Offensive-Resources - A Huge Learning Resources with Labs For Offensive

项目说明

Offensi V4

((اللَّهُمَّ انْفَعْنِي بِمَا عَلَّمْتَنِي، وَعَلِّمْنِي مَا يَنْفَعُنِي، وَزِدْنِي عِلْمًا))
<hr>

A Huge Learning Resources with Labs For Offensi Players.

> E is welcome to pull requests and add new resources, fix false-positives and more. "Every update will be added to the website:.

Now You can visit the website and explore all the resources:

What is new in V4 ?

Content

- <a href="#infrastructure">Infrastructure</a>
- <a href="#wireless">Wireless</a>
- <a href="#iot--hardware">IoT & Hardware</a>
- <a href="#ics-and-scada">ICS and SCADA</a>
- <a href="#exploit-de">Exploit De</a>
- <a href="#web-applications">Web Applications</a>
- <a href="#mobile-applications">Mobile Applications</a>
- <a href="#api">API</a>
- <a href="#cloud">Cloud</a>
- <a href="#re">Reverse Engineering</a>
- <a href="#social-engineering">Social Engineering</a>
- <a href="#offensi">Offensi</a>
- <a href="#blockchain">Blockchain</a>
- <a href="#car-hacking">Car Hacking</a>
- <a href="#game-hacking">Game Hacking</a>
- <a href="#source-code-review">Source Code Review</a>
- <a href="#telecom">Telecom</a>
- <a href="#malware-de">Malware De</a>
- <a href="#voip">VOIP</a>
- <a href="#rfid--sdr">RFID & SDR</a>
- <a href="#atm-hacking">ATM Hacking</a>
- <a href="#aircraft-hacking">Aircraft Hacking</a>
- <a href="#ai-hacking">AI Hacking</a>
- <a href="#de">De</a>
- <a href="#linux-exploit-de">Linux Exploit De</a>
- <a href="#windows-exploit-de">Windows Exploit De</a>
- <a href="#android-exploit-de">Android Exploit De</a>
- <a href="#ios-exploit-de">iOS Exploit De</a>
- <a href="#browser-exploitation">Browser Exploitation</a>
- <a href="#hyper">Hypervisor Exploitation</a>
- <a href="#drones-hacking">Drones Hacking</a>
- <a href="#medtech-hacking">MedTech Hacking</a>
- <a href="#cpu-exploitation">CPU Exploitation</a>
- <a href="#gpu-exploitation">GPU Exploitation</a>
- <a href="#macos-exploitation">macOS Exploitation</a>
- <a href="#satellite-hacking">Satellite Hacking</a>
- <a href="#robots-hacking">Robots Hacking</a>
- <a href="#"> Machine Hacking</a>
- <a href="#osint">OSINT</a>

Infrastructure

Books

- <a href=" Hacker's Handbook</a>
- <a href=" Infrastructure Penetration testing</a>
- <a href=" playbook series</a>
- <a href=" Art of Network Penetration Testing</a>
- <a href=" Kali Linux for Ad Penetration Testing </a>
- <a href=" Penetration Testing for Highly-Secured En</a>
- <a href=" Penetration Testing </a>
- <a href=" Penetration Testing on Windows</a>
- <a href=" Wireless Penetration Testing for Highly Secured En</a>
- <a href=" - Attack and Defense Strategies</a>
- <a href=" Red Team Field Manual</a>
- <a href=" Testing: A Hands-on Introduction to Hacking</a>
- <a href=" Hacking Firewalls & Bypassing Honeypot</a>
- <a href=" Team De and Operations: A practical guide </a>
- <a href=" Red Team Tactics</a>

Courses

- <a href="
- <a href="
- <a href="
- <a href="
- <a href="
- <a href="
- <a href="
- <a href=" Ethical Hacking</a>
- <a href=" Pri Escalation for Beginners</a>
- <a href=" Pri Escalation for Beginners</a>
- <a href=" Pi, and Persistence</a>
- <a href=" External Pentest Playbook</a>
- <a href="
- <a href="
- <a href="
- <a href="
- <a href="

Labs

- <a href=" Pentesting Labs for Ad Penetration Testing></a>
- <a href=" The Box: Pro Labs</a>
- <a href=" Team Attack Lab</a>
- <a href=" Pentest</a>
- <a href=" a Lab</a>
- <a href=" Lab</a>
- <a href=" PentestLab Management Script</a>
- <a href="
- <a href=" Lab</a>
- <a href=" Labs</a>
- <a href=" The Box</a>
- <a href="
- <a href=" Proving Grounds</a>
- <a href="

Wireless

- Books
- <a href=" 5 Wireless Penetration Testing Beginner's Guide</a>
- <a href=" Linux Wireless Penetration Testing Cookbook</a>
- <a href=" Wireless Penetration Testing for Highly Secured En</a>

- Courses
- <a href="
- <a href=" Security and Pentesting</a>
- <a href=" Hacking and Wireless Penetration Testing Course </a>
- <a href=" Wireless Penetration Testing and Ethical Hacking</a>

- Labs
- <a href=" a Pentesting Lab for Wireless Networks</a>
- The Courses and Books ha how to build a lab

IoT & Hardware

- Books
- <a href=" IoT Hacking: The Definiti to Attacking the Internet of Things</a>
- <a href=" IoT Hacker's Handbook: A Practical Guide to Hacking the Internet of Things</a>
- <a href=" Penetration Testing Cookbook: Identify and Secure Your Smart Devices</a>
- <a href=" Hardware Hacking Handbook: Breaking Embedded Security with Hardware Attacks</a>
- <a href=" Hardware Pentesting: A Guide to Attacking Embedded Systems and Protecting Them Against the Most Common Hardware Attacks</a>

- Courses
- <a href=" IoT Penetration Testing</a>
- <a href=" IoT Exploitation</a>
- <a href=" IoT: From Security to Practical Pentesting on IoT </a>
- <a href=" Physical Attacks Series</a>

- Labs
- The Courses and Books ha how to build a lab

ICS and SCADA

- Books
- <a href=" Exposed Industrial Control Systems: ICS and SCADA Security Secrets & Solutions</a>
- <a href=" SCADA/Industrial Control Systems: The Pentest Guide</a>
- <a href=" of SCADA/Control Systems Security</a>
- <a href=""></a>

- Courses
- <a href=" Cybersecurity (Ec council)</a>
- <a href=" ICS/SCADA Security Essentials</a>

- Labs
- The Courses and Books ha how to build a lab

Exploit De

- Books
- <a href=" Testing with Shellcode</a>
- <a href=" Shellcoder's Handbook</a>
- <a href=" The Art of Exploitation</a>
- <a href=" Network Protocols: A Hacker's Guide to Capture, Analysis, and Exploitation</a>
- <a href=" Bug Hunter's Diary</a>
- <a href=" O Attacks: Detect, Exploit, Prevent</a>
- <a href=" Exploit De for Beginners</a>
- <a href=" Brute Force Discovery</a>
- <a href=" for Software Security Testing and Quality Assurance</a>
- <a href=" Fuzzing Book</a>
- <a href=" Source Fuzzing Tools</a>
- <a href=" Guide to Kernel Exploitation</a>

- Courses
- <a href="
- <a href="
- <a href="
- <a href="
- <a href=" Repo</a>
- <a href="
- <a href=" Assembly Language and Shellcoding on Linux</a>
- <a href=" 127: Exploit De</a>
- <a href=" Assembly Language and Shellcoding on Linux</a>
- <a href=" Engineering Win32 Applications</a>
- <a href=" Engineering Linux 32-bit Applications</a>
- <a href=" Simple Buffer O on Win32</a>
- <a href=" Engineering and Exploit De </a>
- <a href=" De for Linux (x86)</a>
- <a href=" De for Linux x64</a>
- <a href=" to Exploit/Zero-Day Discovery and De</a>
- <a href=" De From Scratch</a>
- <a href=" Fuzzing and Exploit De(Part 1)</a>
- <a href=" Fuzzing and Exploit De(Part 2)</a>
- <a href=" Exploit De</a>

- Labs
- Analyize previous and new zero-days will dive you deep into the real-world
- <a href=" collage</a>
- <a href="
- <a href="
- <a href="">BlazeDVD 5 Professional</a>
- <a href="">D</a>
- <a href="">Easy CD DVD</a>
- <a href="">Easy Chat Server 3.1</a>
- <a href="">Easy File Sharing FTP Server 3.5</a>
- <a href="">Easy File Management Web Server 5.3</a>
- <a href="">Easy File Sharing Web Server 7.2</a>
- <a href="">Easy RM to MP3 Con 2.7.3.7</a>
- <a href="">Eureka</a>
- <a href="">FreeFTP 1.0.8 </a>
- <a href="">FreeFloat</a>
- <a href="">KarjaSoft Sami FTP Server 2.0.1</a>
- <a href="">KnFTP Server 1.0.0</a>
- <a href="">Kolibri v2.0 HTTP Server</a>
- <a href="">Millenium MP3 Studio</a>
- <a href="">Minialic HTTP</a>
- <a href="">Minishare</a>
- <a href="">ProSysInfo TFTP Ser 0.4.2</a>
- <a href="">QuickZip 4.60</a>
- <a href="">R v3.4.4</a>
- <a href="">Ricoh DC Software DL-10 FTP Server</a>
- <a href="">SolarFTP</a>
- <a href="">Soritong MP3 Player 1.0 </a>
- <a href="">Xitami Webserver 2.5</a>
- <a href="
- <a href=" the box</a>

