows, x86-32	CVE-2003-0352
2	http://lists.virus.org/darklab-0402/msg00000.html	Windows Heap Overflow Exploitation	02-02-2004	Article	Windows, x86-32	N/A
3	http://www.exploit-db.com/papers/13178/	Windows Heap Overflows using the Process Environment Block (PEB)	31-05-2006	Article	Windows, x86-32	N/A
4	http://www.h-online.com/security/features/A-Heap-of-Risk-747161.html	A heap of risk: Buffer overflows on the heap and how they are exploited	28-06-2006	Article	Windows, x86-32	N/A
5	http://securityevaluators.com/files/papers/isewoot08.pdf	Engineering Heap Overﬂow Exploits with JavaScript	08-09-2008	Article (PDF)	-	N/A
6	http://www.blackhat.com/presentations/bh-usa-09/MCDONALD/BHUSA09-McDonald-WindowsHeap-PAPER.pdf	Practical Windows XP/2003 Heap Exploitation	xx-07-09	Article (PDF)	Windows, x86-32	N/A
7	http://crazylazy.info/blog/?q=print/content/0x41-weekly-exploitation-matters-heap-overflow-fundamentals	0x41 - weekly exploitation matters - Heap overflow fundamentals	23-03-2010	Tutorial	Windows, x86-32	CVE-2009-4324
8	http://grey-corner.blogspot.com/2010/03/difference-between-heap-overflow-and.html	The Difference Between Heap Overflow and Use After Free Vulnerabilities	31-03-2010	Article	-	N/A
9	http://blogs.cisco.com/security/comments/exploring_heap-based_buffer_overflows_with_the_application_verifier/	Exploring Heap-Based Buffer Overflows with the Application Verifier	29-03-2010	Article	Windows, x86-32	N/A
10	http://blogs.iss.net/archive/RequiredReading.html	Heap Cache Exploitation - White Paper by IBM Internet Security Systems	xx-07-2010	Article	Windows, x86-32	N/A
11	https://net-ninja.net/blog/?p=293	Heap Overflows For Humans – 101	24-10-2010	Article	Windows, x86-32	N/A
12	http://www.breakingpointsystems.com/community/blog/ie-vulnerability/	When A DoS Isn't A DoS	16-12-2010	Tutorial	Windows, x86-32	OSVDB-69796
13	http://www.vupen.com/blog/20101221.Exim_string_vformat_Remote_Overflow_Analysis_CVE-2010-4344.php	Technical Analysis of Exim "string_vformat()" Buffer Overflow Vulnerability	21-12-2010	Article	Linux x86-32	CVE-2010-4344
14	http://www.breakingpointsystems.com/community/blog/microsoft-vulnerability-proof-of-concept/	From Patch to Proof-of-Concept: MS10-081	10-01-2011	Tutorial	Windows, x86-32	CVE-2010-2746
15	http://vreugdenhilresearch.nl/ms11-002-pwn2own-heap-overflow/	MS11-002 Pwn2Own heap overflow	12-01-2011	Blog post, Article (PDF)	Windows, x86-32	CVE-2011-0027
16	http://www.skullsecurity.org/blog/2011/a-deeper-look-at-ms11-058	A deeper look at ms11-058	23-08-2011	Article	Windows, x86-32	CVE-2011-1966
17	https://net-ninja.net/blog/?p=674	Heap Overflows For Humans – 102	02-09-2011	Article	Windows, x86-32	N/A
18	http://net-ninja.net/blog/?p=952	Heap Overflows For Humans 102.5	28-12-2011	Article	Windows, x86-32	N/A
19	http://net-ninja.net/blog/?p=1034	Heap Overflows For Humans 103	04-01-2012	Article	Windows, x86-32	N/A
20	http://net-ninja.net/blog/?p=1260	Heap Overflows For Humans 103.5	13-01-2012	Article	Windows, x86-32	N/A
21	http://www.vupen.com/blog/20120117.Advanced_Exploitation_of_Windows_MS12-004_CVE-2012-0003.php	Analysis & Advanced Exploitation of Windows Multimedia Library Heap Overflow (MS12-004)	17-01-2012	Article	Windows, x86-32	CVE-2012-0003
22	https://net-ninja.net/article/2012/Mar/1/heap-overflows-for-humans-104/	Heap Overflows For Humans 104	11-03-2012	Article	Windows, x86-32	N/A
23	http://www.vupen.com/blog/20120710.Advanced_Exploitation_of_Internet_Explorer_HeapOv_CVE-2012-1876.php	Advanced Exploitation of Internet Explorer Heap Overflow (Pwn2Own 2012 Exploit)	10-07-2012	Article	Windows, x86-32	CVE-2012-1876
24	https://community.rapid7.com/community/metasploit/blog/2012/12/19/new-metasploit-exploit-crystal-reports-viewer-cve-2010-2590	New Metasploit Exploit: Crystal Reports Viewer CVE-2010-2590	19-12-2012	Article	Windows, x86-32	CVE-2010-2590
25	http://blog.stalkr.net/2013/06/golang-heap-corruption-during-garbage.html	Golang heap corruption during garbage collection	04-06-2013	Blogpost	Linux	N/A
26	https://www.corelan.be/index.php/2013/07/02/root-cause-analysis-integer-overflows/	Root Cause Analysis – Integer Overflows	02-07-2013	Tutorial	Windows, x86-32	N/A
27	http://doar-e.github.io/blog/2013/09/09/pinpointing-heap-related-issues-ollydbg2-off-by-one-story/	Pinpointing Heap-related Issues: OllyDbg2 Off-by-one Story	09-09-2013	Blogpost	Windows	N/A
28	http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Technical-Analysis-of-CVE-2014-1761-RTF-Vulnerability/ba-p/6440048#.U0MYW_ldV8F	Technical Analysis of CVE-2014-1761 RTF Vulnerability	07-04-2014	Article	Windows	CVE-2014-1761
29	http://radare.today/technical-analysis-of-the-gnutls-hello-vulnerability/	Technical Analysis Of The GnuTLS Hello Vulnerability	01-06-2014	Blogpost	Linux	CVE-2014-3466
30	http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/ZDI-14-173-CVE-2014-0195-OpenSSL-DTLS-Fragment-Out-of-Bounds/ba-p/6501002	ZDI-14-173/CVE-2014-0195 - OpenSSL DTLS Fragment Out-of-Bounds Write: Breaking up is hard to do	05-06-2014	Blogpost	Linux	CVE-2014-0195
31	http://www.vupen.com/blog/20140725.Advanced_Exploitation_VirtualBox_VM_Escape.php	Advanced Exploitation of VirtualBox 3D Acceleration VM Escape Vulnerability (CVE-2014-0983)	25-07-2014	Blogpost	Windows	CVE-2014-0983

2.3. Data type issues

CWE-682: Incorrect Calculation, CWE-704: Incorrect Type Conversion or Cast

Nr	URL	Description	Date	Type	Info
1	http://blogs.msdn.com/b/oldnewthing/archive/2004/01/29/64389.aspx	Integer overflow in the new operator	01-29-2004	Article	N/A
2	http://www.fefe.de/intof.html	Catching Integer Overflows in C	01-26-2007	Article	N/A
3	http://dividead.wordpress.com/2009/06/01/glibc-timezone-integer-overflow/	glibc timezone integer overflow	01-06-2009	Blogpost	N/A
4	https://code.google.com/p/em386/downloads/detail?name=CVE-2009-3608-explained.txt&can=2&q=	CVE-2009-3608-explained	01-10-2009	Write-up	CVE-2009-3608
5	http://projects.webappsec.org/Integer-Overflows	Integer Overflows	xx-01-2010	Article	N/A
6	http://www.nodefense.org/eglibc.txt	A delicious, yet slightly cold banquette prepared on the (jump)table	xx-03-2010 (?)	Note	N/A
7	https://www.securecoding.cert.org/confluence/display/seccode/INT32-C.+Ensure+that+operations+on+signed+integers+do+not+result+in+overflow	INT32-C. Ensure that operations on signed integers do not result in overflow	09-09-2010	Article	N/A
8	http://rcvalle.com/post/14169476482/exploiting-glibc-tzfile-read-integer-overflow-to	Exploiting glibc tzfile_read integer overflow to buffer overflow and vsftpd	13-12-2011	Blog post	CVE-2009-5029
9	http://rcvalle.com/post/14261796328/more-on-exploiting-glibc-tzfile-read-integer-overflow	More on exploiting glibc tzfile_read integer overflow to buffer overflow and vsftpd	15-12-2011	Blog post	CVE-2009-5029
10	http://kqueue.org/blog/2012/01/10/cve-2012-0038-xfs-acl-count-integer-overflow/	CVE-2012-0038: XFS ACL count integer overflow	10-01-2012	Blogpost	CVE-2012-0038
11	http://kqueue.org/blog/2012/04/12/cve-2012-2100-a-fix-to-fix-a-fix-in-ext4/	CVE-2012-2100: a fix to fix a fix in ext4	12-04-2012	Blogpost	CVE-2012-2100
12	http://gdtr.wordpress.com/2012/02/22/exploiting-cve-2011-2371-without-non-aslr-modules/	Exploiting CVE-2011-2371 (FF reduceRight) without non-ASLR modules	22-02-2012	Article	CVE-2011-2371
13	http://labs.mwrinfosecurity.com/blog/2013/04/19/mwr-labs-pwn2own-2013-write-up---webkit-exploit/	MWR Labs Pwn2Own 2013 Write-up - Webkit Exploit	19-04-2013	Article	CVE-2013-0912
14	http://www.vupen.com/blog/20130522.Advanced_Exploitation_of_IE10_Windows8_Pwn2Own_2013.php	Advanced Exploitation of Internet Explorer 10 / Windows 8 Overflow (Pwn2Own 2013)	22-05-2013	Article	CVE-2013-2551
15	http://secunia.com/blog/in-memory-of-a-zero-day--ms13-051-385/	In memory of a zero-day – MS13-051	01-11-2013	Blogpost	CVE-2013-1331
16	https://www.blackhat.com/docs/us-14/materials/us-14-Rosenberg-Reflections-On-Trusting-TrustZone-WP.pdf	QSEE TrustZone Kernel Integer Overflow Vulnerability	01-07-2014	Article	N/A

2.4. Format string injection

CWE-134: Uncontrolled Format String

Nr	URL	Description	Date	Type	Info
1	https://docs.google.com/viewer?a=v&pid=explorer&chrome=true&srcid=0B64ViR5GhSKIYWFmODIyY2UtMGNjOS00MGIyLWFhZDAtNWVmNjFlMjJhZjg2&hl=en	Windows 2000 Format String Vulnerabilities	01-05-2001	Article (PDF)	N/A
2	http://crypto.stanford.edu/cs155old/cs155-spring08/papers/formatstring-1.2.pdf	Exploiting Format String Vulnerabilities	01-09-2001	Article (PDF)	N/A
3	http://www.abysssec.com/blog/2009/02/format-string-exploitation-on-windows/	Format string exploitation on windows	02-02-2009	Article (PDF)	N/A
4	http://infond.blogspot.com/2010/07/tutorial-exploitation-format-string.html	Tutorial exploitation format string	30-07-2010	Article	N/A
5	https://docs.google.com/viewer?a=v&pid=explorer&chrome=true&srcid=1kS09rUfzbUduLk6GLj16J3FsKoHRZDE84vAXxw_1G5T_hV2-1Chq6k9LYkV5&hl=en	Format strings, from %x to calc	24-10-2010	Article (PDF)	N/A
6	http://www.exploit-monday.com/2011/06/leveraging-format-string.html	Leveraging format string vulnerabilities to interrogate Win32 process memory	20-06-2011	Article	N/A
7	http://www.viva64.com/en/b/0129/	Wade not in unknown waters. Part two	01-02-2012	Article	N/A
8	http://www.vnsecurity.net/2012/02/exploiting-sudo-format-string-vunerability/	Exploiting Sudo format string vunerability	16-02-2012	Article	CVE-2012-0809
9	http://blog.exodusintel.com/2012/08/29/when-wrapping-it-up-goes-wrong/	EIP-2012-0001: When wrapping it up goes wrong…	29-08-2012	Article	N/A

