This document is in fieri, and, as such, will be subject to change in the near future.


My intention with this document is for it to be somewhat of a recommended reading list for the aspiring hacker.
I have tried to order the articles by technique and chronology.

- sar

Buffer overflows:

How to write buffer overflows, mudge, 1995

• http://insecure.org/stf/mudge_buffer_overflow_tutorial.html

Smashing the stack for fun and profit, Aleph One, 1996

• http://www.phrack.com/issues.html?issue=49&id=14

The Frame Pointer Overwrite, klog, 1999

• http://www.phrack.com/issues.html?issue=55&id=8

win32 buffer overflows, dark spyrit, 1999

• http://www.phrack.com/issues.html?issue=55&id=15

Return-into-lib / Return oriented programming:

Getting around non-executable stack (and fix) (First public description of a return-into-libc exploit), Solar Designer, 1997

• http://marc.info/?l=bugtraq&m=87602746719512

More advanced ret-into-lib(c) techniques, Nergal, 2001

• http://www.phrack.com/issues.html?issue=58&id=4

On the effectiveness of address-space randomization, , 2004

• http://benpfaff.org/papers/asrandom.pdf

Borrowed code chunks exploitation technique, Sebastian Krahmer, 2005

• http://www.suse.de/~krahmer/no-nx.pdf

The Geometry of Innocent Flesh on the Bone: Return-into-libc without function calls, Hovav Shacham, 2007

• http://cseweb.ucsd.edu/~hovav/dist/geometry.pdf

Defeating DEP, the Immunity Debugger way, Pablo Sole,2008

• http://www.immunitysec.com/downloads/DEPLIB.pdf

The Case of Return-Oriented Programming and the AVC Advantage, 2009

• http://www.usenix.org/event/evtwote09/tech/full_papers/checkoway.pdf

Practical Return-Oriented Programming, Dino A. Dai Zovi, 2010

• http://www.sourceconference.com/bos10pubs/Dino.pdf

Heap exploitation:

w00w00 on heap overflows, Matt Conover, 1999

• http://w00w00.org/files/articles/heaptut.txt

Vudo - An object superstitiously believed to embody magical powers, Michel "MaXX" Kaempf, 2001

• http://www.phrack.com/issues.html?issue=57&id=8

Once upon a free(), anonymous author, 2001

• http://www.phrack.com/issues.html?issue=57&id=9

Advanced Doug Lea's malloc exploits, jp, 2003

• http://www.phrack.com/issues.html?issue=61&id=6

Exploiting the wilderness, Phantasmal Phantasmagoria, 2004

• http://www.derkeiler.com/Mailing-Lists/securityfocus/vuln-dev/2004-02/0024.html

Malloc Maleficarum, Phantasmal Phantasmagoria, 2005

• http://www.packetstormsecurity.org/papers/attack/MallocMaleficarum.txt

Yet another free() exploitation technique, huku, 2009

• http://www.phrack.com/issues.html?issue=66&id=6

Format string exploitation:

Exploiting format string vulnerabilities, scut / Team-TESO, 2001

• http://crypto.stanford.edu/cs155old/cs155-spring08/papers/formatstring-1.2.pdf

Advances in format string exploitation, gera, 2002

• http://www.phrack.com/issues.html?issue=59&id=7

An alternative method in format string exploitation, K-sPecial, 2006

• http://www.milw0rm.com/papers/103

Integer overflows:

Big Loop Integer Protection, Oded Horovitz, 2002

• http://www.phrack.com/issues.html?issue=60&id=9

Basic Integer Overflows, blexim, 2002

• http://www.phrack.com/issues.html?issue=60&id=10

Null-ptr dereference:

Large memory management vulnerabilities, Gael Delalleau, 2005

• http://cansecwest.com/core05/memory_vulns_delalleau.pdf

Exploiting the Otherwise Non-exploitable on Windows, skape, 2006

• http://www.uninformed.org/?v=4&a=5&t=pdf

Vector rewrite attack, Barnaby Jack, 2007

• http://www.juniper.net/solutions/literature/white_papers/Vector-Rewrite-Attack.pdf

Application-Specific Attacks: Leveraging the ActionScript Virtual Machine, Mark Dowd, 2008

• http://documents.iss.net/whitepapers/IBM_X-Force_WP_final.pdf

JIT-spray:

Pointer inference and JIT-Spraying, Dion Blazakis, 2010

• http://www.semantiscope.com/research/BHDC2010/BHDC-2010-Paper.pdf

Writing JIT shellcode for fun and profit, Alexey Sintsov, 2010

• http://dsecrg.com/files/pub/pdf/Writing%20JIT-Spray%20Shellcode%20for%20fun%20and%20profit.pdf