Web Applications

- Books
- <a href=" Application Hacker's Handbook</a>
- <a href=" learning materials</a>
- <a href=" web Testing Guide</a>
- <a href=" World Bug Hunting</a>
- <a href=" Bounty playbook part 1 & 2</a>
- <a href=" Modern Web Penetration Testing</a>
- <a href=" Kali Linux for Web Penetration Testing</a>
- <a href=" Linux Web Penetration Testing Cookbook</a>
- <a href=" Bounty Bootcamp</a>

- Courses
- <a href="
- <a href="
- <a href="
- <a href="
- <a href="
- <a href=" bug bounty hunter part 1 &2 hackersera</a>
- <a href=" Application Attacks and API Hacking (W51)</a>

- Labs
- <a href="
- <a href="
- <a href=" labs</a>
- <a href=" me</a>
- <a href=" Juice shop</a>
- <a href=" Broken Web Apps </a>
- <a href="
- <a href="

Mobile Applications

- Books
- <a href=" Mobile Security Testing Guide</a>
- <a href=" application penetration testing</a>
- <a href=" applicatons hacker's handbook</a>
- <a href=" hacker's handbook/</a>
- <a href=" Hacker's Handbook</a>

- Courses
- <a href="
- <a href="
- <a href="
- <a href=" Hacking & Penetration Testing</a>
- <a href=" and Pentesting iOS Applications </a>

- Labs
- <a href=" iOS Application (DVIA)</a>
- <a href=" of intentionally Android apps</a>
- <a href=" Mobile iPhone Labs </a>
- <a href=" Mobile Android Labs </a>

API

- Books
- <a href=" API Security Project</a>
- <a href=" APIs</a>
- <a href=" Secuirty in Action</a>
- <a href=" Api Security</a>

- Courses
- <a href=" Offensive API Exploitation and Security</a>
- <a href=" Top 10: API Security Playbook</a>
- <a href=" Api penetration testing</a>
- <a href=" Application Attacks and API Hacking (W51)</a>
- <a href=" Security: Offence and Defence (W35)</a>

- Labs
- <a href=" API</a>
- <a href="
- <a href="

Cloud

- Books
- <a href=" Penetration Testing </a>
- <a href=" AWS Penetration Testing with Kali Linux</a>
- <a href=" Azure Applications</a>
- <a href=" Cloud Penetration Testing</a>

- Courses
- <a href="

- Labs
- <a href=" Pen-Testing Laboratory</a>
- Create Your own lab from the books

Reverse Engineering

- Books
- <a href=" Secrets of Reverse Engineering</a>
- <a href=" Reverse Engineering</a>
- <a href=" Engineering for Beginners</a>
- <a href="">The Ghidra Book: The Definiti</a>
- <a href=" IDA Pro Book, 2nd Edition</a>
- <a href=" Reverse Engineering</a>

- Courses
- <a href="
- <a href=" Re Malware</a>
- <a href=" Engineering Deep Dive</a>
- <a href=" Engineering: IDA For Beginners</a>
- <a href=" Malware Analysis and Reverse Engineering</a>
- <a href=" Engineering 1: x64dbg Debugger for Beginners </a>
- <a href=" Engineering: Ghidra For Beginners </a>
- <a href=" Engineering 6: Re .NET with dnSpy </a>
- <a href=" Engineering For Beginners (Youtube)</a>

- Labs
- <a href=" Reverse Engineering</a>
- <a href=" Reverse Engineering CTF</a>
- <a href=" Engineering CTF List</a>

Social Engineering

- Books
- <a href=" Engineering: The Science of Human Hacking</a>
- <a href=" Engineering: The Art of Human Hacking</a>
- <a href=" Social Engineer's Playbook</a>
- <a href=" Engineering: Hacking Systems, Nations, and Societies</a>
- <a href=" Social Engineering</a>

- Courses
- <a href=" Social Engineering From Scratch</a>
- <a href=" Complete Social Engineering: Phishing & Malware</a>
- <a href=" Social Engineering Training</a>
- <a href=" Engineering (Cybrary)</a>

- Labs
- Bro, it's about human hacking. Just hack yourself xD

Offensi

- Books
- <a href=" Penetration Testing with Python</a>
- <a href=" Penetration Testing Cookbook</a>
- <a href=" for Offensi</a>
- <a href=" Hat Python</a>
- <a href=" Hat C#: A Hacker's Guide to Creating and Automating Security Tools</a>
- <a href=" Hat Go: Go Programming For Hackers and Pentesters </a>
- <a href=" with Go</a>
- <a href=" Testing with PerL</a>
- <a href=" Hat Ruby</a>

- Courses
- I encourage you to read the books, cause there are a lot of courses for offensi but the most are using python.
- <a href=" Python & Ethical Hacking From Scratch</a>
- <a href=" Complete Python Hacking Course: Beginner to Ad! </a>
- <a href=" Bash Scripting</a>
- <a href=" for Pentesters</a>

- Labs
- First of all try to create automation tools for your tasks. also you can search for offensi and try to write one on your own way.
- Tools:
- <a href="">Subdomain Enumeration</a>
- <a href="">Directory Bruteforcing</a>
- <a href="">Li checker</a>
- <a href="">Google Dorking</a>
- <a href="">Extract ja urls using page source</a>
- <a href="">Reverse & Bind Shells</a>
- <a href="">Protocol Enumeration</a>
- <a href="">Port Scanner (TCP & UDP)</a>
- <a href="">Hash & Password Cracking</a>
- <a href="">Fuzzer</a>
- <a href="">Malware ( Keylogger, Spyware, CryptoMalware, etc)</a>
- <a href="">Packet Sniffer</a>
- <a href="">Wifi Scanner or Bruteforcer</a>
- <a href=""> Scanner ( Web, Network & System , etc )</a>
- <a href="">Exploition Tool ( Try to write an exploition tool for known [e.x: backdoor exploition tool] ) </a>
- <a href="">Network Sniffer</a>
- <a href="">MAC address Changer</a>
- <a href="">Network Scanner</a>

Blockchain

- Books
- <a href=" and Blockchain Security</a>
- <a href=" Technology And Hacking</a>
- <a href=" Cybersecurity with Blockchain</a>

Courses

- <a href=" Blockchain Security Professional (CBSP)</a>
- <a href=" Blockchain and Smart Contract Security</a>
- <a href=" Security Expert (CBSE)</a>
- <a href=" and Defence in Blockchain Technologies (W39)</a>
- <a href="
">Decentralized Application Security Project </a>

Labs

- <a href=" contract security best practices</a>
- <a href="
- <a href="

Car Hacking

- Books
- <a href=" Car Hacker's Handbook</a>
- <a href=" Connected Cars</a>

- Courses
- <a href=" HACKING 101</a>
- <a href=" for Beginners</a>
- <a href=" Hacking Training: Automoti and In- Networks for Beginners</a>
- <a href=" car hacking</a>

- Labs
- Setup your lab from the courses & books

Game Hacking

- Books
- <a href=" Online Games</a>
- <a href=" Hacking: De Autonomous Bots for Online Games</a>
- <a href=" Video Game Consoles</a>
- <a href=" Console Hacking: Xbox, PlayStation, Nintendo, Game Boy, Atari and Sega</a>
- <a href=" the Xbox: An Introduction to Reverse Engineering</a>

- Courses
- <a href=" Game Hacking Course</a>
- <a href=" How To Code a Hack For ANY Game! - Game Hacking </a>
- <a href=" Hacking: Cheat Engine Game Hacking Basics</a>
- <a href=" Hacking Shenanigans - Game Hacking Tutorial Series</a>
- <a href=" Hacking Tutorial</a>

- Labs
- Setup your lab from the courses & books

Source Code Review

- Books
- <a href=" COMPUTER SOFTWARE DE: INTRODUCTION TO DETECTION TOOLS</a>
- <a href=" Guide</a>
- <a href=" Programming with Static Analysis: Getting Software Security Right with Static Analysis</a>
- <a href=" Code Review Guide v2</a>
- <a href=" ultimate guide to code reviews - Edition I</a>

- Courses (Tutorials)
- <a href="
- <a href=" to do Code Review - The Offensi Way</a>
- <a href=" to find by source code review</a>
- <a href=" Security through Code Review - The OWASP way</a>
- <a href=" DevSlop Show: Security Code Review 101 with Paul Ionescu!</a>
- <a href=" to Analyze Code for </a>

- Labs
- <a href=" Code Review</a>
- <a href=" Source Code</a>
- <a href="
">S</a>

Telecom

- Books
- <a href="
">Security for Telecommunications Networks</a>

- Courses
- <a href=" Network Hacking, IP Edition</a>
- <a href=" Era in Telecom Hacking by Ali Abdollahi at BSides Toronto 2020</a>

- Labs
- Setup your lab from the courses & books

Malware De

Books

- You can read malware analysis books to get a deep understanding of malwares

Courses

- <a href=" TEAM Operator: Malware De Essentials Course</a>
- <a href=" TEAM Operator: Malware De Intermediate Course</a>
- <a href=" Undetectable Malware Using C Language: Ethical Hacking</a>
- <a href=" Malware De For Beginners</a>
- <a href=" Botnet & Backdoor In Python For Ethical Hacking</a>
- <a href=" Hacking Foundations: Malware De in Windows</a>

- Labs
- No need for online labs you need to write a malicious code

VOIP

- Books
- <a href=" VoIP: Protocols, Attacks, and Countermeasures</a>
- <a href=" Exposed VoIP: Voice Over IP Security Secrets & Solutions</a>
- <a href=" Exposed Unified Communications & VoIP Security Secrets & Solutions, Second Edition</a>

- Courses
- <a href=" Pentesting (W47)</a>
- <a href=" Hacking & Penetration Testing Training</a>
- <a href=" pentest and SIP hacking</a>

- Labs
- Setup your lab from the courses & books

RFID & SDR

- Books
- <a href=" Security</a>
- <a href=" Radio: An Attack and Defense Guide</a>

- Courses
- <a href=" RFID Hacking</a>
- <a href=" Exploitation</a>
- <a href=" for Ethical Hackers and Security Researchers </a>
- <a href=" SDR for Ethical Hackers Security Researchers 2.0</a>
- <a href=" for Ethical Hackers and Security Researchers 3.0</a>

- Labs
- Setup your lab from the courses & books

ATM Hacking

A curated collection of resources co ATM security research, penetration testing, malware analysis, and defensi.