2.5. Pointer issues

CWE-465: Pointer Issues, CWE-415: Double Free, CWE-476: NULL Pointer Dereference

Nr	URL	Description	Date	Type	OS/Arch	Info
1	http://www.symantec.com/ (part 1) (part 2)	Double Free Vulnerabilities	19/22-01-2007	Article	Windows XP SP2, x86-32	N/A
2	http://www.theregister.co.uk/2007/06/13/null_exploit_interview/	Embedded problems: exploiting NULL pointer dereferences	13-06-2007	Interview	ARM, XScale	N/A
3	https://www.blackhat.com/presentations/bh-usa-07/Afek/Whitepaper/bh-usa-07-afek-WP.pdf	Dangling Pointer - Smashing the Pointer for Fun and Profit	02-07-2007	Article	Windows, x32	CVE-2005-4360
4	http://searchsecurity.techtarget.com.au/news/2240019328/QA-Mark-Dowd-on-NULL-pointer-dereference-bugs	Q&A: Mark Dowd on NULL pointer dereference bugs	02-05-2008	Transcript	-	N/A
5	http://blogs.iss.net/archive/cve-2008-0017.html	What You May Have Missed About CVE-2008-0017: A Firefox NULL Dereference Bug	26-11-2008	Article	Windows, x86-32	CVE-2008-0017
6	http://blog.ksplice.com/2010/04/exploiting-kernel-null-dereferences/	Much ado about NULL: Exploiting a kernel NULL dereference	13-04-2010	Article	Linux, x86	N/A
7	http://www.vupen.com/blog/20101018.Stuxnet_Win32k_Windows_Kernel_0Day_Exploit_CVE-2010-2743.php	Technical Analysis of the Windows Win32K.sys Keyboard Layout Stuxnet Exploit	18-10-2010	Article	Windows, x86-32	CVE-2010-2743
8	http://grey-corner.blogspot.com/2010/01/heap-spray-exploit-tutorial-internet.html	Heap Spray Exploit Tutorial: Internet Explorer Use After Free Aurora Vulnerability	24-01-2010	Tutorial	Windows, x86-32	CVE-2010-0249
9	http://d0cs4vage.blogspot.com/2011/06/insecticides-dont-kill-bugs-patch.html	Insecticides don't kill bugs, Patch Tuesdays do (use-after-free)	16-06-2011	Article	Windows, x86-32	CVE-2011-1260
10	http://www.exploit-monday.com/2011/07/post-mortem-analysis-of-use-after-free_07.html	Post-mortem Analysis of a Use-After-Free Vulnerability (CVE-2011-1260)	07-07-2011	Article	Windows, x86-32	CVE-2011-1260
11	http://j00ru.vexillium.org/?p=893	CVE-2011-1281: A story of a Windows CSRSS Privilege Escalation vulnerability	12-07-2011	Article	Windows, x86-32	CVE-2011-1281
12	http://j00ru.vexillium.org/?p=932	CVE-2011-1282: User-Mode NULL Pointer Dereference & co.	21-07-2011	Article	Windows, x86-32	CVE-2011-1282
13	http://blogs.norman.com/2011/malware-detection-team/drag-and-drop-vulnerability-in-ms11-050	Drag and Drop Vulnerability in MS11-050	29-07-2011	Article	Windows, x32	CVE-2011-1254
14	http://picturoku.blogspot.com/2011/08/diaries-of-vulnerability.html	Diaries of a vulnerability: Understanding CVE-2011-1260	17-08-2011	Article	Windows, x86-32	CVE-2011-1260
15	http://picturoku.blogspot.com/2011/09/diaries-of-vulnerability-take-2.html	Diaries of a vulnerability - take 2: Stage 1 exploit - Controlling EIP	01-09-2011	Article	Windows, x86-32	CVE-2011-1260
16	http://picturoku.blogspot.com/2011/11/diaries-of-vulnerability-take-3.html	Diaries of a vulnerability - take 3: Pray after free and use after pray	02-11-2011	Article	Windows, x86-32	CVE-2011-1260
17	https://community.qualys.com/blogs/securitylabs/2011/12/02/ms11-077-from-patch-to-proof-of-concept	MS11-077: From Patch to Proof-of-Concept	02-12-2011	Article	Windows, x86-32	CVE-2011-1985
18	http://www.vupen.com/blog/20120116.Advanced_Exploitation_of_ProFTPD_Remote_Use_after_free_CVE-2011-4130_Part_II.php	Advanced Exploitation of ProFTPD Response Pool Use-after-free (CVE-2011-4130) - Part II	16-01-2012	Article	Linux, x86-32	CVE-2011-4130
19	http://ifsec.blogspot.com/2012/02/reliable-windows-7-exploitation-case.html (PoC)	Reliable Windows 7 Exploitation: A Case Study	28-02-2012	Article	Windows, x86-32	CVE-2011-1999
20	http://dvlabs.tippingpoint.com/blog/2012/03/15/pwn2own-2012-challenge-writeup	Pwn2Own Challenges: Heapsprays are for the 99%	15-03-2012	Article	Windows, x86-32	CVE-2010-0248
21	http://www.vupen.com/blog/20120625.Advanced_Exploitation_of_Mozilla_Firefox_UaF_CVE-2012-0469.php	Advanced Exploitation of Mozilla Firefox Use-after-free Vulnerability (MFSA 2012-22)	25-06-2012	Article	Windows, x86-32	CVE-2012-0469
22	http://blog.exodusintel.com/2013/01/02/happy-new-year-analysis-of-cve-2012-4792/	Happy New Year Analysis of CVE-2012-4792	02-01-2013	Article	Windows, x86-32	CVE-2012-4792
23	https://www-304.ibm.com/connections/blogs/xforce/entry/use_after_frees_that_pointer_may_be_pointing_to_something_bad?lang=en_us	Use-after-frees: That pointer may be pointing to something bad	01-04-2013	Blogpost	Windows, x86-32	CVE-2012-4969,CVE-2012-4792
24	http://blog.trailofbits.com/2013/05/20/writing-exploits-with-the-elderwood-kit-part-2/	Writing Exploits with the Elderwood Kit (Part 2)	20-05-2013	Article	Windows	N/A
25	http://blogs.technet.com/b/srd/archive/2013/08/06/the-story-of-ms13-002-how-incorrectly-casting-fat-pointers-can-make-your-code-explode.aspx	The story of MS13-002: How incorrectly casting fat pointers can make your code explode	06-08-2013	Blogpost	-	N/A
26	http://h30499.www3.hp.com/t5/blogs/blogarticleprintpage/blog-id/off-by-on-software-security-blog/article-id/97	CVE-2013-3112: From NULL to Control - Persistence pays off with crashes	26-09-2013	Article	Windows, x86-32	CVE-2013-3112
27	http://cyvera.com/cve-2013-3893-analysis-of-the-new-ie-0-day/	CVE-2013-3893 – ANALYSIS OF THE NEW IE 0-DAY	07-10-2013	Article	Windows, x86-32	CVE-2013-3893
28	http://cyvera.com/cve-2013-3897-analysis-of-yet-another-ie-0-day/	CVE-2013-3897 – ANALYSIS OF YET ANOTHER IE 0-DAY	08-10-2013	Article	Windows, x86-32	CVE-2013-3897
29	http://blog.spiderlabs.com/2013/10/another-day-another-ie-zero-day.html	Another Day, SpiderLabs Discovers Another IE Zero-Day	08-2013	Article	Windows, x86-32	CVE-2013-3897
30	http://blog.spiderlabs.com/2013/10/ie-zero-day-cve-2013-3897-technical-aspects.html	The Technical Aspects of Exploiting IE Zero-Day CVE-2013-3897	10-2013	Article	Windows, x86-32	CVE-2013-3897
31	http://nakedsecurity.sophos.com/2013/10/11/anatomy-of-an-exploit-ie-zero-day-part-1/	Anatomy of an exploit - inside the CVE-2013-3893 Internet Explorer zero-day - Part 1	11-10-2013	Article	Windows, x86-32	CVE-2013-3893
32	http://nakedsecurity.sophos.com/2013/10/25/anatomy-of-an-exploit-inside-the-cve-2013-3893-internet-explorer-zero-day-part-2/	Anatomy of an exploit - inside the CVE-2013-3893 Internet Explorer zero-day - Part 2	25-10-2013	Article	Windows, x86-32	CVE-2013-3893
33	http://blog.exodusintel.com/2013/11/26/browser-weakest-byte/	A browser is only as strong as its weakest byte	26-11-2013	Article	Windows	CVE-2013-3147
34	http://blog.exodusintel.com/2013/12/09/a-browser-is-only-as-strong-as-its-weakest-byte-part-2/	A browser is only as strong as its weakest byte - Part 2	09-12-2013	Article	Windows	CVE-2013-3147
35	http://blog.spiderlabs.com/2014/03/deep-analysis-of-cve-2014-0502-a-double-free-story.html	Deep Analysis of CVE-2014-0502 – A Double Free Story	12-03-2014	Blogpost	Windows	CVE-2014-0502
36	http://carterjones.logdown.com/posts/2014/03/14/cve-2014-0301-analysis	CVE-2014-0301 Analysis	14-03-2014	Blogpost	Windows	CVE-2014-0301
37	http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Double-Dip-Using-the-latest-IE-0-day-to-get-RCE-and-an-ASLR/ba-p/6466280	Double-Dip: Using the latest IE 0-day to get RCE and an ASLR Bypass	06-05-2014	Blogpost	Windows	N/A
38	http://www.vupen.com/blog/20140520.Advanced_Exploitation_Firefox_UaF_Pwn2Own_2014.php	Advanced Exploitation of Mozilla Firefox Use-After-Free Vulnerability (Pwn2Own 2014)	20-05-2014	Blogpost	Windows	CVE-2014-1512

2.6. Uninitialized memory

Nr	URL	Description	Date	Type	OS/Arch	Info
1	http://www.vupen.com/blog/20120717.Advanced_Exploitation_of_Internet_Explorer_XML_CVE-2012-1889_MS12-043.php	Advanced Exploitation of IE MSXML Remote Uninitialized Memory (MS12-043 / CVE-2012-1889)	17-07-2012	Article	Windows, x86-32	CVE-2012-1889
2	http://immunityproducts.blogspot.de/2013/06/adobe-xfa-exploits-for-all-first-part.html	Adobe XFA exploits for all! First Part: The Info-leak	24-06-2013	Article	Windows 7	CVE-2013-0640
3	http://labs.portcullis.co.uk/blog/cve-2013-0640-adobe-reader-xfa-oneofchild-un-initialized-memory-vulnerability-part-1/	CVE-2013-0640: Adobe Reader XFA oneOfChild Un-initialized memory vulnerability (part 1)	26-09-2013	Article	Windows	CVE-2013-0640
4	http://labs.portcullis.co.uk/blog/cve-2013-0640-adobe-reader-xfa-oneofchild-un-initialized-memory-vulnerability-part-2/	CVE-2013-0640: Adobe Reader XFA oneOfChild Un-initialized memory vulnerability (part 2)	15-10-2013	Article	Windows	CVE-2013-0640
5	http://ifsec.blogspot.de/2013/11/exploiting-internet-explorer-11-64-bit.html	Exploiting Internet Explorer 11 64-bit on Windows 8.1 Preview	06-11-2013	Article	Windows 8, x86-64	N/A

