# Summary GitHub 地址： * [简介](README.md) * [前言](doc/0_preface.md) * [一、基础知识篇](doc/1_basic.md) * [1.1 CTF 简介](doc/1.1_ctf.md) * [1.2 学习方法](doc/1.2_how_to_learn.md) * [1.3 Linux 基础](doc/1.3_linux_basic.md) * [1.4 Web 安全基础](doc/1.4_web_basic.md) * [1.4.1 HTML 基础](doc/1.4.1_html_basic.md) * [1.4.2 HTTP 协议基础](doc/1.4.2_http_basic.md) * [1.4.3 JavaScript 基础](doc/1.4.3_javascript_basic.md) * [1.4.4 常见 Web 服务器基础](doc/1.4.4_webserver_basic.md) * [1.4.5 OWASP Top Ten Project 漏洞基础](doc/1.4.5_owasp_basic.md) * [1.4.6 PHP 源码审计基础](doc/1.4.6_php_basic.md) * [1.5 逆向工程基础](doc/1.5_reverse_basic.md) * [1.5.1 C/C++ 语言基础](doc/1.5.1_c_basic.md) * [1.5.2 x86/x64 汇编基础](doc/1.5.2_x86_x64.md) * [1.5.3 Linux ELF](doc/1.5.3_elf.md) * [1.5.4 Windows PE](doc/1.5.4_pe.md) * [1.5.5 静态链接](doc/1.5.5_static_link.md) * [1.5.6 动态链接](doc/1.5.6_dynamic_link.md) * [1.5.7 内存管理](doc/1.5.7_memory.md) * [1.5.8 glibc malloc](doc/1.5.8_glibc_malloc.md) * [1.5.9 Linux 内核](doc/1.5.9_linux_kernel.md) * [1.5.10 Windows 内核](doc/1.5.10_windows_kernel.md) * [1.5.11 jemalloc](doc/1.5.11_jemalloc.md) * [1.5.12 MIPS 汇编基础](doc/1.5.12_mips.md) * [1.6 密码学基础](doc/1.6_crypto_basic.md) * [1.7 Android 安全基础](doc/1.7_android_basic.md) * [1.7.1 Android 环境搭建](doc/1.7.1_android_env.md) * [1.7.2 Dalvik 指令集](doc/1.7.2_dalvik.md) * [1.7.3 ARM 汇编基础](doc/1.7.3_arm.md) * [1.7.4 Android 常用工具](doc/1.7.4_android_tools.md) * [二、工具篇](doc/2_tools.md) * 虚拟化分析环境 * [2.1.1 VirtualBox](doc/2.1.1_virtualbox.md) * [2.1.2 QEMU](doc/2.1.2_qemu.md) * [2.1.3 Docker](doc/2.1.3_docker.md) * [2.1.4 Unicorn](doc/2.1.4_unicorn.md) * 静态分析工具 * [2.2.1 radare2](doc/2.2.1_radare2.md) * [2.2.2 IDA Pro](doc/2.2.2_idapro.md) * [2.2.3 JEB](doc/2.2.3_jeb.md) * [2.2.4 Capstone](doc/2.2.4_capstone.md) * [2.2.5 Keystone](doc/2.2.5_keystone.md) * 动态分析工具 * [2.3.1 GDB](doc/2.3.1_gdb.md) * [2.3.2 OllyDbg](doc/2.3.2_ollydbg.md) * [2.3.3 x64dbg](doc/2.3.3_x64dbg.md) * [2.3.4 WinDbg](doc/2.3.4_windbg.md) * [2.3.5 LLDB](doc/2.3.5_lldb.md) * 其他工具 * [2.4.1 pwntools](doc/2.4.1_pwntools.md) * [2.4.2 zio](doc/2.4.2_zio.md) * [2.4.3 metasploit](doc/2.4.3_metasploit.md) * [2.4.4 binwalk](doc/2.4.4_binwalk.md) * [2.4.5 Burp Suite](doc/2.4.5_burpsuite.md) * [2.4.6 Wireshark](doc/2.4.6_wireshark.md) * [2.4.7 Cuckoo Sandbox](doc/2.4.7_cuckoo.md) * [三、分类专题篇](doc/3_topics.md) * Pwn * [3.1.1 格式化字符串漏洞](doc/3.1.1_format_string.md) * [3.1.2 整数溢出](doc/3.1.2_integer_overflow.md) * [3.1.3 栈溢出](doc/3.1.3_stack_overflow.md) * [3.1.4 返回导向编程（ROP）（x86）](doc/3.1.4_rop_x86.md) * [3.1.5 返回导向编程（ROP）（ARM）](doc/3.1.5_rop_arm.md) * [3.1.6 Linux 堆利用（一）](doc/3.1.6_heap_exploit_1.md) * [3.1.7 Linux 堆利用（二）](doc/3.1.7_heap_exploit_2.md) * [3.1.8 Linux 堆利用（三）](doc/3.1.8_heap_exploit_3.md) * [3.1.9 Linux 堆利用（四）](doc/3.1.9_heap_exploit_4.md) * [3.1.10 内核 ROP](doc/3.1.10_kernel_rop.md) * [3.1.11 Linux 内核漏洞利用](doc/3.1.11_linux_kernel_exploit.md) * [3.1.12 Windows 