---

Books

- <a href=" Robbery: ATM Hacking and Implications</a>
- <a href=" Security Analysis, Hacking of Banking EM, ATM, CHIP, PIN & Attacks</a>
- <a href=" in on ATM Malware (Trend Micro / Europol)</a>
- <a href=" ATM Hacking Case (SpringerLink Chapter)</a>
- <a href=" Paper on ATM Security (CEUR-WS)</a>
- <a href=" Next-Gen ATMs: From Capture to Cashout (Black Hat 2016)</a>
- <a href=" Cash E through ATM Exploitation (DEF CON 28)</a>
- <a href=" - Logical Attacks on ATMs (Group-IB Threat Report)</a>
- <a href=" Paper on ATM Security (Uni of South Florida)</a>
- <a href=" Use Case Analysis Example (RIT)</a>
- <a href=" Hacking (Scribd)</a>
- <a href=" Hacking 101 (Scribd)</a>
- <a href=" Hacking ISC Beijing 2018 (Scribd)</a>
- <a href=" Jackpotting (Scribd)</a>
- <a href=" Hack to Get Much More Money (Scribd)</a>
- <a href=" Hack (Scribd)</a>
- <a href=" an ATM Machine (Scribd)</a>

Courses

- <a href=" Hacking and Penetration Testing Training (CyberFox)</a>
- <a href=" Security Training (ATMIA Academy)</a>
- <a href=" Training Courses (ATMIA)</a>
- <a href=" in Practice 2 (includes ATM module)</a>
- <a href=" to ATM Penetration Testing (Ekoparty)</a>

Labs

- <a href=" ATM Malware Wall (Malware Samples)</a>
- <a href=" ATM CTF Challenge</a>
- <a href=" SDK & De En</a>
- <a href=" ATM Malware Sample</a>

Blogs/Series

- <a href=" Manipulating ATM Machines with Malware (Kaspersky)</a>
- <a href=" Malware from Latin America to the World (Kaspersky)</a>
- <a href=" Malware is Being Sold on Darknet Market (Kaspersky)</a>
- <a href=" Malware Landscape 2020-2022 (Kaspersky)</a>
- <a href=" ATMs and a Cup of Coffee - ATMJaDi (Kaspersky)</a>
- <a href=" Infector - Skimer (Kaspersky)</a>
- <a href=" and Non-Malware Ways for ATM Jackpotting (Kaspersky)</a>
- <a href=" Malware Landscape 2017-2019 (Kaspersky)</a>
- <a href=" 2018 Report (Positi)</a>
- <a href=" Can Be Hacked in Minutes (Positi)</a>
- <a href=" Patches ATM (Positi)</a>
- <a href=" Years of Dynamite: ATM Malware Retrospecti Talos)</a>
- <a href=" Penetration Testing (Infosec Institute)</a>
- <a href=" ATM Malware Analysis (Infosec Institute)</a>
- <a href=" ATMs: New Wave of Malware (Infosec Institute)</a>
- <a href=" Malware (Infosec Institute)</a>
- <a href=" in ATM Hacking (Trustwa)</a>
- <a href=" Pen Testing Essentials for Making ATMs Less Hackable (Trustwave)</a>
- <a href=" ATM Attack: A Technical Breakdown (Komodo)</a>
- <a href=" ATM Penetration Testing Methods (GBHackers)</a>
- <a href=" Hacking: Ad Methods for Finding Security </a>
- <a href=" ATM Malwares (XFS Analysis)</a>
- <a href=" Hacking Wiki (French)</a>
- <a href=" - ATM Jackpotting</a>
- <a href=" ATM Malware: Banks Give Away Cash</a>
- <a href=" Malware Tyupkin Spreads to U.S. (SC Magazine)</a>
- <a href=" You Need to Know About ATM Attacks - Part 1 (Malwarebytes)</a>
- <a href=" Attacks and Fraud - Part 2 (Malwarebytes)</a>
- <a href=" the Code: ATM Hacking Series - Part 1 (Medium)</a>
- <a href=" the Code: ATM Hacking Series - Part 2 (Medium)</a>
- <a href=" the Code: XFS Integrity Controls - Part 3 (Medium)</a>
- <a href=" the Code: Escaping Kiosk Mode - Part 4 (Medium)</a>
- <a href=" Security (Hacking Lab CZ)</a>
- <a href=" Replay Attack Audit (Hacking Lab CZ)</a>
- <a href=" Bank Heist Analysis (Group-IB)</a>
- <a href=" Jackpotting Whitepaper (Sepio Cyber)</a>
- <a href=" Web and ATM Hacking (CloudSEK)</a>

Presentations/Conferences/Papers

- <a href=" Hack ATM - OWASP London (2018)</a>
- <a href=" Security Publication (CyberTrends)</a>
- <a href=" Security Video Presentation (TIB A)</a>
- <a href=" Automated Teller Machines Redux - Barnaby Jack (Black Hat 2010)</a>
- <a href=" CON 18 Archive - Barnaby Jack Presentation</a>
- <a href=" Next-Gen ATMs: From Capture to Cash-Out - Weston Hecker (Black Hat 2016)</a>
- <a href=" Hacking - Frank Boldewin (ISC Beijing 2018)</a>
- <a href=" Security: A Case Study of Emerging Threats (ResearchGate)</a>
- <a href=" Analysis of ATM Malware Using CAPA (ResearchGate 2023)</a>
- <a href=" Hacking/Jackpotting – A Case Study (IRJET)</a>
- <a href=" Analysis and Detection Using Reverse Engineering (ResearchGate)</a>
- <a href=" Risk Assessment of Logical Attacks on CEN/XFS (JKU)</a>
- <a href=" 2019 (ATM Section)</a>
- <a href=" Hacking Video - Barnaby Jack Black Hat 2010 (SecurityWeek)</a>
- <a href=" the ATM Hacker at Work (MIT Technology Review)</a>
- <a href=" Barnaby Jack Jackpotting ATMs (Threatpost)</a>
- <a href=" Jack Hits ATM Jackpot at Black Hat (Computerworld)</a>
- <a href=" Say Jackpotting Flaws Tricked ATMs Into Spitting Out Cash (TechCrunch)</a>
- <a href=" Jack Hits The Jackpot With ATM Hack (Dark Reading)</a>
- <a href=" The Wrong Type of Jackpot (UH West Oahu)</a>

Notes

- <a href=" Hacking Wiki / Notes (French)</a>
- <a href=" ATM Malwares Guide</a>
- <a href=" Official Specification & SDK</a>
- <a href=" O (Wikipedia)</a>
- <a href=" - Next-Gen Standard (KAL)</a>
- <a href=" ATM Malware Threat Profiles</a>
- <a href=" Malware Profile (NJCCIC)</a>
- <a href=" ATM Hacking Methods (Archived)</a>
- <a href=" ATM Penetration Testing Methods (Archived)</a>
- <a href=" Hacking Article (Archive.is)</a>

Misc

- <a href=" ATM Hacking - Curated List (GitHub)</a>
- <a href=" (GitHub)</a>
- <a href=" / XFS4IoT Framework (GitHub)</a>
- <a href=" Report Collection - ATM Malware Reports (GitHub)</a>
- <a href=" (GitHub)</a>
- <a href=" (GitHub)</a>
- <a href=" - .NET Wrapper for CEN/XFS (GitHub)</a>
- <a href=" (GitHub)</a>
- <a href=" (GitHub)</a>
- <a href=" Topic on GitHub</a>
- <a href=" Threat Intelligence O (Google Cloud)</a>
- <a href=" (ATM Industry Association)</a>
- <a href=" ATM Penetration Testing</a>
- <a href=" ATM Jackpotting Whitepaper</a>
- <a href=" Hacking Report: Scenarios from 2018 ATM Hacks</a>
- <a href=" ATM Report</a>
- <a href=" Decade of ATM Malware E and Deployment</a>

- <a href=" Hacking Presentation</a>
- <a href=" Security Analysis</a>
- <a href=" Exploitation Techniques</a>
- <a href=" Malware Analysis</a>
- <a href=" Jackpotting Demo</a>
- <a href=" Security Research</a>
- <a href=" Hacking Talk</a>
- <a href=" Penetration Testing</a>