2.7. Kernel vulnerabilities

Nr	URL	Description	Date	Type	OS/Arch	Info
1	http://isec.pl/papers/linux_kernel_do_brk.pdf	Linux Kernel do_brk() Vulnerability	04-12-2003	Article	Linux	CAN-2003-0961
2	http://home.bn-paf.de/sebastian.haase/kmalloc_exploitation.pdf	The story of exploiting kmalloc() overflows	20-09-2005	Article	Linux	N/A
3	http://jon.oberheide.org/blog/2010/09/10/linux-kernel-can-slub-overflow/	Linux Kernel CAN SLUB Overflow	27-11-2010	Article	Linux	CVE-2010-2959
4	http://jon.oberheide.org/blog/2010/11/29/exploiting-stack-overflows-in-the-linux-kernel/	Exploiting Stack Overflows in the Linux Kernel	29-11-2010	Article	Linux	N/A
5	http://esec-lab.sogeti.com/post/Analysis-of-the-jailbreakme-v3-font-exploit	Analysis of the jailbreakme v3 font exploit	18-07-2011	Article	iOS	CVE-2011-0226,CVE-2011-0227
6	https://media.blackhat.com/bh-us-11/Esser/BH_US_11_Esser_Exploiting_The_iOS_Kernel_WP.pdf	Exploiting the iOS Kernel	13-07-2011	Article	iOS	N/A
7	http://blog.coresecurity.com/2011/08/24/looking-behind-the-curtain-making-exploits-work-like-they-do-in-the-movies/	Looking behind the curtain: Making exploits work like they do in the movies...	24-08-2011	Article	Windows, x32	CVE-2011-1283
8	http://census-labs.com/news/2012/01/03/linux-kernel-heap-exploitation/	The Linux kernel memory allocators from an exploitation perspective	03-01-2012	Article	Linux	N/A
9	http://vsecurity.com/download/papers/slob-exploitation.pdf	A Heap of Trouble: Breaking the Linux Kernel SLOB Allocator	22-01-2012	Article	Linux	N/A
10	http://mista.nu/blog/2012/02/17/cve-2012-0148-a-deep-dive-into-afd/	CVE-2012-0148: A Deep Dive Into AFD	17-02-2012	Article	Windows 7, x86-64	CVE-2012-0148
11	http://j00ru.vexillium.org/blog/20_05_12/cve_2011_2018.pdf	The story of CVE-2011-2018 exploitation	xx-04-2012	Article	Windows, x86-32	CVE-2011-2018
12	http://blog.coresecurity.com/2012/05/10/the-big-trick-behind-exploit-ms12-034/	THE BIG TRICK BEHIND EXPLOIT MS12-034	10-05-2012	Article	Windows, x86-32	CVE-2010-2743
13	http://fail0verflow.com/blog/2012/cve-2012-0217-intel-sysret-freebsd.html#Xdblfault	CVE-2012-0217: Intel's sysret Kernel Privilege Escalation (on FreeBSD)	05-07-2012	Tutorial	FreeBSD	CVE-2012-0217
14	http://www.vupen.com/blog/20120806.Advanced_Exploitation_of_Windows_Kernel_x64_Sysret_EoP_MS12-042_CVE-2012-0217.php	Advanced Exploitation of Windows Kernel Intel 64-Bit Mode Sysret Vulnerability (MS12-042)	06-08-2012	Article	Windows	CVE-2012-0217
15	http://www.vupen.com/blog/20120904.Advanced_Exploitation_of_Xen_Sysret_VM_Escape_CVE-2012-0217.php	Advanced Exploitation of Xen Hypervisor Sysret VM Escape Vulnerability	04-09-2012	Article	-	CVE-2012-0217
16	http://j00ru.vexillium.org/?p=1272	Introducing the USB Stick of Death	21-10-2012	Article	Windows, x86-64	N/A
17	http://blog.ptsecurity.com/2013/03/stars-aligners-how-to-kernel-pool.html	Stars aligner’s how-to: kernel pool spraying and VMware CVE-2013-1406	06-03-2013	Article	Windows	CVE-2013-1406
18	http://blog.coresecurity.com/2013/04/01/ms13-017-the-harmless-silent-patch/	MS13-017 – THE HARMLESS SILENT PATCH…	01-04-2013	Blogpost	Windows	N/A
19	http://seclists.org/fulldisclosure/2013/May/91	exploitation ideas under memory pressure	17-05-2013	Post	Windows	CVE-2013-3130
20	https://labs.mwrinfosecurity.com/blog/2013/09/06/mwr-labs-pwn2own-2013-write-up---kernel-exploit/	MWR Labs Pwn2Own 2013 Write-up - Kernel Exploit	06-09-2013	Article	Windows 7, x86-32	CVE-2013-1300
21	http://www.cyvera.com/the-case-for-smep-exploiting-a-kernel-vulnerability/	THE CASE FOR SMEP – EXPLOITING A KERNEL VULNERABILITY	20-09-2013	Article	Windowx XP, x86-32	N/A
22	http://endgame.com/news/microsoft-win32k-null-page-vulnerability-technical-analysis.html	Microsoft Win32k NULL Page Vulnerability Technical Analysis	xx-10-2013	Article	Windows 7	CVE-2013-3881
23	http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Verifying-Windows-Kernel-Vulnerabilities/ba-p/6252649	Verifying Windows Kernel Vulnerabilities	30-10-2013	Article	Windows	N/A
24	http://immunityproducts.blogspot.de/2013/11/exploiting-cve-2013-3881-win32k-null.html	Exploiting CVE-2013-3881: A Win32k NULL Page Vulnerability	04-11-2013	Article	Windows 7	CVE-2013-3881
25	http://labs.portcullis.co.uk/blog/cve-2013-5065-ndproxy-array-indexing-error-unpatched-vulnerability/	CVE-2013-5065: NDProxy array indexing error unpatched vulnerability	06-12-2013	Article	Windows XP SP3	CVE-2013-5065
26	http://blog.spiderlabs.com/2013/12/the-kernel-is-calling-a-zeroday-pointer-cve-2013-5065-ring-ring.html	The Kernel is calling a zero(day) pointer – CVE-2013-5065 – Ring Ring	11-12-2013	Article	Windows XP SP3	CVE-2013-5065
27	http://resources.infosecinstitute.com/exploiting-linux-kernel-heap-corruptions-slub-allocator/	Exploiting Linux Kernel Heap Corruptions (SLUB Allocator)	19-11-2013	Tutorial	Linux	N/A
28	http://poppopret.org/2013/11/20/csaw-ctf-2013-kernel-exploitation-challenge/	CSAW CTF 2013 Kernel Exploitation Challenge	20-11-2013	Tutorial	Linux	N/A
29	http://blog.includesecurity.com/2014/03/exploit-CVE-2014-0038-x32-recvmmsg-kernel-vulnerablity.html	How to exploit the x32 recvmmsg() kernel vulnerability CVE 2014-0038	06-03-2014	Article	Linux	CVE-2014-0038
30	http://doar-e.github.io/blog/2014/03/11/first-dip-into-the-kernel-pool-ms10-058/	First Dip Into the Kernel Pool : MS10-058	11-03-2014	Article	Windows	CVE-2010-1893
31	http://winocm.com/technical/2014/05/30/disarming-the-ios-kernel/	DisARMing the iOS kernel	30-05-2014	Blogpost	iOS	CVE-2010-1320
32	http://blog.includesecurity.com/2014/06/exploit-walkthrough-cve-2014-0196-pty-kernel-race-condition.html	Exploiting CVE-2014-0196 a walk-through of the Linux pty race condition PoC	03-06-2014	Blogpost	CVE-2010-0196
33	https://hackerone.com/reports/13388	Linux PI futex self-requeue bug	19-06-2014	Note	Linux	CVE-2014-3153
34	http://tinyhack.com/2014/07/07/exploiting-the-futex-bug-and-uncovering-towelroot/	Exploiting the Futex Bug and uncovering Towelroot	07-07-2014	Blogpost	Linux	CVE-2014-3153
35	http://www.siberas.de/papers/Pwn2Own_2014_AFD.sys_privilege_escalation.pdf	Pwn2Own 2014 - AFD.SYS DANGLING POINTER VULNERABILITY	11-07-2014	Article	Windows	CVE-2014-1767
36	http://hashcrack.org/page?n=21072014	CVE-2014-4699: Linux Kernel ptrace/sysret vulnerability analysis	21-07-2014	Blogpost	Linux	CVE-2014-4699

2.8. No memory corruption bugs

This section includes different kinds of vulnerabilities that do not involve memory corruption, but still leads to system compromise and are not purely web-application specific bugs.

Nr	URL	Description	Date	Type	OS/Arch	Info
1	http://blog.zx2c4.com/749	Linux Local Privilege Escalation via SUID /proc/pid/mem Write	21-01-2012	Article	Linux	CVE-2012-0056
2	http://blog.chromium.org/2012/06/tale-of-two-pwnies-part-2.html	A Tale Of Two Pwnies (Part 2)	11-06-2012	Article	-	CVE-2011-3063,CVE-2011-3054,CVE-2011-3072 ,CVE-2011-3084
3	http://www.saurik.com/id/17	Exploit (& Fix) Android "Master Key"	xx-07-2013	Article	Android	CVE-2013-4787
4	https://viaforensics.com/mobile-security/chained-vulnerabilities-firefox-android-pimp-browser.html	How I met Firefox: A tale about chained vulnerabilities	02-10-2013	Article	Android	N/A
5	http://www.contextis.com/research/blog/Expressing_Yourself_Analysis_Dot_Net_Elevation_Pri/	EXPRESSING YOURSELF: ANALYSIS OF A DOT NET ELEVATION OF PRIVILEGE VULNERABILITY	xx-12-2013	Article	Windows	CVE-2013-3133

2.9. Other issues

Can be different chained bugs or not belonging to any other section.

Nr	URL	Description	Date	Type	OS/Arch	Info
1	http://blog.chromium.org/2012/05/tale-of-two-pwnies-part-1.html	A Tale of Two Pwnies (Part 1)	22-05-2012	Article	-	CVE-2011-3047, CVE-2011-3063, CVE-2011-3055
2	http://blog.exodusintel.com/2013/01/07/who-was-phone/	DoS? Then Who Was Phone?	07-01-2013	Article	Linux	CVE-2012-5976

3. Mitigations and other obstacles

3.1. Resolving character and other issues

Nr	URL	Description	Date	Type	OS/Arch	Info
1	http://www.corelan.be:8800/index.php/2009/11/06/exploit-writing-tutorial-part-7-unicode-from-0x00410041-to-calc/	Exploit writing tutorial part 7 : Unicode – from 0×00410041 to calc	06-11-2009	Tutorial	Windows, x86-32	OSVDB-66912
2	http://grey-corner.blogspot.com/2010/01/windows-buffer-overflow-tutorial.html	Windows Buffer Overflow Tutorial: Dealing with Character Translation	17-01-2010	Tutorial	Windows, x86-32	OSVDB-59772
3	http://www.abysssec.com/blog/2010/03/ken-ward-zipper-stack-bof-0day-a-not-so-typical-seh-exploit/	Ken Ward Zipper Stack BOF 0day – a not so typical SEH exploit	18-03-2010	Tutorial	Windows, x86-32	OSVDB-63125
4	http://www.corelan.be:8800/index.php/2010/03/27/exploiting-ken-ward-zipper-taking-advantage-of-payload-conversion/	Exploiting Ken Ward Zipper : Taking advantage of payload conversion	27-03-2010	Tutorial	Windows, x86-32	N/A
5	http://www.corelan.be:8800/index.php/2010/03/27/quickzip-stack-bof-0day-a-box-of-chocolates/	QuickZip Stack BOF 0day: a box of chocolates (2 parts)	27-03-2010	Tutorial	Windows, x86-32	N/A
6	https://docs.google.com/viewer?a=v&pid=explorer&chrome=true&srcid=1U1cGztE8e08ALZuGjSFRemHW5dhZ01YT1ab-ShCKOd5E82X62T82l7eQt2fb&hl=en	Unicode, the magic of exploiting 0×00410041	29-05-2010	Tutorial (PDF)	Windows, x86-32	CVE-2009-2225
7	http://www.exploit-db.com/winamp-5-58-from-dos-to-code-execution/	Winamp 5.58 from Denial of Service to Code Execution	20-10-2010	Tutorial	Windows, x86-32	OSVDB-68645
8	http://www.exploit-db.com/winamp-exploit-part-2/	Winamp 5.58 from Denial of Service to Code Execution Part 2	02-11-2010	Tutorial	Windows, x86-32	OSVDB-68645
9	https://www.corelan.be/index.php/2011/07/27/metasploit-bounty-the-good-the-bad-and-the-ugly/	Metasploit Bounty – the Good, the Bad and the Ugly	27-07-2011	Tutorial	Windows, x86-32	OSVDB-72817