Other:

Overwriting the .dtors section, Juan M. Bello Rivas, 2000

• http://seclists.org/bugtraq/2000/Dec/175

Abusing .CTORS and .DTORS for fun 'n profit, Izik, 2006

• http://vxheavens.com/lib/viz00.html

Unorganized:

• http://blog.zynamics.com/2010/03/12/a-gentle-introduction-to-return-oriented-programming/
• http://documents.iss.net/whitepapers/IBM_X-Force_WP_final.pdf exploit null ptr dereference
• http://www.phrack.com/issues.html?issue=57&id=18
• http://documents.iss.net/whitepapers/IBM_X-Force_WP_final.pdf
• http://www.usenix.org/events/sec05/tech/full_papers/kruegel/kruegel_html/attack.html
• http://cansecwest.com/core05/memory_vulns_delalleau.pdf Large memory management vulnerabilities, Gael Delalleau, 2005
• http://timetobleed.com/defeating-the-matasano-c-challenge-with-aslr-enabled/
• http://www.corelan.be:8800/index.php/category/security/exploit-writing-tutorials/
• http://hackitoergosum.org/wp-content/uploads/2010/04/HES10-jvanegue_zero-allocations.pdf
• http://www.ruxcon.org.au/files/2006/unusual_bugs.pdf
• http://www.phrack.com/issues.html?issue=64&id=6, Attacking the Core : Kernel Exploiting Notes, 2007
• http://lkml.org/lkml/2010/5/27/490
• http://vreugdenhilresearch.nl/Pwn2Own-2010-Windows7-InternetExplorer8.pdf
• http://blog.ksplice.com/2010/04/exploiting-kernel-null-dereferences/
• http://www.ruxcon.org.au/files/2006/unusual_bugs.pdf
• http://eeyeresearch.typepad.com/blog/2006/08/post_ms06035_ma.html
• http://www.phrack.org/phrack/63/p63-0x0e_Shifting_the_Stack_Pointer.txt
• http://seclists.org/vuln-dev/2002/Nov/att-0056/0
• http://www.pine.nl/press/pine-cert-20030101.txt
• http://seclists.org/bugtraq/2000/Jan/0016.html

ASLR

Aslr Smack and Laugh Reference

• www-users.rwth-aachen.de/Tilo.Mueller/ASLRpaper.pdf

Advanced Buffer Overflow Methods

• cs.tau.ac.il/tausec/lectures/Advanced_Buffer_Overflow_Methods.ppt

Smack the Stack

• sts.synflood.de/dump/doc/smackthestack.txt

Exploiting the random number generator to bypass ASLR

• blackhat.com/presentations/bh-europe-09/Fritsch/Blackhat-Europe-2009-Fritsch-Bypassing-aslr-whitepaper.pdf

Wikipedia on ASLR

• en.wikipedia.org/wiki/Address_space_layout_randomization

Bypassing Memory Protections: The Future of Exploitation

• usenix.org/events/sec09/tech/slides/sotirov.pdf

On the Effectiveness of Address-Space Randomization

• stanford.edu/~blp/papers/asrandom.pdf

Exploiting with linux-gate.so.1

• milw0rm.com/papers/55

Circumventing the VA kernel patch For Fun and Profit

• milw0rm.com/papers/94

Defeating the Matasano C++ Challenge

• timetobleed.com/defeating-the-matasano-c-challenge-with-aslr-enabled/

Bypassing PaX ASLR protection

• phrack.com/issues.html?issue=59&id=9

Thoughts about ASLR, NX Stack and format string attacks

• nibbles.tuxfamily.org/?p=1190

Return-into-libc without Function Calls

• cseweb.ucsd.edu/~hovav/dist/geometry.pdf

Linux ASLR Curiosities. Tavis Ormandy. Julien Tinnes

• cr0.org/paper/to-jt-linux-alsr-leak.pdf
• corelan.be:8800/index.php/2009/09/21/exploit-writing-tutorial-part-6-bypassing-stack-cookies-safeseh-hw-dep-and-aslr/
• securitytube.net/Exploiting-a-buffer-overflow-under-Linux-kernel-2.6-with-ASLR-through-ret2reg-video.aspx
• securitytube.net/Bypassing-the-Linux-Kernel-ASLR-and-Exploiting-a-Buffer-Overflow-Vulnerable-Application-with-ret2esp-video.aspx
• securitytube.net/Exploiting-Buffer-Overflows-on-kernels-with-ASLR-enabled-using-Brute-Force-on-the-Stack-Layer-video.aspx
• http://ilm.thinkst.com/folklore/index.shtml
• http://www.corelan.be:8800/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-cube/