# AirCraft Hacking

## Books & Whitepapers

* A Cybersecurity: Foundations, Principles, and Applications
* Cyber-Security Challenges in A Industry: A Review of Current and Future Trends (MDPI 2022)
* Assessing Aircraft Security: A Comprehensi and Methodology for E (ACM 2023)
* Building an A Laboratory for Cybersecurity Testing (Martin Strohmeier PDF)
* A Review on Cybersecurity for Urban Air Mobility (NASA PDF)
* Cyber-Security Challenges in A Industry Survey (arXiv PDF)
* A Framework for A Cybersecurity (ResearchGate)
* Cyber Security Challenges in A Communication, Na, and Sur (ScienceDirect)
* A Cybersecurity: An O (Craiger & Kessler, Embry-Riddle 2018)
* ARINC 429 Cyber- and Data in Hardware-in-the-Loop Simulator (2024)
* Cyber Risk Landscape of the Global A Industry 2024 (SecurityScorecard)
* Commercial A Cybersecurity Threats in 2025 (Airways Magazine)
* The Types of Hackers and Cyberattacks in the A Industry (Journal of Transportation Security 2024)
* FAA Penetration Testing Training & Outreach (PDF)
* Hugo Teso: Aircraft Hacking - Practical Aero Series (HITB 2013 PDF)
* Simulating ADS-B and CPDLC Messages with SDR (Di PDF)
* Connected Aircraft: Cyber-Safety Risks, Insider Threat (Uni of Hawaii PDF)
* Phil Polstra: Cyber-hijacking Airplanes - Truth or Fiction (DEF CON 22 PDF)
* Brad RenderMan Haines: Hackers + Airplanes (DEF CON 20 PDF)
* UA: A New Domain for Cyber Power (CCDCOE PDF)
* Unmanned Aircraft Systems (UAS) in the Cyber Domain (New Prairie Press PDF)
* Cyber Threats to US A (Homeland Security Perspecti PDF)
* GAO Report: A Cybersecurity - FAA Should Fully Implement Key Practices (PDF)
* Cybersecurity in A: Addressing Cybersecurity Challenges (Critical Software PDF)
* A Cybersecurity: Scoping the Challenge (Atlantic Council PDF)
* Ci and CyberSecurity (National Academies PDF)
* SAE Standards on Cybersecurity - A Framework (PDF)
* A Cybersecurity Research Test Bed (INL Factsheet PDF)
* A Cyber Test and E (ITEA PDF)
* Safety : Attacking A Systems with Humans in the Loop (arXiv PDF)
* Assessment for Security in A Cyber-Physical Systems (ResearchGate PDF)
* FAA Aircraft Systems Information Security/Protection (ASISP) R&D (PDF)R&D.pdf)
* Airport Security Assessments Guidebook (PARAS PDF)
* ICAO A Cybersecurity Strategy (PDF)
* IATA Cyber Security Presentation (PDF)
* Deep Learning for Large-Scale Real-World ACARS and ADS-B Radio Signal Classification (arXiv PDF)
* On the Security of Satellite-Based Air Traffic Control (ADS-C) (NDSS 2024 PDF)
* ADS-B and ADS-C Communication in the Light of Digitalisation (SKYbrary PDF)
* Securing the Air-Ground Link in A (Oxford PDF)
* E the Security of Aircraft Systems (arXiv PDF)
* Economy Class Crypto: Exploring Weak Cipher in A (Oxford PDF)
* On the Implications of Spoofing and Jamming A Datalink Applications (ACSAC PDF)
* The ADS-B Protocol and Its Weaknesses (Di PDF)

Courses

* DEF CON Aerospace (Annual)
* IATA A Cyber Security (Classroom)
* IATA A Cyber Security ( Classroom)
* IATA A Cyber Security Management Diploma
* Tonex A Cybersecurity Training Bootcamp
* ICAO Foundations of A Cybersecurity Leadership and Technical Management
* AIAA A Cybersecurity Management Course
* UK CAA A Cybersecurity O Training
* A Cybersecurity Training (Airline-Cybersecurity.ch)
* A eLearning: Cyber Security in A
* JAA TO A Cyber Security

Labs

* DEF CON Aerospace : Drone Hacking Activity
* DEF CON Aerospace : ADS-B Recei Workshop (Raspberry Pi + RTL-SDR)
* DEF CON Aerospace : A Infrastructure Cyber Defense Challenges
* DEF CON Aerospace : Offensi in Space Workshop
* RTL-SDR Tutorial: Receiving Airplane Data with ACARS
* ACARS Decoding Guide (thebaldgeek)
* Lightweight ACARS Decoders for RTL-SDR (One Transistor)
* Decoding ADSC, ADSB, ACARS, VDL2, Iridium, HF-DL Messages

Blogs & Series

* ACARS Under the Hacker's Magnifier: A Security, SDR Fun (Medium 2025)
* RTL-SDR ACARS Tag Articles
* Frugal Radio: How To Decode L-band Satellite ACARS and CPDLC Messages
* More on Chris Roberts and A Security (Schneier on Security)
* Greatest Cyber Threats to Aircraft Come from the Ground (CSO Online)
* Skyhacked (Flight Safety Australia 2017)
* Hacker Uses Android to Remotely Attack and Hijack an Airplane (Computerworld)
* Boeing, IFE Experts Hit Back at Hacker Claims (Runway Girl Network)
* The Serious Threat of GPS Spoofing: An Analysis (A Week)
* Intel Brief on GPS Spoofing and Jamming in A (Dyami Services)
* What is GPS Spoofing in A (APG)
* GNSS Jamming and Spoofing (SKYbrary)
* GPS Spoofing: Should Operators Be Concerned? (NBAA 2024)
* GPS Spoofing - A Growing Risk for Flight Safety (EASA Community)
* GPS Spoofing and Jamming: Can We Keep A On Track?
* Mitigating the Effects on Aircraft of GNSS Jamming and Spoofing (AIN 2025)
* Manipulated GNSS Signals: Implications for Pilots (ECA)
* Inertial Reference Systems - GPS Spoofing/Jamming Solutions (Honeywell)
* The Cybersecurity Challenges of Modern A Systems (NXLog Blog)
* A and Aerospace Sectors Face Skyrocketing Cyber Threats (Resecurity)
* Ad A Cybersecurity Through Collecti (TAC)

Presentations & Conferences

* DEF CON 32 Aerospace Acti
* DEF CON 33 Aerospace Acti (2025)
* DEF CON 31 Aerospace Talk Schedule
* DEF CON 29 Aerospace (Space & Cybersecurity)
* Hugo Teso: Aircraft Hacking - Practical Aero Series (HITB 2013)
* A Cybersecurity Conference September 2025 London (Cyber Senate)
* RSA Conference: Securing A Systems with Cybersecurity
* Black Hat USA 2024 & DEF CON 32 August 2025 Las Vegas
* Assessment for Security in A Cyber-Physical Systems (IEEE)
* Pen Test Partners Events & Speaking
* EASA Compilation of A Cybersecurity

* EASA A Cybersecurity Compilation
* Mentour Pilot: Can Aircraft be Hacked?!
* ICAO Secretary General: Cyber-Security in A
* TomoNews US: Aircraft Hacking
* A Cybersecurity Tutorial Series

Tools & Frameworks

ADS-B Reception & Decoding:
* dump1090: Mode S Decoder for RTLSDR Devices
* dump1090-fa: FlightAware's Fork of dump1090
* PiAware: FlightAware's Raspberry Pi Flight Tracking Software
* FlightAware Ground Station Network
* tar1090: Web Interface for dump1090
* Radar Server: Aircraft Tracking Web Interface

ACARS Decoders:
* acarsdec: Multi-Channel ACARS Decoder with RTL-SDR Support
* AcarsDeco2: ACARS Decoder for Windows/Linux/Raspberry Pi/OS X
* JAERO: L-band Satellite ACARS Decoder
* dumpvdl2: VDL Mode 2 Message Decoder
* dumphfdl: HF Data Link Protocol Decoder

SDR Hardware:
* RTL-SDR Blog V3: USB DVB-T Software Defined Radio
* FlightAware Pro Stick Plus: Optimized ADS-B USB Receiver
* Airspy: High Performance SDR
* HackRF One: Software Defined Radio Platform
* BladeRF: Software Defined Radio Platform

Aircraft Tracking Platforms:
* FlightRadar24: Real-Time Flight Tracking
* ADS-B Exchange: Unfiltered Flight Tracking
* OpenSky Network: Open Air Traffic Data
* RadarBox: Li Tracker

Analysis & Research Tools:
* GNU Radio: Software Defined Radio Framework
* SDR#: Popular SDR Software for Windows
* GQRX: SDR Software for Linux/Mac
* Wireshark: Network Protocol Analyzer (with a protocol dissectors)

A Security Testing:
* Metasploit Pro: Penetration Testing Framework
* BackTrack Tools: Assessment Tools

