I'm a CS student going all-in on binary exploitation, and I got tired
of bookmarking twenty "how to learn pwn" lists that all disagreed with
each other. So I wrote the path I'm actually walking, in phases, with a
concrete milestone at the end of each one.
Phase 0 — Foundations. C, x86-64 assembly, Linux, some Python.
Milestone: disassemble a tiny C program and follow the stack by hand
through a function call.
Phase 1 — Tooling & reversing. gdb+pwndbg, objdump/readelf/checksec,
Ghidra, the ELF format.
Milestone: reverse a crackme and explain how it validates the password.
Phase 2 — The stack. Overflows, saved return address, ret2win, shellcode.
Milestone: ROP Emporium ret2win + a shellcode challenge.
Phase 3 — Mitigations. NX, ASLR, canaries, PIE, RELRO, info leaks,
ret2libc, ROP.
Milestone: a working ret2libc and a ROP chain built from gadgets you
found yourself.
Phase 4 — The heap. glibc internals, UAF, double free, tcache poisoning.
Milestone: reproduce how2heap techniques, then solve a heap challenge
with no writeup open.
Phase 5 — Specialize. Format strings, kernel, browsers, ARM, real CVEs.
Resources are deliberately few: as the backbone, ROP
Emporium, Nightmare, ir0nstone's notes, how2heap, LiveOverflow. A phase
with fifteen links is a phase nobody starts.
Two things I'd genuinely like feedback on from people further along:
-
Is Phase 4 too early? I've seen the argument that you should spend
much longer on ROP and real-world stack targets before touching the
heap at all.
-
Anything you'd cut? I left out fuzzing entirely and I'm not sure
that's right.
I'm on Phase 0-1 myself and logging progress publicly as I go — happy
to share where it lives if anyone wants to follow along.