3.2. Overcoming mitigations

Nr	URL	Description	Date	Type	OS/Arch	Info
1	http://www.symantec.com/connect/articles/new-way-bypass-windows-heap-protections	A new way to bypass Windows heap protections	31-08-2005	Article	Windows XP SP2, x86-32	N/A
2	https://docs.google.com/viewer?a=v&pid=explorer&chrome=true&srcid=0B64ViR5GhSKINDcxZGM1YTItM2U0Ni00ZGZlLWFhNDgtZmY4YjE2Y2I1Y2Rk&hl=en	x86-64 buffer overflow exploits and the borrowed code chunks	28-09-2005	Article (PDF)	Linux x86-64	N/A
3	http://www.uninformed.org/?v=2&a=4	Bypassing Windows Hardware-enforced Data Execution Prevention	02-10-2005	Article	Windows, x86-32	OSVDB-875
4	http://cseweb.ucsd.edu/~hovav/papers/s07.html	The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86)	xx-10-2007	Article (PDF)	x86	N/A
5	http://taossa.com/archive/bh08sotirovdowd.pdf	Bypassing Browser Memory Protections	07-08-2008	Article	Windows, x86-32	N/A
6	http://www.sophsec.com/research/aslr_research.html	Attacking ASLR on Linux 2.6	27-05-2009	Article	Linux	N/A
7	http://www.packetstormsecurity.org/papers/bypass/bypass-dep.pdf	Bypassing hardware based DEP on Windows Server 2003 SP2	10-06-2009	Tutorial (PDF)	Windows, x86-32	N/A
8	http://www.corelan.be:8800/index.php/2009/09/21/exploit-writing-tutorial-part-6-bypassing-stack-cookies-safeseh-hw-dep-and-aslr/	Exploit writing tutorial part 6 : Bypassing Stack Cookies, SafeSeh, SEHOP, HW DEP and ASLR	12-09-2009	Tutorial	Windows, x86-32	CVE-2006-6199
9	http://bernardodamele.blogspot.com/2009/12/dep-bypass-with-setprocessdeppolicy.html	DEP bypass with SetProcessDEPPolicy()	09-12-2009	Article	Windows, x86-32	N/A
10	http://vrt-blog.snort.org/2009/12/dep-and-heap-sprays.html	DEP and Heap Sprays	17-12-2009	Blog post	Windows	N/A
11	http://blog.zynamics.com/2010/03/12/a-gentle-introduction-to-return-oriented-programming/	A gentle introduction to return-oriented programming	12-03-2010	Article	x86	N/A
12	http://archives.neohapsis.com/archives/fulldisclosure/2010-03/att-0553/Windows-DEP-WPM.txt	Exploitation With WriteProcessMemory()/Yet Another DEP Trick	xx-03-2010	Article	Windows	N/A
13	http://blog.harmonysecurity.com/2010/04/little-return-oriented-exploitation-on.html	A little return oriented exploitation on Windows x86 (Part 1)	12-04-2010	Article	Windows, x86-32	CVE-2010-0838
14	http://blog.harmonysecurity.com/2010/04/little-return-oriented-exploitation-on_16.html	A little return oriented exploitation on Windows x86 (Part 2)	16-04-2010	Article	Windows, x86-32	N/A
15	http://divine-protection.com/wordpress/?p=20	Advanced Return-Oriented Exploit	05-05-2010	Article	Linux, x86-32	N/A
16	http://www.corelan.be:8800/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-cube/	Exploit writing tutorial part 10 : Chaining DEP with ROP – the Rubik’sTM Cube	16-06-2010	Tutorial	Windows, x86-32	N/A
17	https://docs.google.com/viewer?a=v&pid=explorer&chrome=true&srcid=1g5FD5gjWAIu0iGf7gaF-DBfgya-u9kYX2KT9EgAdbpyjVzXI90imHI783LIF&hl=en	Bypassing ASLR and DEP under Windows	17-06-2010	Article (PDF)	Windows, x86-32	N/A
18	http://eticanicomana.blogspot.com/2010/06/so-called-return-oriented-programming.html	The so called Return Oriented Programming...	21-06-2010	Blog post	Windows, x86-32	N/A
19	http://www.exploit-db.com/osx-rop-exploits-evocam-case-study/	OSX ROP Exploit – EvoCam Case Study	06-07-2010	Tutorial	Mac OS X	OSVDB-65043
20	http://force.vnsecurity.net/download/longld/BHUS10_Paper_Payload_already_inside_data_reuse_for_ROP_exploits.pdf	Payload already inside: data reuse for rop exploits	28-07-2010	Article	Linux x86	N/A
21	http://www.vnsecurity.net/2010/10/simple-mac-os-x-ret2libc-exploit-x86/	Simple Mac OS X ret2libc exploit (x86)	05-10-2010	Blog post	Mac OS X, x86-32	N/A
22	http://j00ru.vexillium.org/?p=690	Exploiting the otherwise non-exploitable: Windows Kernel-mode GS cookies subverted	11-01-2011	Article (PDF)	Windows, x86-32	CVE-2010-4398
23	http://www.dis9.com/x-security/dep-bypass-with-setprocessdeppolicy.html	DEP bypass with SetProcessDEPPolicy()	13-02-2011	Blog post	Windows, x86-32	N/A
24	http://vulnfactory.org/blog/2011/09/21/defeating-windows-8-rop-mitigation/	Defeating Windows 8 ROP Mitigation	21-09-2011	Blog post	Windows 8	N/A
25	http://www.secfence.com/whitepapers/Whitepaper-on-ASLR-DEP-Bypass-Secfence-Technologies.pdf	Bypassing ASLR/DEP	25-09-2011	Article	Windows, x86-32	CVE-2011-0065
26	http://www.nes.fr/docs/NES-BypassWin7KernelAslr.pdf	Bypassing Windows 7 Kernel ASLR	11-10-2011	Article	Windows, x86-32	N/A
27	http://falken.tuxfamily.org/?p=115	Beat SMEP on Linux with Return-Oriented Programming	09-11-2011	Article	Linux, x86-64	N/A
28	http://www.exploit-monday.com/2011/11/man-vs-rop-overcoming-adversity-one.html	Man vs. ROP - Overcoming Adversity One Gadget at a Time	14-11-2011	Article	Windows, x86-32	N/A
29	http://blog.bkis.com/en/advanced-generic-rop-chain-for-windows-8/	Advanced Generic ROP chain for Windows 8	16-11-2011	Article	Windows 8	CVE-2011-0065
30	http://www.greyhathacker.net/?p=483	Bypassing EMET’s EAF with custom shellcode using kernel pointer	19-12-2011	Tutorial	Windows, x86-32	CVE-2010-3654
31	http://seclists.org/fulldisclosure/2012/Jan/124	SafeSEH+SEHOP all-at-once bypass explotation method principles	10-01-2012	Post	Windows, x86-32	N/A
32	http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/	Apache ModSetEnvIf Integer Overflow	11-01-2012	Article	Linux	CVE-2011-3607
33	http://piotrbania.com/all/articles/anti_emet_eaf.txt	BYPASSING EMET Export Address Table Access Filtering feature	19-01-2012	Post	Windows, x86-32	N/A
34	http://recxltd.blogspot.com/2012/03/partial-technique-against-aslr-multiple.html	A Partial Technique Against ASLR - Multiple O/Ss	02-03-2012	Article	Windows, x86-32	N/A
35	http://esec-lab.sogeti.com/post/Bypassing-ASLR-and-DEP-on-Adobe-Reader-X	Bypassing ASLR and DEP on Adobe Reader X	22-06-2012	Article	Windows, x86-32	N/A
36	https://community.rapid7.com/community/metasploit/blog/2012/07/06/stack-smashing-when-code-execution-becomes-a-nightmare	Stack Smashing: When Code Execution Becomes a Nightmare	06-07-2012	Tutorial	Windows, x86-32	CVE-2012-0124
37	https://community.rapid7.com/community/metasploit/blog/2012/08/15/the-stack-cookies-bypass-on-cve-2012-0549	The Stack Cookies Bypass on CVE-2012-0549	15-08-2012	Blog post	Windows, x86-32	CVE-2012-0549
38	http://blog.ptsecurity.com/2012/09/intel-smep-overview-and-partial-bypass.html	Intel SMEP overview and partial bypass on Windows 8	17-09-2012	Article	Windows 8	N/A
39	http://c0decstuff.blogspot.com.es/2012/12/defeating-windows-8-rop-mitigation.html	Defeating Windows 8 ROP Mitigation	19-12-2012	Article	Windows 8	N/A
40	http://kingcope.wordpress.com/2013/01/24/attacking-the-windows-78-address-space-randomization/	Attacking the Windows 7/8 Address Space Randomization	24-01-2013	Post	Windows 7/8	N/A
41	https://www.corelan.be/index.php/2013/02/19/deps-precise-heap-spray-on-firefox-and-ie10/	DEPS – Precise Heap Spray on Firefox and IE10	19-02-2013	Article	Windows	N/A
42	http://codearcana.com/posts/2013/05/28/introduction-to-return-oriented-programming-rop.html	Introduction to return oriented programming (ROP)	28-05-2013	Article	Linux	N/A
43	http://www.fireeye.com/blog/technical/cyber-exploits/2013/10/aslr-bypass-apocalypse-in-lately-zero-day-exploits.html	ASLR Bypass Apocalypse in Recent Zero-Day Exploits	15-10-2013	Article	Windows	CVE-2013-0640,CVE-2013-0634,CVE-2013-3163,CVE-2013-1690,CVE-2013-1493
44	http://bromiumlabs.files.wordpress.com/2014/02/bypassing-emet-4-1.pdf	BYPASSING EMET 4.1	xx-02-2014	Article	Windows	N/A
45	http://www.offensive-security.com/vulndev/disarming-enhanced-mitigation-experience-toolkit-emet/	Disarming Enhanced Mitigation Experience Toolkit	01-07-2014	Blogpost	Windows	N/A
46	https://labs.mwrinfosecurity.com/blog/2014/08/15/windows-8-kernel-memory-protections-bypass/	Windows 8 Kernel Memory Protections Bypass	15-08-2014	Blogpost	Windows 8	N/A