内核漏洞利用](doc/3.1.12_windows_kernel_exploit.md) * [3.1.13 竞争条件](doc/3.1.13_race_condition.md) * [3.1.14 虚拟机逃逸](doc/3.1.14_vm_escape.md) * Reverse * [3.2.1 patch 二进制文件](doc/3.2.1_patch_binary.md) * [3.2.2 脱壳技术（PE）](doc/3.2.2_pe_unpack.md) * [3.2.3 脱壳技术(ELF)](doc/3.2.3_elf_unpack.md) * [3.2.4 反调试技术（PE）](doc/3.2.4_pe_anti_debugging.md) * [3.2.5 反调试技术（ELF）](doc/3.2.5_elf_anti_debugging.md) * [3.2.6 指令混淆](doc/3.2.6_instruction_confusion.md) * Web * [3.3.1 SQL 注入利用](doc/3.3.1_sql_injection.md) * [3.3.2 XSS 漏洞利用](doc/3.3.2_xss.md) * Crypto * Misc * Mobile * [四、技巧篇](doc/4_tips.md) * [4.1 Linux 内核调试](doc/4.1_linux_kernel_debug.md) * [4.2 Linux 命令行技巧](doc/4.2_Linux_terminal_tips.md) * [4.3 GCC 编译参数解析](doc/4.3_gcc_arg.md) * [4.4 GCC 堆栈保护技术](doc/4.4_gcc_sec.md) * [4.5 ROP 防御技术](doc/4.5_defense_rop.md) * [4.6 one-gadget RCE](doc/4.6_one-gadget_rce.md) * [4.7 通用 gadget](doc/4.7_common_gadget.md) * [4.8 使用 DynELF 泄露函数地址](doc/4.8_dynelf.md) * [4.9 shellcode 开发](doc/4.9_shellcode.md) * [4.10 跳转导向编程（JOP）](doc/4.10_jop.md) * 4.11 * [4.12 利用 __stack_chk_fail](doc/4.12_stack_chk_fail.md) * [4.13 利用 _IO_FILE 结构](doc/4.13_io_file.md) * [4.14 glibc tcache 机制](doc/4.14_glibc_tcache.md) * [4.15 利用 vsyscall 和 vDSO](doc/4.15_vsyscall_vdso.md) * [五、高级篇](doc/5_advanced.md) * [5.0 软件漏洞分析](doc/5.0_vulnerability.md) * [5.1 模糊测试](doc/5.1_fuzzing.md) * [5.1.1 AFL fuzzer](doc/5.1.1_afl_fuzzer.md) * [5.1.2 libFuzzer](doc/5.1.2_libfuzzer.md) * [5.2 动态二进制插桩](doc/5.2_dyn_binary_instrumentation.md) * [5.2.1 Pin](doc/5.2.1_pin.md) * [5.2.2 DynamoRio](doc/5.2.2_dynamorio.md) * [5.2.3 Valgrind](doc/5.2.3_valgrind.md) * [5.3 符号执行](doc/5.3_symbolic_execution.md) * [5.3.1 angr](doc/5.3.1_angr.md) * [5.3.2 Triton](doc/5.3.2_triton.md) * [5.3.3 KLEE](doc/5.3.3_klee.md) * [5.3.4 S²E](doc/5.3.4_s2e.md) * [5.4 数据流分析](doc/5.4_dataflow_analysis.md) * [5.4.1 Soot](doc/5.4.1_soot.md) * [5.5 污点分析](doc/5.5_taint_analysis.md) * [5.5.1 TaintCheck](doc/5.5.1_taintcheck.md) * [5.6 LLVM](doc/5.6_llvm.md) * [5.6.1 Clang](doc/5.6.1_clang.md) * [5.7 程序切片](doc/5.7_slicing.md) * [5.8 SAT/SMT](doc/5.8_sat-smt.md) * [5.8.1 Z3](doc/5.8.1_z3.md) * [5.9 基于模式的漏洞分析](doc/5.9_pattern_based_analysis.md) * [5.10 基于二进制比对的漏洞分析](doc/5.10_diff_based_analysis.md) * [5.11 反编译技术](doc/5.11_decompiling.md) * [5.11.1 RetDec](doc/5.11.1_retdec.md) * [六、题解篇](doc/6_writeup.md) * Pwn * [6.1.1 pwn HCTF2016 brop](doc/6.1.1_pwn_hctf2016_brop.md) * [6.1.2 pwn NJCTF2017 pingme](doc/6.1.2_pwn_njctf2017_pingme.md) * [6.1.3 pwn XDCTF2015 pwn200](doc/6.1.3_pwn_xdctf2015_pwn200.md) * [6.1.4 pwn BackdoorCTF2017 Fun-Signals](doc/6.1.4_pwn_backdoorctf2017_fun_signals.md) * [6.1.5 pwn GreHackCTF2017 beerfighter](doc/6.1.5_pwn_grehackctf2017_beerfighter.md) * [6.1.6 pwn DefconCTF2015 fuckup](doc/6.1.6_pwn_defconctf2015_fuckup.md) * [6.1.7 pwn 0CTF2015 freenote](doc/6.1.7_pwn_0ctf2015_freenote.md) * [6.1.8 pwn DCTF2017 