Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
awesome-windows-exploitation
https://github.com/gavz/awesome-windows-exploitation
- Win32 Buffer Overflows (Location, Exploitation and Prevention) - by Dark spyrit [1999]
- Writing Stack Based Overflows on Windows - by Nish Bhalla’s [2005]
- Third Generation Exploitation smashing heap on 2k - by Halvar Flake [2002]
- Exploiting the MSRPC Heap Overflow Part 1 - by Dave Aitel (MS03-026) [September 2003]
- Exploiting the MSRPC Heap Overflow Part 2 - by Dave Aitel (MS03-026) [September 2003]
- Windows heap overflow penetration in black hat - by David Litchfield [2004]
- How to attack kernel based vulns on windows was done - by a Polish group called “sec-labs” [2003]
- Sec-lab old whitepaper
- Sec-lab old exploit
- Windows Local Kernel Exploitation (based on sec-lab research) - by S.K Chong [2004]
- How to exploit Windows kernel memory pool - by SoBeIt [2005]
- Exploiting remote kernel overflows in windows - by Eeye Security
- Kernel-mode Payloads on Windows in uninformed - by Matt Miller
- Exploiting 802.11 Wireless Driver Vulnerabilities on Windows
- BH US 2007 Attacking the Windows Kernel
- Remote and Local Exploitation of Network Drivers
- Exploiting Comon Flaws In Drivers
- I2OMGMT Driver Impersonation Attack
- Real World Kernel Pool Exploitation
- Exploit for windows 2k3 and 2k8
- Alyzing local privilege escalations in win32k
- Intro to Windows Kernel Security Development
- There’s a party at ring0 and you’re invited
- Windows kernel vulnerability exploitation
- Data Execution Prevention
- /GS (Buffer Security Check)
- /SAFESEH
- ASLR
- SEHOP
- Third Generation Exploitation smashing heap on 2k - by Halvar Flake [2002]
- Creating Arbitrary Shellcode In Unicode Expanded Strings - by Chris Anley
- Advanced windows exploitation - by Dave Aitel [2003]
- Defeating the Stack Based Buffer Overflow Prevention Mechanism of Microsoft Windows 2003 Server - by David Litchfield
- Reliable heap exploits and after that Windows Heap Exploitation (Win2KSP0 through WinXPSP2) - by Matt Conover in cansecwest 2004
- Safely Searching Process Virtual Address Space - by Matt Miller [2004]
- IE exploit and used a technology called Heap Spray
- Bypassing hardware-enforced DEP - by Skape (Matt Miller) and Skywing (Ken Johnson) [October 2005]
- Exploiting Freelist[0 - by Brett Moore [2005]
- Kernel-mode Payloads on Windows in uninformed
- Exploiting 802.11 Wireless Driver Vulnerabilities on Windows
- Exploiting Comon Flaws In Drivers
- Heap Feng Shui in JavaScript
- Understanding and bypassing Windows Heap Protection - by Nicolas Waisman [2007]
- Heaps About Heaps - by Brett moore [2008]
- Bypassing browser memory protections in Windows Vista - by Mark Dowd and Alex Sotirov [2008]
- Attacking the Vista Heap - by ben hawkes [2008]
- Return oriented programming Exploitation without Code Injection - by Hovav Shacham (and others ) [2008]
- Token Kidnapping and a super reliable exploit for windows 2k3 and 2k8 - by Cesar Cerrudo [2008]
- Defeating DEP Immunity Way - by Pablo Sole [2008]
- Practical Windows XP2003 Heap Exploitation - by John McDonald and Chris Valasek [2009]
- Bypassing SEHOP - by Stefan Le Berre Damien Cauquil [2009]
- Interpreter Exploitation : Pointer Inference and JIT Spraying - by Dionysus Blazakis[2010]
- Write-up of Pwn2Own 2010 - by Peter Vreugdenhil
- All in one 0day presented in rootedCON - by Ruben Santamarta [2010]
- DEP/ASLR bypass using 3rd party - by Shahin Ramezany [2013]
- Real-world HW-DEP bypass Exploit - by Devcode
- Bypassing DEP by returning into HeapCreate - by Toto
- First public ASLR bypass exploit by using partial overwrite - by Skape