3.3. About mitigations

Nr	URL	Description	Date	Type	OS/Arch
1	http://em386.blogspot.com/2008/05/self-protecting-got.html	Self Protecting Global Offset Table (GOT)	24-04-2008	Article	N/A
2	https://www.blackhat.com/presentations/bh-europe-09/Fritsch/Blackhat-Europe-2009-Fritsch-Buffer-Overflows-Linux-whitepaper.pdf	Buffer overflows on linux-x86-64	22-01-2009	Article	Linux, x86-64
3	http://blogs.technet.com/b/srd/archive/2009/05/26/safe-unlinking-in-the-kernel-pool.aspx	Safe Unlinking in the Kernel Pool	26-05-2012	Article	Windows
4	http://blogs.technet.com/b/srd/archive/2009/08/04/preventing-the-exploitation-of-user-mode-heap-corruption-vulnerabilities.aspx	Preventing the exploitation of user mode heap corruption vulnerabilities	04-08-2009	Article	Windows
5	http://sysc.tl/2010/04/26/kernel-exploitation-mitigations/	FreeBSD kernel exploitation mitigations	26-04-2010	Article	FreeBSD
6	http://labs.mwrinfosecurity.com/notices/security_mechanisms_in_linux_environment__part_1___userspace_memory_protection/	Assessing the Tux Strength: Part 1 - Userspace Memory Protection	29-07-2010	Article	Linux
7	http://www.kryptoslogic.com/download/ROP_Whitepaper.pdf	Security Mitigations for Return-Oriented Programming Attacks	20-08-2010	Article	Windows
8	http://labs.mwrinfosecurity.com/notices/assessing_the_tux_strength_part_2_into_the_kernel/	Assessing the Tux Strength: Part 2 - Into the Kernel	02-09-2010	Article	Linux
9	http://blogs.technet.com/b/srd/archive/2010/12/08/on-the-effectiveness-of-dep-and-aslr.aspx	On the effectiveness of DEP and ASLR	08-12-2010	Article	Windows
10	http://msdn.microsoft.com/en-us/library/bb430720.aspx	Windows ISV Software Security Defenses	xx-12-2010	Article	Windows
11	https://wiki.ubuntu.com/Security/Features	Security/Features - Ubuntu Wiki	17-02-2011	Wiki	Linux
12	http://census.gr/media/bheu-2011-wp.pdf	Protecting the Core: Kernel Exploitation Mitigations	18-03-2011	Whitepaper	FreeBSD
13	http://isisblogs.poly.edu/2011/06/01/relro-relocation-read-only/	RELRO: RELocation Read-Only	01-06-2011	Article	Linux
14	http://www.mista.nu/research/nullpage.pdf	Locking Down the Windows Kernel:Mitigating Null Pointer Exploitation	07-07-2011	Article	Windows
15	http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=26788	Mitigating Software Vulnerabilities	12-07-2011	Article	Windows
16	http://www.accuvant.com/blog/2011/12/01/measure-twice-cut-once	Measure Twice, Cut Once	01-12-2011	Blog post	Windows
17	http://recxltd.blogspot.com/2011/12/curious-case-of-virtualalloc-aslr-and.html	The Curious Case of VirtualAlloc, ASLR and an SDL	13-12-2011	Blog post	Windows
18	http://blogs.msdn.com/b/sdl/archive/2012/01/26/enhancements-to-gs-in-visual-studio-11.aspx	Enhancements to /GS in Visual Studio 11	26-01-2012	Blog post	Windows
19	http://forums.grsecurity.net/viewtopic.php?t=2939&p=11669	Recent Advances: How We Learn From Exploits	15-02-2012	Forum post	Linux
20	http://blog.duosecurity.com/2012/02/a-look-at-aslr-in-android-ice-cream-sandwich-4-0/	A look at ASLR in Android Ice Cream Sandwich 4.0	17-02-2012	Blog post	Android
21	http://blogs.msdn.com/b/sdl/archive/2012/03/08/guarding-against-uninitialized-class-member-pointers.aspx	Guarding against uninitialized class member pointers	08-03-2012	Blog post	Windows
22	http://blogs.msdn.com/b/ie/archive/2012/03/12/enhanced-memory-protections-in-ie10.aspx?Redirected=true	Enhanced Memory Protections in IE10	13-03-2012	Article	Windows
23	http://blogs.msdn.com/b/sdl/archive/2012/04/24/guarding-against-re-use-of-stale-object-references.aspx	Guarding against re-use of stale object references	24-04-2012	Article	Windows
24	http://www.inertiawar.com/win8_unlink/	Windows 8 and Safe Unlinking in NTDLL	14-07-2012	Note	Windows
25	https://blog.duosecurity.com/2012/07/exploit-mitigations-in-android-jelly-bean-4-1/	Exploit Mitigations in Android Jelly Bean 4.1	16-07-2012	Article	Android
26	http://0xfeedface.org/blog/lattera/2012-07-19/new-exploit-protections-android-41	New Exploit Protections in Android 4.1	19-07-2012	Article	Android
27	http://blogs.technet.com/b/srd/archive/2012/07/24/emet-3-5-tech-preview-leverages-security-mitigations-from-the-bluehat-prize.aspx	EMET 3.5 Tech Preview leverages security mitigations from the BlueHat Prize	24-07-2012	Article	Windows
28	http://blogs.technet.com/b/srd/archive/2012/07/26/technical-analysis-of-the-top-bluehat-prize-submissions.aspx	Technical Analysis of the Top BlueHat Prize Submissions	26-07-2012	Article	Windows
29	http://security.stackexchange.com/questions/18556/how-do-aslr-and-dep-work	How do ASLR and DEP work?	12-08-2012	Article	-
30	http://forums.grsecurity.net/viewtopic.php?f=7&t=3043	Inside the Size Overflow Plugin	28-08-2012	Article	-
31	http://forums.grsecurity.net/viewtopic.php?f=7&t=3046	Supervisor Mode Access Prevention	07-09-2012	Note	-
32	http://blog.ptsecurity.com/2012/12/windows-8-aslr-internals.html	Windows 8 ASLR Internals	04-12-2012	Article	Windows 8
33	http://blog.shell-storm.org/files/ASLR_implementation_in_Linux_Kernel_3.7.pdf	ASLR implementation in Linux Kernel 3.7	19-01-2013	Note	Linux
34	http://forums.grsecurity.net/viewtopic.php?f=7&t=3292	Recent ARM security improvements	18-02-2013	Post	ARM
35	http://forums.grsecurity.net/viewtopic.php?f=7&t=3367	KASLR: An Exercise in Cargo Cult Security	20-03-2013	Post	-
36	http://cyvera.com/a-brief-analysis-of-microsoft-patchguard-msr-protection/	A BRIEF ANALYSIS OF MICROSOFT PATCHGUARD MSR PROTECTION	10-10-2013	Post	Windows
37	http://blogs.technet.com/b/srd/archive/2013/10/29/software-defense-mitigation-heap-corruption-vulnerabilities.aspx	Software Defense: mitigating heap corruption vulnerabilities	29-10-2013	Article	Windows
38	http://blogs.technet.com/b/srd/archive/2013/11/06/software-defense-safe-unlinking-and-reference-count-hardening.aspx	Software defense: safe unlinking and reference count hardening	06-11-2013	Article	Windows
39	http://site.pi3.com.pl/papers/ASSP.pdf	Adventure with Stack Smashing Protector (SSP)	11-11-2013	Article	Linux
40	http://www.alex-ionescu.com/?p=82	KASLR Bypass Mitigations in Windows 8.1	17-11-2013	Article	Windows 8.1
41	http://0xdabbad00.com/wp-content/uploads/2013/11/emet_4_1_uncovered.pdf	EMET 4.1 Uncovered	18-11-2013	Whitepaper	Windows
42	http://blogs.technet.com/b/srd/archive/2013/12/11/software-defense-mitigating-common-exploitation-techniques.aspx	Software defense: mitigating common exploitation techniques	11-12-2013	Article	Windows
43	https://www.cert.org/blogs/certcc/post.cfm?EntryID=191	Differences Between ASLR on Windows and Linux	10-02-2014	Article	Windows
44	http://scrammed.blogspot.de/2014/03/reversing-emets-eaf-and-couple-of.html	Reversing EMET's EAF (and a couple of curious findings...)	20-03-2014	Blogpost	Windows
45	https://labs.mwrinfosecurity.com/blog/2014/06/20/isolated-heap-friends---object-allocation-hardening-in-web-browsers/	Isolated Heap & Friends - Object Allocation Hardening in Web Browsers	20-06-2014	Blogpost	-
46	http://blog.trendmicro.com/trendlabs-security-intelligence/isolated-heap-for-internet-explorer-helps-mitigate-uaf-exploits/	Isolated Heap for Internet Explorer Helps Mitigate UAF Exploits	01-07-2014	Blogpost	Windows
47	http://blog.fortinet.com/post/is-use-after-free-exploitation-dead-the-new-ie-memory-protector-will-tell-you	Is use-after-free exploitation dead? The new IE memory protector will tell you	16-06-2014	Blogpost	Windows
48	http://researchcenter.paloaltonetworks.com/2014/07/beginning-end-use-free-exploitation/	Is It the Beginning of the End For Use-After-Free Exploitation?	16-06-2014	Blogpost	Windows
49	http://blog.trendmicro.com/trendlabs-security-intelligence/mitigating-uaf-exploits-with-delay-free-for-internet-explorer/	Mitigating UAF Exploits with Delay Free for Internet Explorer	17-06-2014	Blogpost	Windows
50	http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Efficacy-of-MemoryProtection-against-use-after-free/ba-p/6556134	Efficacy of MemoryProtection against use-after-free vulnerabilities	28-07-2014	Blogpost	Windows