Flex](doc/6.1.8_pwn_dctf2017_flex.md) * [6.1.9 pwn RHme3 Exploitation](doc/6.1.9_pwn_rhme3_exploitation.md) * [6.1.10 pwn 0CTF2017 BabyHeap2017](doc/6.1.10_pwn_0ctf2017_babyheap2017.md) * [6.1.11 pwn 9447CTF2015 Search-Engine](doc/6.1.11_pwn_9447ctf2015_search_engine.md) * [6.1.12 pwn N1CTF2018 vote](doc/6.1.12_pwn_n1ctf2018_vote.md) * [6.1.13 pwn 34C3CTF2017 readme_revenge](doc/6.1.13_pwn_34c3ctf2017_readme_revenge.md) * [6.1.14 pwn 32C3CTF2015 readme](doc/6.1.14_pwn_32c3ctf2015_readme.md) * [6.1.15 pwn 34C3CTF2017 SimpleGC](doc/6.1.15_pwn_34c3ctf2017_simplegc.md) * [6.1.16 pwn HITBCTF2017 1000levels](doc/6.1.16_pwn_hitbctf2017_1000levels.md) * [6.1.17 pwn SECCONCTF2016 jmper](doc/6.1.17_pwn_secconctf2016_jmper.md) * [6.1.18 pwn HITBCTF2017 Sentosa](doc/6.1.18_pwn_hitbctf2017_sentosa.md) * [6.1.19 pwn HITBCTF2018 gundam](doc/6.1.19_pwn_hitbctf2018_gundam.md) * [6.1.20 pwn 33C3CTF2016 babyfengshui](doc/6.1.20_pwn_33c3ctf2016_babyfengshui.md) * [6.1.21 pwn HITCONCTF2016 Secret_Holder](doc/6.1.21_pwn_hitconctf2016_secret_holder.md) * [6.1.22 pwn HITCONCTF2016 Sleepy_Holder](doc/6.1.22_pwn_hitconctf2016_sleepy_holder.md) * [6.1.23 pwn BCTF2016 bcloud](doc/6.1.23_pwn_bctf2016_bcloud.md) * [6.1.24 pwn HITCONCTF2016 House_of_Orange](doc/6.1.24_hitconctf2016_house_of_orange.md) * [6.1.25 pwn HCTF2017 babyprintf](doc/6.1.25_pwn_hctf2017_babyprintf.md) * [6.1.26 pwn 34C3CTF2017 300](doc/6.1.26_pwn_34c3ctf2017_300.md) * [6.1.27 pwn SECCONCTF2016 tinypad](doc/6.1.27_pwn_secconctf2016_tinypad.md) * [6.1.28 pwn ASISCTF2016 b00ks](doc/6.1.28_pwn_asisctf2016_b00ks.md) * [6.1.29 pwn Insomni'hack_teaserCTF2017 The_Great_Escape_part-3](doc/6.1.29_pwn_insomnictf2017_the_great_escape3.md) * [6.1.30 pwn HITCONCTF2017 Ghost_in_the_heap](doc/6.1.30_pwn_hitconctf2017_ghost_in_the_heap.md) * [6.1.31 pwn HITBCTF2018 mutepig](doc/6.1.31_pwn_hitbctf2018_mutepig.md) * [6.1.32 pwn SECCONCTF2017 vm_no_fun](doc/6.1.32_pwn_secconctf2017_vm_no_fun.md) * [6.1.33 pwn 34C3CTF2017 LFA](doc/6.1.33_pwn_34c3ctf2017_lfa.md) * [6.2.34 pwn N1CTF2018 memsafety](doc/6.1.34_pwn_n1ctf2018_memsafety.md) * Reverse * [6.2.1 re XHPCTF2017 dont_panic](doc/6.2.1_re_xhpctf2017_dont_panic.md) * [6.2.2 re ECTF2016 tayy](doc/6.2.2_re_ectf2016_tayy.md) * [6.2.3 re CodegateCTF2017 angrybird](doc/6.2.3_re_codegatectf2017_angrybird.md) * [6.2.4 re CSAWCTF2015 wyvern](doc/6.2.4_re_csawctf2015_wyvern.md) * [6.2.5 re PicoCTF2014 Baleful](doc/6.2.5_re_picoctf2014_baleful.md) * [6.2.6 re SECCONCTF2017 printf_machine](doc/6.2.6_re_secconctf2017_printf_machine.md) * [6.2.7 re CodegateCTF2018 RedVelvet](doc/6.2.7_re_codegatectf2018_redvelvet.md) * [6.2.8 re DefcampCTF2015 entry_language](doc/6.2.8_re_defcampctf2015_entry_language.md) * Web * [6.3.1 web HCTF2017 babycrack](doc/6.3.1_web_hctf2017_babycrack.md) * Crypto * Misc * Mobile * [七、实战篇](doc/7_exploit.md) * CVE * [7.1.1 CVE-2017-11543 tcpdump sliplink_print 