- Heap spray and bypassing DEP - by Skylined
- First public exploit that used ROP for bypassing DEP in adobe lib TIFF vulnerability
- Exploit codes of bypassing browsers memory protections
- PoC’s on Tokken TokenKidnapping . PoC for 2k3 -part 1 - by Cesar Cerrudo
- PoC’s on Tokken TokenKidnapping . PoC for 2k8 -part 2 - by Cesar Cerrudo
- An exploit works from win 3.1 to win 7 - by Tavis Ormandy KiTra0d
- Old ms08-067 metasploit module multi-target and DEP bypass
- PHP 6.0 Dev str_transliterate() Buffer overflow – NX + ASLR Bypass
- SMBv2 Exploit - by Stephen Fewer
- Exploit writing tutorial part 1 : Stack Based Overflows
- Exploit writing tutorial part 2 : Stack Based Overflows – jumping to shellcode
- Exploit writing tutorial part 3 : SEH Based Exploits
- Exploit writing tutorial part 3b : SEH Based Exploits – just another example
- Exploit writing tutorial part 4 : From Exploit to Metasploit – The basics
- Exploit writing tutorial part 5 : How debugger modules & plugins can speed up basic exploit development
- Exploit writing tutorial part 6 : Bypassing Stack Cookies, SafeSeh, SEHOP, HW DEP and ASLR
- Exploit writing tutorial part 7 : Unicode – from 0x00410041 to calc
- Exploit writing tutorial part 8 : Win32 Egg Hunting
- Exploit writing tutorial part 9 : Introduction to Win32 shellcoding
- Exploit writing tutorial part 10 : Chaining DEP with ROP – the Rubik’s Cube
- Exploit writing tutorial part 11 : Heap Spraying Demystified
- Part 1: Introduction to Exploit Development
- Part 2: Saved Return Pointer Overflows
- Part 3: Structured Exception Handler (SEH)
- Part 4: Egg Hunters
- Part 5: Unicode 0x00410041
- Part 6: Writing W32 shellcode
- Part 7: Return Oriented Programming
- Part 8: Spraying the Heap [Chapter 1: Vanilla EIP
- Part 9: Spraying the Heap [Chapter 2: Use-After-Free
- Windows Exploit Development – Part 1: The Basics
- Windows Exploit Development – Part 2: Intro to Stack Based Overflows
- Windows Exploit Development – Part 3: Changing Offsets and Rebased Modules
- Windows Exploit Development – Part 4: Locating Shellcode With Jumps
- Windows Exploit Development – Part 5: Locating Shellcode With Egghunting
- Windows Exploit Development – Part 6: SEH Exploits
- Windows Exploit Development – Part 7: Unicode Buffer Overflows
- angr - Platform-agnostic binary analysis
- BARF - Multiplatform, open
- binnavi - Binary analysis IDE for
- Bokken - GUI for Pyew and Radare.
- Capstone - Disassembly framework for
- codebro - Web based code browser using
- dnSpy - .NET assembly editor, decompiler
- Evan's Debugger (EDB) - A
- GDB - The GNU debugger.
- GEF - GDB Enhanced Features, for exploiters
- hackers-grep - A utility to
- IDA Pro - Windows
- Immunity Debugger - Debugger for
- ltrace - Dynamic analysis for Linux executables.
- objdump - Part of GNU binutils,
- OllyDbg - An assembly-level debugger for Windows
- PANDA - Platform for Architecture-Neutral Dynamic Analysis
- PEDA - Python Exploit Development
- pestudio - Perform static analysis of Windows
- Process Monitor
- Pyew - Python tool for malware
- Radare2 - Reverse engineering framework, with
- SMRT - Sublime Malware Research Tool, a
- strace - Dynamic analysis for
- Udis86 - Disassembler library and tool
- Vivisect - Python tool for
- X64dbg - An open-source x64/x32 debugger for windows.
Keywords
reverse-engineering
4
python
2
analysis
2
pwntools
1
pwn
1
powerpc
1
mips
1
malware-analysis
1
linux
1
ida-pro
1
gef
1
gdb
1
exploit-development
1
exploit
1
discord
1
debugging
1
ctf
1
binary-ninja
1
python-api
1
sparc
1
disassembler
1
emulation
1
angr
1
binary
1
arm
1
binary-analysis
1
reil
1
x86
1
binnavi
1
java
1
yfiles
1