Notes

* 2024-2025 Statistics: Cyberattacks on a increased by 74% since 2020; a industry experienced 24% increase in cyber attacks with 55 reported incidents in 2022
* Global Threat Landscape: A industry a a "B" cybersecurity rating; organizations with B rating are 2.9x more likely to suffer data breaches than those with A rating
* Major Incidents (2024-2025): Arab Ci Organization (ACAO) breach in February 2025; ICAO data breach with 42,000 documents exposed; Japan Airlines attack in December 2024 disrupting baggage services; Seattle-Tacoma Airport Rhysida ransomware attack in 2024
* Breach Statistics: In global a systems, breaches caused by hacking or information leakage increased from 4% in 2010 to 81% in 2024
* Attack : DDoS attacks represent 25% of cyber incidents targeting airlines and airports; GPS spoofing exploits weaknesses in aircraft na systems; malicious acts from hostile operators on ground or flight operations
* ACARS : ACARS transmits at 131.550 MHz unencrypted; has no encryption (messages sent in plain sight), no authentication (receiver can't sender), no integrity (no signature or hash)
* ADS-B Security Issues: ADS-B broadcasts detailed aircraft information (position, , identity) o data links; susceptible to ea, spoofing, and injection attacks
* ARINC 429 Protocol: Ubiquitous data bus for ci lacks any form of encryption or authentication; inherently insecure communication protocol to denial-of-service attacks
* GPS Spoofing/Jamming: GPS jamming prevents receivers from locking onto satellite signals; spoofing broadcasts counterfeit signals causing false positioning; particularly affects conflict zones (Black Sea, Middle East)
* Effects on Aircraft Systems: GPS spoofing can disable Inertial Reference System (IRS), cause failures in GPS Clock, Weather Radar, ADS-B, and Terrain Warning Systems; FMS can show aircraft more than 60nm off-track
* Detection Indicators: GPS position suddenly 100+ nm from FMS position; abnormally low groundspeed readings; significant difference between GPS altitude and actual altitude
* Notable Researchers: Hugo Teso (n.runs Professionals) demonstrated aircraft hacking via FMS computers and ACARS at HITB 2013; Chris Roberts (One World Labs) claimed IFE system hacks on 15-20 flights between 2011-2014
* Industry Response: Boeing and Airbus state IFE systems are isolated from flight and na systems; third-party penetration testing allowed during aircraft de; grey-box testing mimics malicious passenger actions
* DEF CON Aerospace : Annual gathering featuring drone hacking workshops, ADS-B recei using Raspberry Pi + RTL-SDR, a infrastructure cyber defense challenges, offensi cybersecurity sessions
* Lab Setup: Use RTL-SDR ($20-$30) with dump1090/PiAware for ADS-B reception; acarsdec/JAERO for ACARS decoding; GNU Radio for signal analysis; Raspberry Pi for portable tracking stations
* Countermeasures: Signal strength monitoring, time-of-arri, cryptographic authentication, multiple satellite na systems for cross-, enhanced pilot training, backup na systems
* Regulatory Bodies: FAA provides penetration testing training; ICAO offers cybersecurity leadership courses; EASA publishes a cybersecurity guidance; IATA provides industry-standard training programs
* Research Institutions: Embry-Riddle's Center for Aerospace Resilient Systems (CARS) researches AI/ML for a cybersecurity defense; SecurityScorecard conducts industry-wide cybersecurity assessments
* Legal Warning: Unauthorized access to aircraft systems, jamming GPS signals, or interfering with a communications is illegal and dangerous. All research must be conducted in authorized lab en with proper permissions
* Testing Limitations: Conducting penetration tests on li systems could impact operations and present safety risks; testing must use controlled en with simulated systems
* Ethical Considerations: A security research should be conducted responsibly with coordinated disclosure to manufacturers and regulatory bodies; focus on defensi and improving a safety
* Hardware Requirements: RTL-SDR V3 or FlightAware dongles for (blue dongles filtered for 1090 MHz ADS-B will not work on ); appropriate antennas for 1090 MHz (ADS-B) and 131.550 MHz (ACARS)
* Best Practices: Build receiving stations for passi only; ne on a frequencies; contribute data to open networks (FlightAware, ADS-B Exchange, OpenSky) for research purposes
* Future Trends: AI integration in a cybersecurity defense; quantum-resistant cryptography for a communications; enhanced authentication protocols for ACARS/ADS-B replacement systems

AI Hacking

Books & Whitepapers

* Not with a Bug, But with a Sticker (Book)
* Hacking Artificial Intelligence (Book)
* Redefining Hacking (Book)
* Large Language Models in Cybersecurity (Book)
* Hands-On Large Language Models (Book)
* Jailbreaking Large Language Models Chain Injection (Arxiv)
* Arxi 2508.21669
* LLM Agents can Autonomously Hack Websites (Whitepaper)
* NIST AI 100-2e2025: Ad Machine Learning Taxonomy (Updated 2025)
* CISO's GenAI Security Blueprint: 2025 OWASP Top 10 LLM Risks (Securiti Whitepaper)
* Securing AI Systems: A Guide to Known Attacks and Impacts (Arxiv 2025)
* A Comprehensi of Ad Attacks and Defense Strategies (MDPI 2025)
* Dataset & Lessons: 2024 SaTML LLM CTF (Arxiv)
* Prompt Injection Attacks in Defended Systems (Arxiv)
* Multi-Chain Prompt Injection Attacks (WithSecure Labs)
* Ad Machine Learning and Cybersecurity (Georgetown CSET)
* Prompt Hacking in LLMs 2024-2025 Literature Review

Courses

* HTB Academy: AI Red Teamer Path
* HTB Academy: Introduction to Red Teaming AI
* Antisyphon: Hacking AI/LLM Applications Workshop
* Udemy: Hands-on AI LLM Red Teaming
* Udemy: OWASP Top 10 for LLM Applications 2025
* SANS SEC545: GenAI and LLM Application Security
* TCM Security: AI Hacking 101
* Microsoft AI Red Team Training Series
* NVIDIA: Exploring Ad Machine Learning (Self-Paced)
* DeepLearning.AI: Red Teaming LLM Applications
* Learn Prompting: AI Red Teaming and AI Security Masterclass
* OffSec: LLM & AI Training for Red Teams
* Practical De: Certified AI Security Professional (CAISP)
* Tonex: Certified AI Penetration Tester – Red Team (CAIPT-RT)

Labs

* TryHackMe: Output Handling and Privacy Risks
* PortSwigger: Web LLM Attacks
* Gandalf by Lakera
* Dreadnode Crucible
* OWASP FinBot CTF
* Microsoft AI Red Teaming Playground
* SaTML 2024 LLM CTF Competition
* Bishop Fox's Local LLM CTF Lab
* WithSecure Workout Planner CTF Challenge
* CTF Prompt Injection (GitHub Lab)
* Steve's Chat Playground (Browser-Based Sandbox)
* Wild LLaMa (Prompt Engineering Mini-Game)
* Damn LLM Agent

Blogs & Series

* LLM Security Best Practices (VIEH Group)
* Getting Started with AI Hacking Part 2 (BHIS)
* LLM Jailbreaking: Ad Attack Techniques (JIN)
* LLM Pentest Agent Hacking (Blaze Infosec)
* From Prompt to Pwn: How I Pen-Tested a LLM
* Stanford's 8-Word Hack (Medium)
* Understanding LLM Attacks and Prompt Injections
* Six Key Ad Attacks and Their Consequences (Mindgard)
* LLM Security in 2025: Risks, Examples, and Best Practices (Oligo Security)
* Securing AI/LLMs in 2025: A Practical Guide (Software Analyst)
* AI Under the Microscope: OWASP Top 10 for LLMs 2025 (Qualys)
* Safeguarding Generative AI LLMs and Agentic AI (ISACA)
* Security Roundup: Top AI Stories in 2024 (IBM)
* SaTML 2024 LLM CTF Write-up
* CTFs on AI - Part 1: LLM Prompt Injection Attacks
* Ad Machine Learning (UC Berkeley CLTC)

Darshan Naresh Naik Series:

* Part 2: Prompt Injection
* Part 3: Sensitive Data Disclosure
* Part 4: Supply Chain & Poisoning
* Part 6: Excessi & Plugins
* Part 7: System Prompt Leakage
* Part 8: Misinformation & DoS

Presentations & Conferences

* DEF CON 32: Hacker vs AI perspectives from an ex spy
* DEF CON 32: On Your Ocean's 11 Team, I'm the AI Guy
* TEDx: The Rise of AI Hackbots
* YouTube: AI Hacking Resource

Notes & Misc

* Walkthrough: TryHackMe E (Medium)
* The Best AI for Ethical Hacking (Tools List)
* Hacking with AI SASTs (Reddit Discussion)
* Awesome-AI-Security (GitHub)
* Awesome AI for Security (GitHub)
* Awesome AI Cybersecurity (GitHub)
* Awesome-AI-Security by TalEliyahu (GitHub)
* MITRE ATLAS Framework
* OWASP LLM Top 10
* OWASP Gen AI Security Project
* Google's Secure AI Framework (SAIF)
* What Are Ad AI Attacks? (Palo Alto Networks)
* NIST: Types of Cyberattacks That Manipulate AI Systems

Tools & Frameworks

* Cybersecurity AI (CAI) Framework (GitHub)
* LLM Guard by Protect AI (GitHub)
* LlamaFirewall (GitHub)
* Garak - LLM Security Probing Tool (GitHub)
* Llamator - LLM Testing Framework (GitHub)
* Foolbox - Ad Examples Toolbox (GitHub)
* Counterfit - ML Security Assessment Tool (GitHub)
* TenSEAL - Homomorphic Encryption for Tensors (GitHub)
* dstack - Confidential AI Framework (GitHub)
* AI Security Analyzer (GitHub)
* SaTML LLM CTF Codebase (GitHub)

De

Books & Whitepapers

Books

- The DevOps Handbook: How to Create World-Class Agility, Reliability, and Security
- De: A leader’s guide to producing secure software
- Learning De: A Practical Guide to Processes and Tools
- Securing DevOps: Security in the Cloud
- The De Playbook: Deli Security at Speed
- Implementing De Practices
- Hands-On Security in DevOps
- Container Security: Fundamental Technology Concepts
- Software Supply Chain Security
- Security as Code: De Patterns with AWS
- Epic Failures in De
- Alice and Bob Learn Application Security
- Microservices Security in Action
- De in Oracle Cloud
- De for Azure
- Mastering De
- De for .NET Core
- Practical Security Automation and Testing

Whitepapers

- DoD Enterprise De Reference Design v2.0 (PDF)
- MITRE: De Security Test Automation Briefing (PDF)
- NIST SP 800-204: Security Strategies for Microservices (PDF)
- CSA: The Six Pillars of De
- CSA: De Automated Security Testing
- Integrating Security into CI/CD Pipelines: A De Approach with SAST, DAST, and SCA Tools (ResearchGate)