4. Exploitation techniques and research

Nr	URL	Description	Date	Type	OS/Arch	Info
1	http://cansecwest.com/slides07/Vector-Rewrite-Attack.pdf	Vector Rewrite Attack - Exploitable NULL Pointer Vulnerabilities on ARM and XScale Architectures	xx-03-2007	Whitepaper	ARM/XScale	-
2	http://www.phreedom.org/presentations/heap-feng-shui/	Heap Feng Shui in JavaScript	2007	Slides, video, paper	Windows, x86-32	N/A
3	http://documents.iss.net/whitepapers/IBM_X-Force_WP_final.pdf	Application-Specific Attacks: Leveraging the ActionScript Virtual Machine	xx-04-2008	Article (PDF)	-	-
4	https://code.google.com/p/em386/downloads/detail?name=Exploring_the_STL_Owning_erase.pdf&can=2&q=	Exploring the STL: Owning erase( )	20-07-2009	Article	Linux	-
5	http://dsecrg.com/pages/pub/show.php?id=22	Writing JIT-Spray Shellcode for fun and profit	05-03-2010	Article (PDF)	Windows, x86-32	N/A
6	http://census-labs.com/media/bheu-2010-wp.pdf	Binding the Daemon: FreeBSD Kernel Stack and Heap Exploitation	22-04-2010	Whitepaper	FreeBSD	CVE-2008-3531
7	https://sites.google.com/site/zerodayresearch/Adobe_Readers_Custom_Memory_Management_a_Heap_of_Trouble.pdf?attredirects=0	Adobe Reader's Custom Memory Management: A Heap Of Trouble	22-04-2010	Whitepaper	-	CVE-2010-1241
8	http://www.mista.nu/research/MANDT-kernelpool-PAPER.pdf	Kernel Pool Exploitation on Windows 7	12-01-2011	Whitepaper	Windows	N/A
9	http://ifsec.blogspot.com/2011/06/memory-disclosure-technique-for.html	Memory disclosure technique for Internet Explorer	09-06-2011	Article	Windows, x86-32	N/A
10	http://www.whitephosphorus.org/sayonara.txt	White Phosphorus Exploit Pack Sayonara ASLR DEP Bypass Technique	21-06-2011	Note	Windows, x86-32	N/A
11	http://www.matasano.com/research/Attacking_Clientside_JIT_Compilers_Paper.pdf	Attacking Clientside JIT Compilers	07-08-2011	Article (PDF)	-	N/A
12	https://media.blackhat.com/bh-us-11/Brossard/BH_US_11_Brossard_Post_Memory_WP.pdf	Post Memory Corruption Memory Analysis	03-08-2011	Article (PDF)	Linux, x86	N/A
13	http://blog.cdleary.com/2011/08/understanding-jit-spray/	Understanding JIT spray	29-08-2011	Article	-	N/A
14	http://www.exploit-monday.com/2011/08/targeted-heap-spraying-0x0c0c0c0c-is.html	Targeted Heap Spraying – 0x0c0c0c0c is a Thing of the Past	29-08-2011	Article	-	N/A
15	https://community.rapid7.com/community/metasploit/blog/2011/10/11/monasploit	MonaSploit	11-10-2011	Article	-	N/A
16	http://j00ru.vexillium.org/?p=1038	Windows Kernel Address Protection	xx-08-2011	Article	Windows	N/A
17	http://media.blackhat.com/bh-ad-11/Drake/bh-ad-11-Drake-Exploiting_Java_Memory_Corruption-WP.pdf	Exploiting Memory Corruption Vulnerabilities in the Java Runtime	15-12-2011	Article	-	CVE-2009-3869,CVE-2010-3552
18	https://www.corelan.be/index.php/2011/12/31/exploit-writing-tutorial-part-11-heap-spraying-demystified/	Exploit writing tutorial part 11 : Heap Spraying Demystified	31-12-2011	Tutorial	Windows, x86-32	N/A
19	http://sysc.tl/2012/01/03/linux-kernel-heap-exploitation/	The Linux kernel memory allocators from an exploitation perspective	03-01-2012	Article	Linux	N/A
20	http://zhodiac.hispahack.com/my-stuff/security/Flash_ASLR_bypass.pdf	CVE-2012-0769, the case of the perfect info leak	09-04-2012	Article	Windows	CVE-2012-0769
21	http://badishi.com/jit-spraying-primer-and-cve-2010-3654/	JIT Spraying Primer and CVE-2010-3654	26-05-2012	Article	Windows	CVE-2010-3654
22	https://media.blackhat.com/bh-us-12/Briefings/Argyoudis/BH_US_12_Argyroudis_Exploiting_the_%20jemalloc_Memory_%20Allocator_WP.pdf	Exploiting the jemalloc Memory Allocator: Owning Firefox's Heap	25-07-2012	Whitepaper	nix	N/A
23	https://media.blackhat.com/bh-us-12/Briefings/Serna/BH_US_12_Serna_Leak_Era_WP.pdf	CVE-2012-0769, the case of the perfect info leak	25-07-2012	Whitepaper	Windows	CVE-2012-0769
24	https://media.blackhat.com/bh-us-12/Briefings/Esser/BH_US_12_Esser_iOS_Kernel_Heap_Armageddon_WP.pdf	iOS Kernel Heap Armageddon	26-07-2012	Whitepaper	iOS	N/A
25	https://communities.coverity.com/blogs/security/2012/07/31/windows-8-heap-internals-update	Windows 8 Heap Internals	31-07-2012	Whitepaper	Windows	N/A
26	https://subreption.com/site_media/uploads/reports/droidleak_release.pdf	Android exploitation primers: lifting the veil on mobile offensive security (Vol. I)	xx-08-2012	Whitepaper	Android	CVE-2010-4577
27	http://www.vdalabs.com/tools/DeMott_BlueHat_Submission.pdf	BlueHat Prize Submission (/ROP)	xx-03-2012	Whitepaper	Windows	N/A
28	http://www.trailofbits.com/threads/2012_LeafSR_NaCl_paper_BlackHat.pdf	Google Native Client - Analysis Of A Secure Browser Plugin Sandbox	25-07-2012	Whitepaper	-	N/A
29	http://mainisusuallyafunction.blogspot.de/2012/11/attacking-hardened-linux-systems-with.html	Attacking hardened Linux systems with kernel JIT spraying	17-11-2012	Article	Linux	NA
30	https://sites.google.com/site/zerodayresearch/smashing_the_heap_with_vector_Li.pdf	Smashing the Heap with Vector: Advanced Exploitation Technique in Recent Flash Zero-day Attack	xx-02-2013	Whitepaper	-	CVE-2013-0643
31	https://media.blackhat.com/eu-13/briefings/Liu/bh-eu-13-liu-advanced-heap-WP.pdf	Advanced Heap Manipulation in Windows 8	15-03-2013	Whitepaper	Windows 8	N/A
32	http://j00ru.vexillium.org/?p=1695	SyScan 2013, Bochspwn paper and slides	24-04-2013	Whitepaper	Windows	N/A
33	http://zhodiac.hispahack.com/my-stuff/security/Flash_Jit_InfoLeak_Gadgets.pdf	Flash JIT – Spraying info leak gadgets	19-07-2013	Whitepaper	-	N/A
34	http://blog.azimuthsecurity.com/2013/12/attacking-zone-page-metadata-in-ios-7.html	Attacking Zone Page Metadata in iOS 7 and OS X Mavericks	19-12-2013	Article	iOS	N/A
35	http://www.slideshare.net/xiong120/exploit-ie-using-scriptable-active-x-controls-version-english	Exploit IE Using Scriptable ActiveX Controls (version English)	22-03-2014	Article	Windows	N/A
36	https://community.rapid7.com/community/metasploit/blog/2014/04/07/hack-away-at-the-unessential-with-explib2-in-metasploit	"Hack Away at the Unessential" with ExpLib2 in Metasploit	07-04-2014	Article	Windows	N/A
37	https://doar-e.github.io/blog/2014/04/30/corrupting-arm-evt/	Corrupting the ARM Exception Vector Table	30-04-2014	Article	ARM	N/A
38	http://blog.fortinet.com/post/advanced-exploit-techniques-attacking-the-ie-script-engine	Advanced Exploit Techniques Attacking the IE Script Engine	16-06-2014	Blogpost	Windows	N/A
39	https://www.blackhat.com/docs/us-14/materials/us-14-Gorenc-Thinking-Outside-The-Sandbox-Violating-Trust-Boundaries-In-Uncommon-Ways-WP.pdf	Thinking outside the sandbox - Violating trust boundaries in uncommon ways	05-08-2014	Article	Windows	CVE-2014-1705,CVE-2014-4015,CVE-2014-0506,CVE-2014-1713
40	http://atredispartners.blogspot.de/2014/08/here-be-dragons-vulnerabilities-in.html	Here Be Dragons: Vulnerabilities in TrustZone	14-08-2014	Article	ARM	N/A

5. Shellcode writing

Nr	URL	Description	Date	Type	OS/Arch	Info
1	http://hick.org/code/skape/papers/win32-shellcode.pdf	Understanding Windows Shellcode	12-06-2003	Article (PDF)	Windows, x86-32	N/A
2	http://www.vividmachines.com/shellcode/shellcode.html	Shellcoding for Linux and Windows Tutorial	xx-06-2007	Article	Windows, x86-32/Linux	N/A
3	http://blog.harmonysecurity.com/2009/08/calling-api-functions.html	Calling API Functions	05-08-2009	Article	Windows, x86-32	N/A
4	http://blog.harmonysecurity.com/search/label/Shellcode	Implementing a Windows, x86-32 Kernel Shellcode	05-11-2009	Article	Windows, x86-32	N/A
5	http://www.corelan.be:8800/index.php/2010/01/09/exploit-writing-tutorial-part-8-win32-egg-hunting/	Exploit writing tutorial part 8 : Windows, x86-32 Egg Hunting	09-01-2010	Tutorial	Windows, x86-32	CVE-2009-3837
6	http://grey-corner.blogspot.com/2010/02/windows-buffer-overflow-tutorial.html	Windows Buffer Overflow Tutorial: An Egghunter and a Conditional Jump	13-02-2010	Tutorial	Windows, x86-32	CVE-2005-0338
7	http://www.corelan.be:8800/index.php/2010/02/25/exploit-writing-tutorial-part-9-introduction-to-win32-shellcoding/	Exploit writing tutorial part 9 : Introduction to Windows, x86-32 shellcoding	25-02-2010	Tutorial	Windows, x86-32	N/A
8	http://www.corelan.be:8800/index.php/2010/08/22/exploit-notes-win32-eggs-to-omelet/	Exploit notes – win32 eggs-to-omelet	22-08-2010	Article	Windows, x86-32	N/A
9	http://www.exploit-db.com/foxit-reader-stack-overflow-exploit-egghunter/	Foxit Reader Stack Overflow Exploit – Egghunter Edition	14-11-2010	Tutorial	Windows, x86-32	OSVDB-68648
10	http://www.exploit-db.com/papers/15652/	How to Create a Shellcode on ARM Architecture	25-11-2010	Article	ARM	N/A
11	http://mcdermottcybersecurity.com/articles/windows-x64-shellcode	Windows x64 shellcode	11-01-2011	Article	Windows, x86-64	N/A
12	http://resources.infosecinstitute.com/stack-based-buffer-overflow-tutorial-part-3-%E2%80%94-adding-shellcode/	Stack Based Buffer Overflow Tutorial, part 3 — Adding shellcode	09-03-2011	Tutorial	Windows, x86-32	N/A
13	http://www.corelan.be/index.php/2011/05/12/hack-notes-ropping-eggs-for-breakfast/	Hack Notes : Ropping eggs for breakfast	12-05-2011	Tutorial	Windows, x86-32	N/A
14	http://gdtr.wordpress.com/2011/07/23/universal-rop-shellcode-for-os-x-x64/	Universal ROP shellcode for OS X x64	23-07-2011	Article	Mac OS X, x64	N/A
15	http://www.vnsecurity.net/2011/07/yet-another-universal-osx-x86_64-dyld-rop-shellcode/	Yet another universal OSX x86_64 dyld ROP shellcode	30-07-2011	Article	Mac OS X, x64	N/A
16	http://www.codeproject.com/Articles/325776/The-Art-of-Win32-Shellcoding	The Art of Win32 Shellcoding	06-02-2012	Article	Windows, x86-32	N/A
17	http://blog.markloiseau.com/2012/06/64-bit-linux-shellcode/	64-bit Linux Shellcode	10-06-2012	Article	Linux, x86-64	N/A
18	https://community.rapid7.com/community/metasploit/blog/2012/07/06/an-example-of-egghunting-to-exploit-cve-2012-0124	An example of EggHunting to exploit CVE-2012-0124	06-07-2012	Tutorial	Windows, x86-32	CVE-2012-0124
19	https://www.offensive-security.com/vulndev/aix-shellcode-metasploit/	Fun with AIX Shellcode and Metasploit	20-11-2012	Article	AIX	N/A
20	http://www.exploit-monday.com/2013/08/writing-optimized-windows-shellcode-in-c.html	Writing Optimized Windows Shellcode in C	16-08-2013	Article	Windows	N/A

6. Analysis

6.1. Vulnerability analysis

Tends to contain analysis of the root issue including source code or reversed binary, explaining the problem.