栈溢出漏洞](doc/7.1.1_tcpdump_2017-11543.md) * [7.1.2 CVE-2015-0235 glibc __nss_hostname_digits_dots 堆溢出漏洞](doc/7.1.2_glibc_2015-0235.md) * [7.1.3 CVE-2016-4971 wget 任意文件上传漏洞](doc/7.1.3_wget_2016-4971.md) * [7.1.4 CVE-2017-13089 wget skip_short_body 栈溢出漏洞](doc/7.1.4_wget_2017-13089.md) * [7.1.5 CVE–2018-1000001 glibc realpath 缓冲区下溢漏洞](doc/7.1.5_glibc_2018-1000001.md) * [7.1.6 CVE-2017-9430 DNSTracer 栈溢出漏洞](doc/7.1.6_dnstracer_2017-9430.md) * [7.1.7 CVE-2018-6323 GNU binutils elf_object_p 整型溢出漏洞](doc/7.1.7_binutils_2018-6323.md) * [7.1.8 CVE-2010-2883 Adobe CoolType SING 表栈溢出漏洞](doc/7.1.8_adobe_reader_2010-2883.md) * [7.1.9 CVE-2010-3333 Microsoft Word RTF pFragments 栈溢出漏洞](doc/7.1.9_ms_word_2010-3333.md) * Malware * [八、学术篇](doc/8_academic.md) * [8.1 The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86)](doc/8.1_ret2libc_without_calls.md) * [8.2 Return-Oriented Programming without Returns](doc/8.2_rop_without_ret.md) * [8.3 Return-Oriented Rootkits: Bypassing Kernel Code Integrity Protection Mechanisms](doc/8.3_rop_rootkits.md) * [8.4 ROPdefender: A Detection Tool to Defend Against Return-Oriented Programming Attacks](doc/8.4_ropdefender.md) * [8.5 Data-Oriented Programming: On the Expressiveness of Non-Control Data Attacks](doc/8.5_dop.md) * [8.6 Hacking Blind](doc/8.6_brop.md) * [8.7 What Cannot Be Read, Cannot Be Leveraged? Revisiting Assumptions of JIT-ROP Defenses](doc/8.7_jit-rop_defenses.md) * [8.8 All You Ever Wanted to Know About Dynamic Taint Analysis and Forward Symbolic Execution (but might have been afraid to ask)](doc/8.8_dta_and_fse.md) * [8.9 Symbolic Execution for Software Testing: Three Decades Later](doc/8.9_symbolic_execution.md) * [8.10 AEG: Automatic Exploit Generation](doc/8.10_aeg.md) * [8.11 Address Space Layout Permutation (ASLP): Towards Fine-Grained Randomization of Commodity Software](doc/8.11_aslp.md) * [8.12 ASLR on the Line: Practical Cache Attacks on the MMU](doc/8.12_aslr_on_the_line.md) * [8.13 New Frontiers of Reverse Engineering](doc/8.13_reverse_engineering.md) * [8.14 Who Allocated My Memory? Detecting Custom Memory Allocators in C Binaries](doc/8.14_detecting_memory_allocators.md) * [8.15 EMULATOR vs REAL PHONE: Android Malware Detection Using Machine Learning](doc/8.15_emu_vs_real.md) * [8.16 DynaLog: An automated dynamic analysis framework for characterizing Android applications](doc/8.16_dynalog.md) * [8.17 A Static Android Malware Detection Based on Actual Used Permissions Combination and API Calls](doc/8.17_actual_permissions.md) * [8.18 MaMaDroid: Detecting Android malware by building Markov chains of behavioral models](doc/8.18_malware_markov.md) * [8.19 DroidNative: Semantic-Based Detection of Android Native Code Malware](doc/8.19_droidnative.md) * [8.20 DroidAnalytics: A Signature Based Analytic System to Collect, Extract, Analyze and Associate Android