Courses

- SANS SEC540: Cloud Nati and De Automation
- Practical De: Certified De Professional (CDP)
- OffSec: De Essentials (OS-210)
- Linux Foundation: Implementing De (LFS262)
- Linux Foundation: De Secure Software (LFD121)
- Coursera: IBM DevOps and Software Engineering Professional Certificate
- Coursera: Cybersecurity in the Cloud Specialization (Univ. of Minnesota)
- Udemy: De & DevOps with Jenkins, Kubernetes, Terraform & AWS
- Udemy: Ultimate De Bootcamp by School of Devops
- Pluralsight: De - The Big Picture
- LinkedIn Learning: De - Automated Security Testing
- Codecademy: De Principles
- EC-Council: Certified De Engineer (E|CDE)
- DevOps Institute: De Foundation (DOF)
- DevOps Institute: De Practitioner (DOP)
- EXIN: De Professional
- NotSoSecure: De Training
- Udemy: De - Kubernetes DevOps & Security
- IGM Guru: De Training with Certification
- Security Compass: De Training

Labs

- TryHackMe: De Path
- OWASP Juice Shop
- Kontra: De Interacti
- SecureFlag
- Punk Security De CTF
- De Home Lab (De)
- Practical De Platform Labs
- OWASP WebGoat
- DVWA (Damn Web Application)
- Kubernetes Goat
- CI/CD Goat

Blogs & Series

- Red Hat De: De Topics & Resources
- RSA Conference Blog: Combining DAST with SAST for Holistic Co
- AWS Security Blog
- Google Cloud Security Blog
- GitLab Blog: De
- Snyk Blog
- Practical De: Top 15 De Best Practices for 2025
- GeeksforGeeks: 10 De Best Practices for 2025
- [Pynt.io: De Principles, Tools, and Best Practices [2025 Guide]]()
- Codefresh: Top 10 De Best Practices for 2025
- Check Point: Top 10 De Best Practices
- Tigera: 5 De Best Practices You Must Implement
- De Guides: Simple Guide for De and Operation
- ChaosSearch: 5 De Checklists for Ad Techniques in 2025
- AWS DevOps Blog: Building End-to-End AWS De CI/CD Pipeline
- Medium: Mastering De - Building a Secure End-to-End Pipeline
- Wiz Academy: 11 De Tools and Top Use Cases in 2025
- StationX: 25 Top De Tools - Ultimate Guide for 2025
- Codefresh: 15 De Tools to Know in 2025
- Spacelift: 21 Best De Tools and Platforms for 2025
- Atlassian: De Tools Guide
- Escape: Top 10 DAST Tools for De - Tested in CI/CD (2025)
- Jit: Top 10 DAST Tools for 2025
- Kiuwan: Application Security Tools Comparison
- TechTarget: Compare SAST vs. DAST vs. SCA for De

Presentations & Conferences

- Black Hat USA 2019: De - What, Why, And How (PDF)
- RSAC 2025: De Re - Unleashing Generative AI
- RSAC 2024: De Next - Na the Next Era
- RSAC Inno Showcase: De
- De
- All Day DevOps
- OWASP AppSec Days
- KubeCon + CloudNativeCon

Tools & Frameworks

Static Application Security Testing (SAST)

- SonarQube - Continuous code quality and security inspection
- Checkmarx - Enterprise SAST platform
- - Application security testing platform
- Semgrep - Lightweight static analysis for many languages
- Horusec - Open-source security analysis tool
- Bandit - Security linter for Python

Dynamic Application Security Testing (DAST)

- OWASP ZAP - Web application security scanner
- Burp Suite - Web scanner
- Acunetix - Automated web application security testing
- Nuclei - Fast scanner
- w3af - Web application attack and audit framework

Software Composition Analysis (SCA)

- Snyk - De security platform
- Dependabot - Automated dependency updates
- OWASP Dependency-Check - SCA tool
- Syft - SBOM generation tool
- Grype - scanner for container images

Container Security

- Trivy - Comprehensi scanner
- Clair - static analysis for containers
- Anchore - Container security and compliance platform
- Falco - Cloud-nati security

Infrastructure as Code (IaC) Security

- Checkov - Static code analysis for IaC
- tfsec - Security scanner for Terraform
- Terrascan - Static code analyzer for IaC
- KICS - Find security in IaC

Secrets Management

- Gitleaks - Detect hardcoded secrets
- TruffleHog - Find credentials in git repositories
- detect-secrets - Pre secrets in code
- HashiCorp Vault - Secrets management platform
- AWS Secrets Manager - Manage secrets for AWS
- git-secrets - Prevent committing secrets to git

CI/CD Security & Orchestration

- Jenkins - Automation server with security plugins
- GitLab CI/CD - Built-in CI/CD with security features
- GitHub Actions - Workflow automation
- CircleCI - Continuous integration platform
- Tekton - Cloud-native CI/CD framework

Security Orchestration & Management

- DefectDojo - Security management
- Archery - assessment and management
- Faraday - Multiuser penetration test IDE
- OpenVAS - Full-featured scanner

Policy as Code & Compliance

- Open Policy Agent (OPA) - Policy-based control for cloud native
- Conftest - Test configuration files using OPA
- Rego - OPA policy language
- InSpec - Infrastructure testing framework

API Security

- 42Crunch - API security platform
- Postman - API testing with security scanning
- OWASP API Security Top 10 - API security standard

Monitoring & Obser

- Prometheus - Monitoring and alerting toolkit
- Grafana - Obser platform
- ELK Stack - Elasticsearch, Logstash, Kibana
- Splunk - Security information and event management

Notes

- OWASP De Guideline
- SANS De Cheat Sheet
- Start Here - De (Roadmap)
- Hacking the Cloud
- Periodic Table of DevOps Tools
- Practical De: De Roadmap - Top Certifications List for 2025
- Practical De: Best De Tools List for 2025
- Upwind: Top 13 Open-Source De Tools for 2025
- Bytebase: Top De Tools for 2025

Misc (GitHub Repos, , Reports)

GitHub Repos

- Awesome De (The Source)
- DefectDojo
- Trivy
- Gitleaks
- Checkov
- GHA-De: De Pipeline using SAST + DAST and SCA
- TruffleHog
- Semgrep
- Nuclei
- tfsec
- Terrascan
- KICS (Keeping Infrastructure as Code Secure)
- Bandit - Python Security Linter
- Syft - SBOM Generator
- Grype - Scanner
- GitGuardian - Secrets Detection
- CI/CD Goat - Deliberately Insecure CI/CD
- Kubernetes Goat
- DVWA - Damn Web Application

& Podcasts

- Podcast: RSAC De Insights and Exciting Horizons
- Video: De - What, Why and How (Black Hat)
- Video Series: De Training Academy (Playlist)
- Video: De Course for Beginners – API Security
- Video: De FULL 8 Hours Course
- Video: De Full Course
- YouTube: KubeCon + CloudNativeCon Channel
- Podcast: All Day DevOps
- Video: Punk Security De CTF 2024 Writeup

Reports & Industry Resources

- Sonatype: State of the Software Supply Chain Report
- GitLab: Global De Report
- SANS Institute: Application Security & API Survey
- CIO Influence: De Tools for CIOs in 2024
- Zymr: 10 DevOps and De Trends and Predictions 2024
- CloudDefense.AI - De Platform
- Aqua Security - Cloud Nati Platform
- Palo Alto Networks Prisma Cloud
- Fortify - Application Security Solutions

Linux Exploit De

Books & Whitepapers

* Linux Exploit De for Beginners (PDF)
* Exploit De Student 1 (eLearnSecurity PDF)
* Automatic Generation of Control Flow Hijacking Exploits (GitHub PDF)
* Linux Exploit De Part 3 - ret2libc (PDF)
* Linux Exploit De Part 4 - Bypass (Packet Storm PDF)
* Playing for K(H)eaps: Understanding and Improving Linux Kernel Exploit Reliability (USENIX Security 2022)
* Unleashing Use-After-Free in Linux Kernel (ACM 2015)
* A Systematic Study of Elastic Objects in Kernel Exploitation (ELOISE Paper)
* Take a Step Further: Understanding Page Spray in Linux Kernel Exploitation (arXiv 2024)
* GREBE: Un Exploitation Potential for Linux Kernel Bugs (Research Paper)
* An In-Depth Survey of Bypassing Buffer O Mitigation Techniques (MDPI 2022)
* Bypassing ASLR/DEP Whitepaper (Exploit-DB)
* Cueing up a Calculator: An Introduction to Exploit De on Linux (GitHub Blog)
* A Practical Approach to Learning Linux (Journal of Computer 2022)
* Understanding Binary Protections (and How to Bypass) with a Dumb Example

Courses

* SANS SEC760: Ad Exploit De for Penetration Testers
* OffensiveCon: Exploiting the Linux Kernel (2024)
* Pentester Academy: SLAE - SecurityTube Linux Assembly Expert (32-bit)
* Pentester Academy: SLAE64 - SecurityTube Linux Assembly Expert (64-bit)
* Duasynt: Linux Kernel Exploitation Techniques
* Pluralsight: Exploit De Learning Path (2025 Updated)
* Udemy: Exploit De for Linux (x86)
* Udemy: Exploit De for Linux x64
* Udemy: Exploit De Tutorial for Hackers and Pentesters
* CyberWarfare Labs: Certified Exploit De Professional (CEDP)
* City College of San Francisco: CNIT 127 - Exploit De (Free)
* OpenSecurityTraining: Exploits 1
* Class Central: 300+ Exploit De Online Courses for 2025
* Hack The Box Academy: Stack-Based Buffer O

Labs & Tools

Debugging & Analysis Tools:
* pwndbg - GDB Plugin for Exploit De
* GEF (GDB Enhanced Features) - Multi-Architecture GDB Plugin
* PEDA (Python Exploit De Assistance for GDB)
* pwntools - CTF Framework and Exploit De Library
* Ropper - ROP Gadget Finder and Binary Information Tool
* ROPgadget - ROP Chain Builder
* one_gadget - Magic Gadget Finder for libc
* radare2 - Reverse Engineering Framework
* Binary Ninja - Reverse Engineering Platform
* IDA Pro - Interacti
* Ghidra - NSA Reverse Engineering Tool