Nr	URL	Description	Date	OS/Arch	Info
1	http://roeehay.blogspot.com/2008/10/graphviz-buffer-overflow-code-execution.html	Graphviz Buffer Overflow Code Execution	08-10-2008	-	N/A
2	http://dvlabs.tippingpoint.com/blog/2009/06/30/exploiting-ms-advisory-971778---quicktime-directshow-vulnerability	Exploiting MS Advisory 971778: QuickTime DirectShow	28-05-2009	Windows, x86-32	CVE-2009-1537
3	http://roeehay.blogspot.com/2009/06/apple-quicktime-image-description-atom.html	Apple QuickTime Image Description Atom Sign Extension Memory Corruption	02-06-2009	Windows, x86-32	CVE-2009-0955
4	http://site.pi3.com.pl/adv/xpdf.txt	Xpdf - Integer overflow which causes heap overflow and NULL pointer derefernce	06-07-2009	-	N/A
5	http://roeehay.blogspot.com/2009/08/advisory-adobe-flash-player-avm2.html	Advisory: Adobe Flash Player and AIR AVM2 intf_count Integer Overflow	02-08-2009	Windows, x86-32	CVE-2009-1869
6	http://www.viva64.com/en/a/0046/	Safety of 64-bit code	06-08-2009	-	N/A
7	http://www.matasano.com/research/NaCl_Summary-Team-CJETM.pdf	NaCl Contest - Summary of findings	xx-xx-2009	-	N/A
8	http://site.pi3.com.pl/adv/mod_proxy.txt	Mod_proxy from apache 1.3 - Integer overflow which causes heap overflow	27-01-2010	Linux, x86-64	N/A
9	http://code.google.com/p/chromium/issues/attachmentText?id=35724&aid=126993484832405244&name=Pwnium-1.3.html&token=feb53c401c565218ebbb4e57977988f2	Pwnium 1.3 - an exploit for an integer overflow in WebGLUnsignedIntArray.	01-03-2010	Windows, x86-32	N/A
10	http://site.pi3.com.pl/adv/libopie-adv.txt	libopie readrec() off-by one (FreeBSD ftpd remote PoC)	27-05-2010	FreeBSD	CVE-2010-1938
11	http://dvlabs.tippingpoint.com/blog/2010/09/01/zdi-10-169-on-exploitability	Security Advisory for NetWare 6.5 OpenSSH	01-09-2010	Windows, x32	ZDI-10-169
12	http://em386.blogspot.com/2010/12/webkit-css-type-confusion.html	WebKit CSS Type Confusion	15-12-2010	-	CVE-2010-4577
13	http://esec-lab.sogeti.com/dotclear/index.php?post/2010/12/09/CVE-2010-3830-iOS-4.2.1-packet-filter-local-kernel-vulnerability	CVE-2010-3830 - iOS < 4.2.1 packet filter local kernel vulnerability	18-12-2010	iOS < 4.2.1	CVE-2010-3830
14	http://0x1byte.blogspot.co.il/2011/02/cve-2010-3333-microsoft-office-rtf-file.html	Analysis of CVE 2010-3333 Microsoft Office RTF File Stack Buffer Overflow Vulnerability	20-02-2011	Windows	CVE-2010-3333
15	http://cissrt.blogspot.com/2011/02/cve-2011-0045-ms-windows-xp.html	CVE-2011-0045: MS Windows XP WmiTraceMessageVa Integer Truncation Vulnerability	26-02-2011	Windows	CVE-2011-0045
16	http://www.vupen.com/blog/20110326.Technical_Analysis_and_Win7_Exploitation_Adobe_Flash_0Day_CVE-2011-0609.php	Technical Analysis and Advanced Exploitation of Adobe Flash 0-Day (CVE-2011-0609)	26-03-2011	Windows, x86-32	CVE-2011-0609
17	http://bugix-security.blogspot.com/2011/04/cve-2011-0611-adobe-flash-zero-day.html	CVE-2011-0611 Adobe Flash Zero Day embeded in DOC	12-04-2011	Windows, x86-32	CVE-2011-0611
18	http://blogs.technet.com/b/mmpc/archive/2011/04/12/analysis-of-the-cve-2011-0611-adobe-flash-player-vulnerability-exploitation.aspx	Analysis of the CVE-2011-0611 Adobe Flash Player vulnerability exploitation	12-04-2011	Windows, x86-32	CVE-2011-0611
19	http://secunia.com/blog/210	Adobe Flash Player 0-day Exploit Analysis (CVE-2011-0611)	14-04-2011	Windows, x86-32	CVE-2011-0611
20	http://scarybeastsecurity.blogspot.de/2011/05/libxml-vulnerability-and-interesting.html	libxml vulnerability and interesting integer issues	27-05-2011	-	N/A
21	https://bugzilla.mozilla.org/show_bug.cgi?id=664009	Mozilla Firefox 4.0.1 Array.reduceRight() Vulnerability	14-06-2011	-	CVE-2011-2371
22	http://research.reversingcode.com/index.php/advisories/75-apple-quicktime-player-h264-issues	Apple QuickTime Player H.264 issues	01-09-2011	Windows, x86-32	CVE-2011-0247
23	http://www.offensive-security.com/vulndev/ms11-080-voyage-into-ring-zero/	MS11-080 – A Voyage into Ring Zero	06-12-2011	Windows, x86-32	CVE-2011-2005
24	http://thexploit.com/secdev/a-textbook-buffer-overflow-a-look-at-the-freebsd-telnetd-code/	A Textbook Buffer Overflow: A Look at the FreeBSD telnetd Code	25-12-2011	FreeBSD	CVE-2011-4862
25	http://rdtsc.net/?p=136	sitting on the bugs	05-01-2012	-	N/A
26	http://newsoft-tech.blogspot.com/2012/01/ms11-014-this-is-not-bug-your-are.html	MS11-014: this is not the bug your are looking for …	10-01-2012	Windows, x86-32	CVE-2011-0039
27	http://www.vupen.com/blog/20120110.Technical_Analysis_of_ProFTPD_Remote_Use_after_free_CVE-2011-4130_Part_I.php	Technical Analysis of ProFTPD Response Pool Remote Use-after-free (CVE-2011-4130) - Part I	10-01-2012	Linux, x86-32	CVE-2011-4130
28	http://www.dis9.com/ms11-077-from-patch-to-proof-of-concept.html	MS11-077: From Patch to Proof-of-Concept	16-01-2012	Windows, x86-32	CVE-2011-1985
29	http://home.gdal.org/private/zdi-can-1221/zdi-can-1221.txt	ZDI-CAN-1221: LibTIFF TileSize Parsing Remote Code Execution Vulnerability	06-04-2012	-	CVE-2012-1173
30	http://axtaxt.wordpress.com/2012/07/08/analysis-of-cve-2011-3545/	Analysis of CVE-2011-3545 (ZDI-11-307)	08-07-2012	-	CVE-2011-3545
31	https://media.blackhat.com/bh-us-12/Briefings/Wojtczuk/BH_US_12_Wojtczuk_A_Stitch_In_Time_WP.pdf	Stitch In Time Saves Nine: A Stitch In Time Saves Nine: A Case Of Multiple OS Vulnerability	25-07-2012	-	CVE-2006-0744,CVE-2012-0217
32	http://seclists.org/bugtraq/2012/Sep/29	Internet Explorer Script Interjection Code Execution (updated)	06-09-2012	Windows	N/A
33	https://community.rapid7.com/community/metasploit/blog/2012/11/16/nfr-agent-buffer-vulnerabilites-cve-2012-4959	New 0day Exploits: Novell File Reporter Vulnerabilities	16-11-2012	Windows	CVE-2012-4956
34	http://www.offensive-security.com/vulndev/ca-arcserve-rwslist-remote-code-execution/	CA ARCserve CVE-2012-2971	30-10-2012	Windows, x86-32	CVE-2012-2971
35	https://lock.cmpxchg8b.com/sophailv2.pdf	Sophail: Applied attacks against Sophos Antivirus	xx-10-2012	-	N/A
36	http://www.cyvera.com/how-to-exploit-cve-2010-3333/	HOW TO EXPLOIT CVE-2010-3333	28-11-2012	Windows	CVE-2010-3333
37	http://j00ru.vexillium.org/?p=1479	CVE-2012-2553: Windows Kernel VDM use-after-free in win32k.sys	18-12-2012	Windows	CVE-2012-2553
38	https://www.corelan.be/index.php/2013/02/26/root-cause-analysis-memory-corruption-vulnerabilities/	Root Cause Analysis – Memory Corruption Vulnerabilities	26-02-2013	Windows	N/A
39	http://scarybeastsecurity.blogspot.de/2013/02/exploiting-64-bit-linux-like-boss.html	Exploiting 64-bit Linux like a boss	03-02-2013	Linux, x86-64	N/A
40	http://blog.ptsecurity.com/2013/02/surprise-for-network-resources-from.html	Surprise for Network Resources from kernel32 (MS12-081, Detailed Analysis of Vulnerability in Microsoft File Handling Component)	11-02-2013	Windows	N/A
41	http://blog.azimuthsecurity.com/2013/02/from-usr-to-svc-dissecting-evasi0n.html	From USR to SVC: Dissecting the 'evasi0n' Kernel Exploit	13-02-2013	iOS	N/A
42	http://blog.azimuthsecurity.com/2013/02/re-visiting-exynos-memory-mapping-bug.html	Re-visiting the Exynos Memory Mapping Bug	14-02-2013	Android 4.0	N/A
43	http://sitsec.net/blog/2013/04/22/stack-based-buffer-overflow-in-the-vpn-software-tinc-for-authenticated-peers/	Stack-based Buffer Overflow in the VPN Software tinc for Authenticated Peers	22-04-2013	nix	CVE-2013-1428
44	http://antid0te.com/syscan_2013/SyScan2013_Mountain_Lion_iOS_Vulnerabilities_Garage_Sale_Whitepaper.pdf	Mountain Lion/iOS Vulnerabilities Garage Sale	24-04-2013	Mac OS X / iOS	N/A
45	http://rikiji.it/2013/05/10/CVE-2013-2094-x86.html	CVE-2013-2094 port to x86	10-05-2013	Linux	CVE-2013-2094
46	http://blog.binamuse.com/2013/05/readerbmprle.html	Adobe Reader BMP/RLE heap corruption - CVE-2013-2729	14-05-2013	-	CVE-2013-2729
47	http://blog.cmpxchg8b.com/2013/05/introduction-to-windows-kernel-security.html	Introduction to Windows Kernel Security Research	15-05-2013	Windows	N/A
48	http://www.reddit.com/r/netsec/comments/1eb9iw/sdfucksheeporgs_semtexc_local_linux_root_exploit/c9ykrck	sd@fucksheep.org's semtex.c: Local Linux root exploit, 2.6.37-3.8.8 inclusive (and 2.6.32 on CentOS) 0-day	15-05-2013	Linux	CVE-2013-2094
49	http://timetobleed.com/a-closer-look-at-a-recent-privilege-escalation-bug-in-linux-cve-2013-2094/	A closer look at a recent privilege escalation bug in Linux (CVE-2013-2094)	20-05-2013	Linux	CVE-2013-2094
50	http://www.vnsecurity.net/2013/05/analysis-of-nginx-cve-2013-2028/	Analysis of nginx 1.3.9/1.4.0 stack buffer overflow and x64 exploitation (CVE-2013-2028)	21-05-2013	Linux	CVE-2013-2028
51	https://www-304.ibm.com/connections/blogs/xforce/entry/cve_2013_1347_microsoft_internet_explorer_cgenericelement_object_use_after_free_vulnerability	CVE-2013-1347: Microsoft Internet Explorer CGenericElement object Use-After-Free Vulnerability	22-05-2013	Windows x86-32	CVE-2013-1347
52	http://rpw.io/blog/2013/06/11/postpwnium_writeup/	Postpwnium Writeup	11-06-2013	Chrome OS	N/A
53	http://blog.azimuthsecurity.com/2013/06/attacking-crypto-phones-weaknesses-in.html	Attacking Crypto Phones: Weaknesses in ZRTPCPP	27-06-2013	-	N/A
54	http://labs.portcullis.co.uk/blog/in-the-lab-popping-cve-2013-2171-for-freebsd-9-0/	In the lab, popping CVE-2013-2171 for FreeBSD 9.0…	11-12-2013	FreeBSD	CVE-2013-2171
55	https://www.sektioneins.de/advisories/advisory-012013-php-openssl_x509_parse-memory-corruption-vulnerability.html	Advisory 01/2013: PHP openssl_x509_parse() Memory Corruption Vulnerability	13-12-2013	-	CVE-2013-6420
56	https://hackerone.com/reports/1356	PHP Heap Overflow Vulnerability in imagecrop()	06-02-2014	-	CVE-2013-7726
57	http://seclists.org/fulldisclosure/2014/Feb/48	Information on recently-fixed Oracle VM VirtualBox vulnerabilities	07-02-2014	-	CVE-2013-5892,CVE-2014-0407,CVE-2014-0405,CVE-2014-0406,CVE-2014-0404
58	http://blog.securitymouse.com/2014/06/raising-lazarus-20-year-old-bug-that.html	Raising Lazarus - The 20 Year Old Bug that Went to Mars	26-06-2014	-	NA
59	http://blog.lekkertech.net/blog/2014/07/02/LZO-on-integer-overflows-and-auditing/	LZO, on integer overflows and auditing	02-07-2014	-	N/A

Nr.	URL	Description
1	http://xorl.wordpress.com/category/bugs/	Vulnerabilities descriptions mapped to CVE
2	http://www.abysssec.com/blog/tag/binary-analysis/	Vulnerabilities binary analysis by Abysssec
3	http://exploitshop.wordpress.com/	Vulnerability analysis blog using DarunGrim
4	http://0x1byte.blogspot.com/search/label/0-days	Alexander Gavrun published vulnerabilities
5	http://blog.cr0.org/	Julien Tinnes blog (Kernel-level bugs)
6	http://sysc.tl/category/advisories/	Patroklos (argp) Argyroudis advisories
7	http://trapkit.de/advisories/published.html	Published Security Advisories by Tobias Klein
8	http://jon.oberheide.org/	Jon Oberheide Blog
9	http://www.scary.beasts.org/security/	Chris Evans: Software security holes found via auditing, fuzzing, etc.
10	http://www.ioactive.com/ioactive_labs_advisories.html	IOActive Labs Advisories
11	http://www.blackhat.com/presentations/bh-europe-07/Eriksson-Janmar/Whitepaper/bh-eu-07-eriksson-WP.pdf	Kernel Wars
12	code.google.com/p/chromium/issues/list...	ZDI submissions to Google Chrome
13	bugzilla.mozilla.org/buglist.cgi...	ZDI submissions to Mozilla Firefox

6.2. Exploit analasys

(New section, to be updated...)

Analysis of full-blown exploits with shellcode, DEP/ASLR bypasses and all the things, usually found in the wild.