Malware](doc/8.20_droidanalytics.md) * [8.21 Micro-Virtualization Memory Tracing to Detect and Prevent Spraying Attacks](doc/8.21_tracing_to_detect_spraying.md) * [8.22 Practical Memory Checking With Dr. Memory](doc/8.22_memory_checking.md) * [8.23 Evaluating the Effectiveness of Current Anti-ROP Defenses](doc/8.23_current_anti-rop.md) * [8.24 How to Make ASLR Win the Clone Wars: Runtime Re-Randomization](doc/8.24_runtime_re-randomization.md) * [8.25 (State of) The Art of War: Offensive Techniques in Binary Analysis](doc/8.25_angr.md) * [8.26 Driller: Augmenting Fuzzing Through Selective Symbolic Execution](doc/8.26_driller.md) * [8.27 Firmalice - Automatic Detection of Authentication Bypass Vulnerabilities in Binary Firmware](doc/8.27_firmalice.md) * [8.28 Cross-Architecture Bug Search in Binary Executables](doc/8.28_cross_arch_bug.md) * [8.29 Dynamic Hooks: Hiding Control Flow Changes within Non-Control Data](doc/8.29_dynamic_hooks.md) * [8.30 Preventing brute force attacks against stack canary protection on networking servers](doc/8.30_prevent_brute_force_canary.md) * [8.31 WYSINWYX What You See Is Not What You eXecute](doc/8.31_wysinwyx.md) * [8.32 Unleashing MAYHEM on Binary Code](doc/8.32_mayhem.md) * [8.33 Under-Constrained Symbolic Execution: Correctness Checking for Real Code](doc/8.33_ucklee.md) * [8.34 Enhancing Symbolic Execution with Veritesting](doc/8.34_veritesting.md) * [8.35 Q: Exploit Hardening Made Easy](doc/8.35_q.md) * [8.36 A Survey of Symbolic Execution Techniques](doc/8.36_survey_symbolic_execution.md) * [8.37 CUTE: A Concolic Unit Testing Engine for C](doc/8.37_cute.md) * [8.38 TaintEraser: Protecting Sensitive Data Leaks Using Application-Level Taint Tracking](doc/8.38_tainteraser.md) * [8.39 DART: Directed Automated Random Testing](doc/8.39_dart.md) * [8.40 EXE: Automatically Generating Inputs of Death](doc/8.40_exe.md) * [8.41 IntPatch: Automatically Fix Integer-Overflow-to-Buffer-Overflow Vulnerability at Compile-Time](doc/8.41_intpatch.md) * [8.42 Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software](doc/8.42_taintcheck.md) * [8.43 DTA++: Dynamic Taint Analysis with Targeted Control-Flow Propagation](doc/8.43_dta++.md) * [8.44 Superset Disassembly: Statically Rewriting x86 Binaries Without Heuristics](doc/8.44_multiverse.md) * [8.45 Ramblr: Making Reassembly Great Again](doc/8.45_ramblr.md) * [8.46 FreeGuard: A Faster Secure Heap Allocator](doc/8.46_freeguard.md) * [8.47 Jump-Oriented Programming: A New Class of Code-Reuse Attack](doc/8.47_jop.md) * [8.48 Reassembleable Disassembling](doc/8.48_uroboros.md) * [8.49 Understanding Integer Overflow in C/C++](doc/8.49_ioc.md) * [九、附录](doc/9_appendix.md) * [9.1 更多 Linux 工具](doc/9.1_Linuxtools.md) * [9.2 更多 Windows 工具](doc/9.2_wintools.md) * [9.3 更多资源](doc/9.3_books_blogs.md) * [9.4 Linux 系统调用表](doc/9.4_linux_syscall.md) * [9.5 幻灯片](doc/9.5_slides.md)