Exploitation Frameworks & Resource Collections:
* GitHub: linux-exploitation-course - Intermediate Le Exploitation
* GitHub: xairy/linux-kernel-exploitation - Comprehensi Security Resources
* GitHub: martinradeion-1 - Kernel Exploit Links Collection
* GitHub: bcoles/kernel-exploits - Linux Kernel Exploits
* GitHub: xairy/kernel-exploits - Proof-of-Concept Linux Kernel Exploits
* GitHub: Lazenca/Kernel-exploit-tech - Linux Kernel Exploitation Tutorial
* GitHub: ww9210/Linux_kernel_exploits - Real World Kernel Exploits
* GitHub: ByteHackr/Kernel-Exploits - Curated Linux Exploitation Resources
* GitHub: Linux Kernel - Kernel Research
* GitHub: linux-exploit-de by HardenedLinux

Practice & CTF Resources:
* pwn.college - Computer Security Practice Challenges
* Nightmare - Binary Exploitation Tutorial
* Exploit Education - VMs for Learning
* ROP Emporium - ROP Challenge Collection
* CTF101 - Binary Exploitation Handbook
* Phoenix - Exploit Education Challenges
* Protostar - Stack/Heap Exploitation Challenges

Blogs & Series

* C: Linux Kernel Pri Escalation Actively Exploited (CrowdStrike)
* C: Critical Linux Kernel Flaw Exploited in Ransomware Attacks (SOC Prime)
* C: Critical Linux Kernel Flaw Allows Pri Escalation (GBHackers)
* 2025: 7 Linux Kernel Exploited in the Wild (LinuxSecurity)
* Easy Pri Escalation Exploit Lands for Linux Kernels (The Register March 2024)
* Linux Kernel Let Attackers Escalate Pri - PoC Released (CyberSecurityNews)
* Bypassing DEP & ASLR in Linux (BorderGate)
* How to Bypass Basic Exploit Mitigation - Part 0x00: Buffer O (Andy's Cave 2025)
* How to Bypass Basic Exploit Mitigation - Part 0x01: DEP/NX (Andy's Cave 2025)
* How to Bypass Basic Exploit Mitigation - Part 0x03: ASLR (Andy's Cave 2025)
* Linux Exploitation: E Exploit Protection (MCSI Library)
* Introduction to x64 Linux Binary Exploitation - Part 3: RoP Chains (Medium)
* ROP - Return Oriented Programming (hackndo)
* Linux - ELF64 ROP Leaks (InfoSec Notes)
* ROP Exploitation on x32 Linux (Buffer O)
* Heap Exploitation Part 1: Understanding the Glibc Heap Implementation (Azeria Labs)
* Heap Exploitation - Nightmare Tutorial
* Heap O with Stack-Pi, Format String and ROP (MBE LAB7A)
* Balsn's Lazyhouse Exploit Analysis: ROP on the Heap in GLIBC 2.29
* Exploit De with AFL, PEDA and PwnTools (DeepCode)
* PEDA, GEF, and PWNDBG—Which GDB Extension Should You Use in 2025? (Medium)
* Speed Up Your Binary Exploits! An Introduction to GEF and Pwntools (ParzelseSec)

Presentations & Conferences

* USENIX Security: Linux Kernel Exploitation Research
* Black Hat: Linux Exploit De Presentations
* DEF CON: Linux Security and Exploitation Talks
* OffensiveCon: Linux Kernel Exploitation Training
* PwnSec: Linux Binary Exploitation Challenges
* HITCON CTF: Ad Linux Exploitation Challenges
* Google Project Zero: Linux Kernel Security Research

* YouTube: Linux Exploit De Tutorials
* YouTube: Linux Kernel Exploitation
* YouTube: ROP Chain Exploitation Linux
* YouTube: Linux Heap Exploitation
* YouTube: pwntools Tutorial

Notes

* Primary Architectures: x86 (32-bit), x86-64 (64-bit), ARM, MIPS, RISC-V
* Exploitation Techniques: Stack o, heap o, use-after-free, double-free, format string, integer o, race conditions, ROP chains, ret2libc, ret2plt, SROP (Sigreturn-Oriented Programming)
* Kernel Exploitation: Pri escalation, SMEP/SMAP bypass, page spray, elastic objects, heap feng shui, kernel ROP, race conditions (TOCTOU), arbitrary read/write primitives
* 2024-2025 Critical CVEs: C (netfilter UAF - actively exploited in ransomware, CISA KE (IP sets bitmap pri escalation), C ("Attack of the Vsock"), C (Netlink interface)
* Exploit Mitigations: NX/DEP (No-Execute), ASLR (Address Space Layout Randomization), PIE (Position Independent Executable), RELRO (Relocation Read-Only), stack canaries, FORTIFY_SOURCE, SMEP (Supervisor Mode Execution Pre), SMAP (Supervisor Mode Access Pre), KASLR (Kernel ASLR)
* Mitigation Bypass Techniques: ROP chains for DEP bypass, information leaks for ASLR bypass, partial RELRO exploitation, GOT/PLT o, stack pi, heap spray, brute forcing (partial ASLR)
* Memory Allocators: glibc malloc/ptmalloc2, tcache, fastbins, unsorted bins, small bins, large bins; kernel allocators: SLUB, SLAB, SLOB, buddy allocator
* Common Bug Classes: Buffer o (stack/heap), use-after-free (UAF), double-free, type confusion, integer o/underflow, uninitialized memory, race conditions, format string
* Stack Exploitation: Buffer o to o return address, stack canary bypass, frame pointer o, sa pointer corruption, shellcode injection (when DEP disabled)
* Heap Exploitation: Fastbin attack, tcache poisoning, unsorted bin attack, house of force, house of spirit, o chunks, chunk consolidation abuse, heap spray
* ROP Techniques: ret2libc (return to libc functions), ret2plt (return to PLT), ret2syscall, SROP (sigreturn-oriented programming), JOP (jump-oriented programming), stack pi for ROP chains
* Kernel Specific: Credential struct o, modprobe_path o, commit_creds + prepare_kernel_cred combo, pipe spray, msg_msg spray, seq_operations exploitation, userfaultfd for race condition exploitation
* Information Leaks: Stack/heap leaks strings, partial o, uninitialized memory disclosure, /proc filesystem leaks, timing side-channels, speculati
* Shellcode De: x86/x64 assembly, syscall in, null-byte a, alphanumeric shellcode, polymorphic shellcode, egg hunters, staged payloads, reverse shells, bind shells
* SLAE Certification: SecurityTube Linux Assembly Expert focuses on x86 (32-bit) and x86-64 (64-bit) assembly, shellcoding techniques, encoder/decoder de, custom shellcode creation, exam requires 7 assignments + blog writeups
* De Tools: GCC, NASM/YASM assemblers, objdump, readelf, strace, ltrace, checksec, seccomp-tools, qemu for kernel debugging, GDB with Python scripting
* GDB Extensions Comparison: Pwndbg (best for exploit de integration, Python 3), GEF (multi-arch support, rich features, Python 3), PEDA (legacy x86 only, Python 2)
* Pwntools Features: Process/remote interaction, ROP chain building, shellcode assembly, ELF parsing, format string exploitation helpers, cyclic pattern generation, integer packing/unpacking
* Lab Setup: Isolated (Ubuntu/Kali), kernel source compilation for debugging, QEMU for kernel exploitation, Docker containers for controlled testing, disable ASLR for initial learning
* CTF Platforms: pwn.college, Nightmare, Exploit Education (Phoenix, Protostar, Fusion), ROP Emporium, picoCTF, HTB (Hack The Box), pwnable.kr, pwnable.tw
* Debugging Workflow: GDB with pwndbg/GEF, attach to process, set breakpoints, examine registers/memory, single-step through execution, analyze crash dumps, automate with pwntools
* Kernel Debugging: QEMU with GDB stub, /proc/kallsyms for symbol resolution, dmesg for kernel logs, ftrace for tracing, SystemTap/eBPF for dynamic instrumentation
* CISA KE: 7 Linux kernel added to Known Exploited in 2025, primarily netfilter subsystem flaws, require immediate patching for go systems
* Exploitation Trends 2025: 159 C in Q1 2025, focus on kernel netfilter/network stack, device dri, local pri escalation chains, ransomware using kernel exploits
* Legal Warning: Unauthorized exploitation is illegal. All research must be conducted in authorized lab en, on systems you own, or with explicit permission
* Responsible Disclosure: Report to (kernel.org security team, distro security teams), coordinate disclosure timelines (typically 90 days), ne exploits for unauthorized use
* Best Practices: Start with basic stack o before moving to kernel, understand assembly and C deeply, practice on CTF challenges, read exploit writeups, study C, contribute to security community
* Career Paths: Penetration tester, exploit de, researcher, security engineer, red team operator, CTF competitor, bug bounty hunter, security consultant
* Certifications: OSCP (Offensi Certified Professional), OSCE (Offensi Certified Expert), SLAE/SLAE64, CEDP (Certified Exploit De Professional), GXPN (GIAC Exploit Researcher and Ad Penetration Tester)
* Research Institutions: Google Project Zero, Linux Kernel Security Team, uni research labs (Georgia Tech, MIT, UC Berkeley), commercial security firms (CrowdStrike, Trend Micro ZDI)
* Key Researchers: PaX Team (grsecurity), Spender, Jon Oberheide, Dan Rosenberg, Brad Spengler, Andrey Konovalo), Will Drewry, Kees Cook
* Future Trends: Increased adoption of memory-safe languages (Rust in kernel), hardware-based security (Intel CET, ARM PAC/BTI), eBPF security hardening, confidential computing, automated exploit generation