Nr	URL	Description	Date	OS/Arch	Info
1	http://www.fireeye.com/blog/technical/cyber-exploits/2013/12/cve-2013-33465065-technical-analysis.html	CVE-2013-3346/5065 Technical Analysis	06-12-2013	Windows	CVE-2013-3346,CVE-2013-5065
2	http://www.crowdstrike.com/blog/analysis-cve-2013-3906-exploit/index.html	Analysis of a CVE-2013-3906 Exploit	09-12-2013	Windows	CVE-2013-3906
3	http://vrt-blog.snort.org/2014/05/anatomy-of-exploit-cve-2014-1776.html	Anatomy of an exploit: CVE 2014-1776	02-05-2014	Windows	CVE-2014-1776
4	http://www.cyphort.com/blog/dig-deeper-ie-vulnerability-cve-2014-1776-exploit/	Dig deeper into the IE Vulnerability (CVE-2014-1776) exploit	06-05-2014	Windows	CVE-2014-1776
5	http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/The-mechanism-behind-Internet-Explorer-CVE-2014-1776-exploits/ba-p/6476220	The mechanism behind Internet Explorer CVE-2014-1776 exploits	14-05-2014	Windows	CVE-2014-1776
6	http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Technical-Analysis-of-CVE-2014-0515-Adobe-Flash-Player-Exploit/ba-p/6482744	Technical Analysis of CVE-2014-0515 Adobe Flash Player Exploit	21-05-2014	Windows	CVE-2014-0515
7	http://googleprojectzero.blogspot.de/2014/07/pwn4fun-spring-2014-safari-part-i_24.html	pwn4fun Spring 2014 - Safari - Part I	24-07-2014	Mac OSX	N/A

7. Tools and projects

Nr	URL	Description	Date	Type
1	http://reverse.put.as/wp-content/uploads/2011/06/hackingleopard.pdf	Hacking Leopard: Tools and Techniques for Attacking the Newest Mac OS X	22-06-2007	Article
2	http://www.corelan.be:8800/index.php/2009/08/12/exploit-writing-tutorials-part-4-from-exploit-to-metasploit-the-basics/	Exploit writing tutorial part 4 : From Exploit to Metasploit – The basics	12-08-2009	Tutorial
3	http://www.corelan.be:8800/index.php/2009/09/05/exploit-writing-tutorial-part-5-how-debugger-modules-plugins-can-speed-up-basic-exploit-development/	Exploit writing tutorial part 5 : How debugger modules & plugins can speed up basic exploit development	05-09-2009	Tutorial
4	http://www.corelan.be:8800/index.php/2010/01/26/starting-to-write-immunity-debugger-pycommands-my-cheatsheet/	Starting to write Immunity Debugger PyCommands : my cheatsheet	26-01-2010	Tutorial
5	http://skypher.com/SkyLined/heap_spray/small_heap_spray_generator.html	Heap spray generator	-	Online service
6	http://www.offensive-security.com/metasploit-unleashed/exploit-development	Exploit Development	-	Site
7	http://gorope.me/	FREE Online ROP Gadgets Search	-	Online service
8	https://www.corelan.be/index.php/security/corelan-ropdb/	Corelan ROPdb	-	Online service
9	https://blog.mandiant.com/archives/1899	Exploring Artifacts in Heap Memory with Heap Inspector	-	Tool, Article
10	http://redmine.corelan.be/projects/mona	Corelan Team project page for 'mona', a PyCommand for Immunity Debugger	-	Tool
11	http://www.hsc.fr/ressources/outils/skyrack/index.html.en	ROP gadget search tool	-	Tool
12	http://blog.metasploit.com/2008/08/byakugan-windbg-plugin-released.html	Set of extensions for exploit development under WinDbg	-	Tool
13	http://www.whitephosphorus.org/	Public releases of White Phosphorus (ASLR/DEP bypasses)	-	-
14	https://github.com/djrbliss/libplayground	A simple framework for developing Linux kernel heap exploit techniques	-	Tool
15	http://exploit-exercises.com/	exploit-exercises.com provides a variety of virtual machines ...	-	OS
16	http://sourceforge.net/projects/metasploitable/files/	Metasploitable 2	-	OS
17	http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=tool&name=Heappie	Heappie! is an exploit-writing-oriented memory analysis tool	-	Tool
18	https://community.rapid7.com/community/metasploit/blog/2012/07/05/part-1-metasploit-module-development--the-series	Metasploit exploit development - The series Part 1.	05-07-2012	Tutorial
19	https://www.corelan.be/index.php/2012/12/31/jingle-bofs-jingle-rops-sploiting-all-the-things-with-mona-v2/	Jingle BOFs, Jingle ROPs, Sploiting all the things… with Mona v2 !!	31-12-2012	Blog
20	http://www.alertlogic.com/modern-userland-linux-exploitation-courseware/	Modern Userland Linux Exploitation Courseware	21-04-2013	Courseware
21	https://github.com/neuromancer/sea	Symbolic Exploit Assistant	-	Tool
22	http://www.blackhatlibrary.net/Shellcodecs	Shellcodecs is a collection of shellcodes, loaders, sources, and generators	-	Wiki

8. Other collections, wiki's, etc.

Nr	URL	Description	Type
1	http://www.labri.fr/perso/fleury/courses/SS07/download/papers/Evolution_of_Buffer_Overflows.pdf	On the Evolution of Buﬀer Overﬂows	Article
2	http://www.freeinfosociety.com/media/pdf/2708.pdf	A Buffer Overflow Study - Attacks & Defenses	Article (PDF)
3	http://www.ma.rhul.ac.uk/static/techrep/2009/RHUL-MA-2009-06.pdf	Buffer Overflows in the Microsoft Windows® Environment	Article (PDF)
4	http://skypher.com/wiki/index.php/Main_Page	Skypher - the wiki for absolutely nothing	Wiki
5	http://myne-us.blogspot.com/2010/08/from-0x90-to-0x4c454554-journey-into.html	From 0x90 to 0x4c454554, a journey into exploitation.	Collection
6	http://5d4a.wordpress.com/2010/10/13/my-smashing-improved/	Smashing the stack in 2010	Article (PDF)
7	http://projectshellcode.com/	Knowledge base for all shellcode related resources	Site
8	http://pentest.cryptocity.net/	Penetration Testing and Vulnerability Analysis	Course
9	http://www.shell-storm.org/papers/index.php?lg=english	Database of papers	Collection
10	http://secdocs.lonerunners.net/	Database of papers	Collection
11	http://www.theamazingking.com/exploit.html	Exploit Development	Collection
12	http://packetstormsecurity.org/files/tags/paper/	Whitepaper Files	Collection
13	http://6dev.net/mirror/doc.bughunter.net/	Database of papers	Collection
14	http://sf-freedom.blogspot.com/	Software Vulnerability Exploitation Blog	Blog
15	http://tools.securitytube.net/index.php?title=Open_Security_Training	Open Security Training	Collection of video
16	http://www.phrack.org	Phrack Magazine	Magazine
17	http://poppopret.blogspot.com/	Hacking & IT Security Stuff	Blog
18	http://www.securityaegis.com/the-big-fat-metasploit-post/	The Big Fat Metasploit Post	Blog post
19	https://www.corelan-training.com/	Win32 Exploit Development class	Training
20	http://theiphonewiki.com/wiki/index.php?title=Category:Exploits	The iPhone Wiki	Wiki
21	http://en.wikibooks.org/wiki/Metasploit	The Metasploit Book	Wiki
22	http://sysc.tl/	Patroklos (argp) Argyroudis blog	Blog
23	http://www.gimpel.com/html/bugs.htm	The Bug of the Month	-
24	http://reverse.put.as/papers/	Reverse Engineering Mac OS X: Papers & Presentations	-
25	http://grsecurity.net/research.php	Academic Research Publications Mentioning grsecurity/PaX	List
26	http://jon.oberheide.org/mokb/	the Month of Kernel Bugs (MoKB) archive	-
27	http://jon.oberheide.org/moab/	the Month of Apple Bugs	-
28	http://www.opensecuritytraining.info/Training.html	Training Classes	Course
29	http://www.fuzzysecurity.com/tutorials.html	Exploit Development Tutorial Series	Collection
30	https://developers.google.com/native-client/community/security-contest/	Security Contest Archive	Archive
31	http://0xdabbad00.com/2013/04/28/exploit-mitigation-kill-chain/	Exploit Mitigation Kill Chain	Blogpost
32	http://uninformed.org/index.cgi?	INFORMATIVE INFORMATION FOR THE UNINFORMED	Site
33	http://www.exploit-db.com/wp-content/themes/exploit/docs/16151.pdf	Exploiting ARM Linux Systems	Whitepaper

9. Media

Nr	URL	Description	Date
1	http://redmine.corelan.be:8800/projects/corelanart/files	Graphics and Art (Wallpapers)	30-11-2010
2	https://community.rapid7.com/community/infosec/blog/2011/02/24/dual-cores-metasploit-track-free-download	Dual Core's Metasploit Track: Free Download!	24-02-2011

10. Timeline and history

Nr	URL	Description	Date
1	http://ilm.thinkst.com/folklore/index.shtml	Memory Corruption and Hacker Folklore	xx-xx-2010
2	https://zynamics.files.wordpress.com/2010/02/code_reuse_timeline1.png	Code Reuse Timeline	xx-02-2010
3	http://www.abysssec.com/blog/2010/05/past-present-future-of-windows-exploitation/	Past, Present, Future of Windows Exploitation	08-05-2010
4	https://media.blackhat.com/bh-us-10/whitepapers/Meer/BlackHat-USA-2010-Meer-History-of-Memory-Corruption-Attacks-wp.pdf	Memory Corruption Attacks: The (almost) Complete History	25-06-2010
5	https://paulmakowski.wordpress.com/2011/01/25/smashing-the-stack-in-2011/	Smashing the Stack in 2011	25-01-2011
6	http://www.isg.rhul.ac.uk/sullivan/pubs/tr/technicalreport-ir-cs-73.pdf	Memory Errors: The Past, the Present, and the Future	12-09-2012
7	http://blogbromium.files.wordpress.com/2013/01/heap-sprays-to-sandbox-escapes_issa0113.pdf	Heap Sprays to Sandbox Escapes: A Brief History of Browser Exploitation	xx-01-2013

11. Debugging

Nr	URL	Description	Date	Type	OS/Arch
1	http://msdn.microsoft.com/en-us/magazine/cc163311.aspx	Analyze Crashes to Find Security Vulnerabilities in Your Apps	xx-11-2007	Article	Windows, x86-32
2	https://blogs.technet.com/b/srd/archive/2009/01/28/stack-overflow-stack-exhaustion-not-the-same-as-stack-buffer-overflow.aspx	Stack overflow (stack exhaustion) not the same as stack buffer overflow	28-01-2009	Article	-
3	http://sysc.tl/2009/07/02/freebsd-kernel-debugging/	FreeBSD kernel debugging	02-07-2009	Tutorial	FreeBSD
4	https://blogs.msdn.com/b/sudeepg/archive/2010/04/29/debugging-a-crash-an-example.aspx	debugging a crash – An example	29-04-2010	Article	-
5	http://resources.infosecinstitute.com/debugging-fundamentals-for-exploit-development/	Debugging Fundamentals for Exploit Development	28-02-2011	Article	Windows, x86-32
6	http://resources.infosecinstitute.com/in-depth-seh-exploit-writing-tutorial-using-ollydbg/	OllyDbg Tricks for Exploit Development	28-02-2011	Article	Windows, x86-32
7	http://blogs.msdn.com/b/ntdebugging/archive/2013/06/14/understanding-pool-corruption-part-1-buffer-overflows.aspx	Understanding Pool Corruption Part 1 – Buffer Overflows	14-06-2013	Article	Windows
8	http://blogs.msdn.com/b/ntdebugging/archive/2013/08/22/understanding-pool-corruption-part-2-special-pool-for-buffer-overruns.aspx	Understanding Pool Corruption Part 2 – Special Pool for Buffer Overruns	22-08-2013	Article	Windows

posted @ 2014-11-14 00:03 by_3ks 阅读(1231) 评论(0) 编辑收藏举报

会员力量，点亮园子希望

刷新页面返回顶部

by_3ks