Windows Exploit De

Books & Whitepapers

* Bypassing ASLR/DEP Whitepaper (Exploit-DB)
* Taking Windows 10 Kernel Exploitation to the Next Level (Black Hat 2017 PDF)
* Identifying and Exploiting Windows Kernel Race Conditions (Google Research PDF)
* Windows Kernel Hijacking Is Not an Option: MemoryRanger (JDFSL 2021)
* Windows 10 NT Heap Exploitation (SlideShare PDF)
* History and Current State of Heap Exploit (FFRI PDF)
* Heap O Exploitation on Windows 10 Explained (Rapid7)
* Ad Exploit De - Heap Exploitation Techniques (UncleSp1d3r Blog 2024)
* Windows Heap Exploitation: From Heap O to Arbitrary R/W
* Windows C Secure Kernel Mode (Qualys)
* Windows Exploit De - The Basics (Security Sift)
* Windows Exploit De - The Basics (Mike Czumak)

Courses

* Offensi: EXP-301 - Windows User Mode Exploit De (OSED)
* Offensi: EXP-401 - Ad Windows Exploitation (OSEE)
* SANS SEC760: Ad Exploit De for Penetration Testers
* OffensiveCon: Windows Exploit Engineering Foundation (2024)
* Udemy: Windows Exploit De Megaprimer
* Udemy: Exploit De Tutorial for Hackers and Pentesters
* City College of San Francisco: CNIT 127 - Exploit De (Free)
* Corelan: Heap Masterclass - BruCON 2024
* Applied Technology Academy: OffSec EXP-301 OSED Training
* QA: Offensi Windows User Mode Exploit De
* Phoenix TS: EXP-301 Windows User Mode Exploit De

Labs & Tools

Debuggers & Analysis Tools:
* WinDbg - Windows Debugger (Microsoft)
* WinDbg Preview - Modern Windows Debugger with Time Tra
* IDA Pro - Interacti
* Immunity Debugger - Free Windows Debugger
* x64dbg - Open Source x64/x32 Debugger for Windows
* OllyDbg - 32-bit Assembler Le
* Ghidra - NSA Reverse Engineering Framework
* Binary Ninja - Reverse Engineering Platform
* Cutter - Free and Open-Source RE Platform powered by rizin
* Radare2 - UNIX-like Reverse Engineering Framework

Exploitation Tools & Plugins:
* Mona.py - Immunity Debugger Plugin for Exploit De
* rp++ - Full-CPP ROP Gadget Finder
* Ropper - ROP Gadget Finder and Binary Information Tool
* Exploit Pattern Tools - Metasploit Pattern Create/Offset
* pyDbg - Pure Python Debugger

Resource Collections:
* GitHub: WindowsExploitDe Exploit De Tutorial Series
* GitHub: WindowsExploitationResources - Curated Resources for Windows Exploitation
* GitHub: WindowsKernelExploitationResources - Kernel & Dri
* GitHub: Awesome-Adion-References
* GitHub: awesome-windows-kernel-security-de - Kernel Security & Exploitation
* GitHub: windows-kernel-exploits - Windows Kernel LPE Exploits Collection
* GitHub: ByteHackr/WindowsExploitation - Curated Windows Exploitation List
* GitHub: gaitation - Comprehensi Exploit Resources
* GitHub: FabioBaroni/awesome-exploit-de - Books, Tutorials, Tools
* GitHub: Exploit-De - Learning Resources
* GitHub: windows-exploitation - Collection of Resources

Practice En:
* Exploit Exercises - Windows Binaries
* Metasploitable - Intentionally Windows VMs
* FuzzySecurity Tutorials - Heap O For Humans

Blogs & Series

* C: Windows Kernel Race Condition - CISA Warning (2025)
* C: Windows Agere Modem Dri Escalation (2025)
* C: Windows RasMan Pri Escalation (2025)
* C: Windows CLFS Dri Exploited (Microsoft April 2025)
* C: Windows CLFS Zero-Day Pri Escalation (ZeroPath)
* C: Acti Domain Services Pri Escalation (Picus Security)
* C: AWS Client Client Local Pri Escalation
* The September 2025 Security Update Review (Zero Day Initiative)
* A Step-by-Step Introduction to ROP Gadgets to Bypass DEP (Cyber Geeks)
* Defeating Windows DEP With A Custom ROP Chain (NCC Group)
* Bypassing ASLR and DEP using WriteProcessMemory (Ian's Blog)
* Exploit De: Rippity ROPpity - Full ASLR and DEP Bypass on Windows 10 x64 (Connor McGarr)
* A Gentle Intro to ROP and Bypassing DEP (cwinfosec)
* Windows Exploit De Part I (NutCrackersSecurity)
* Windows Kernel Exploitation - Debugging En and Stack O (Connor McGarr)
* Windows Kernel Exploitation (Network Intelligence)
* Exploit Writing Tutorial Part 5: How Debugger Modules & Plugins Speed Up Exploit De (Corelan)
* ASLR Bypass Lab (MIT CSG)
* Re and Exploiting with Free Tools: Part 11 (CoreLabs)
* The Maddest of 2024 (DARKNAVY)

Presentations & Conferences

* Black Hat: Windows Kernel Exploitation Presentations
* DEF CON: Windows Security and Exploitation Talks
* Zero Day Initiati Research
* OffensiveCon: Windows Exploitation Training
* BruCON: Corelan Heap Masterclass
* Microsoft Security: Windows Disclosures
* CISA: Known Exploited Catalog

* YouTube: Windows Exploit De Tutorials
* YouTube: OSED Certification Study Guide
* YouTube: Windows Kernel Exploitation
* YouTube: ROP Chain Windows Exploitation
* YouTube: Windows Heap Exploitation

Notes

* Primary Architectures: x86 (32-bit), x86-64 (64-bit), ARM64 (Windows on ARM)
* 2025 Actively Exploited Zero-Days: C (kernel race condition), C (Agere modem driver - affects all Windows ), C (RasMan), C (CLFS driver), C (CLFS UAF), C (Acti)
* 2024 Zero-Days: C (Secure Kernel Mode), multiple CLFS , kernel pri escalation flaws
* Exploitation Techniques: Stack o, heap o, use-after-free, double-free, type confusion, integer o, SEH o, ROP chains, ret2libc, heap spray, pool spray, arbitrary read/write primitives
* Kernel Exploitation: Token stealing, EPROCESS manipulation, pool o, arbitrary kernel write, PTE manipulation, kernel ROP, SMEP/SMAP bypass, arbitrary kernel read for KASLR bypass
* Exploit Mitigations: DEP/NX (Data Execution Pre), ASLR (Address Space Layout Randomization), CFG (Control Flow Guard), ACG (Arbitrary Code Guard), SEHOP (SEH O Protection), stack cookies/canaries, SafeSEH, KASLR (Kernel ASLR), SMEP (Supervisor Mode Execution Pre), SMAP (Supervisor Mode Access Pre)
* Mitigation Bypass Techniques: ROP chains for DEP bypass, information leaks for ASLR bypass, partial o techniques, heap spray to defeat ASLR, / ROP chains, WriteProcessMemory exploitation, return to non-ASLR modules
* Memory Allocators: NT Heap (default through Windows 7/8), Segment Heap (Windows 10+ default for modern apps), Low Fragmentation Heap (LFH), Frontend allocators (LFH, Size), Backend allocator
* Common Bug Classes: Buffer o (stack/heap), use-after-free (UAF), pool corruption, type confusion, integer o/underflow, uninitialized memory, race conditions (TOCTOU), arbitrary pointer dereference
* Stack Exploitation: Buffer o to o return address, SEH o (Structured Exception Handler), stack cookie bypass, frame pointer o, sa pointer corruption
* Heap Exploitation: LFH exploitation (deterministic chunk locations), heap o, chunk coalescing, freelist manipulation, heap spray, heap feng shui, pool o (kernel), lookaside list exploitation
* SEH Exploitation: SEH chain o, SafeSEH bypass, SEHOP bypass, pop/pop/ret gadgets, exception handler registration record corruption
* ROP Techniques: ROP chain (make memory executable), ROP chain, WriteProcessMemory abuse, return to ZwProtect, stack pi, JOP (jump-oriented programming)
* Kernel Specific: Token swapping (PsInitialSystemProcess), EPROCESS credential manipulation, HAL dispatch table o (legacy), HalDispatchTable + 0x4 pointer swap, arbitrary kernel write exploitation, PTE manipulation for arbitrary R/W
* Information Leaks: Stack/heap leaks, kernel pool leaks tion, partial pointer o, timing side-channels, speculati (Spectre )
* Shellcode De: x86/x64 assembly, Windows API calls, PEB/TEB walking, null-byte a, alphanumeric shellcode, position-independent code (PIC), egg hunters, staged payloads, reverse shells
* OSED Certification: Windows User Mode Exploit De (EXP-301) covers reverse engineering, DEP/ASLR bypass, custom ROP chains, SEH exploitation, egghunters, format string , 48-hour hands-on exam
* OSEE Certification: Ad Windows Exploitation (EXP-401) covers kernel debugging, pool exploitation, arbitrary kernel write, KASLR bypass, modern mitigation bypasses, 72-hour hands-on exam
* De Tools: Studio, WinDbg/WinDbg Preview (kernel debugging), IDA Pro/Ghidra (disassembly), x64dbg/Immunity Debugger (usermode debugging), Mona plugin (ROP gadget finding), Process Monitor/Process Explorer
* WinDbg Extensions: Mona for WinDbg, !exploit commands, MEX (Microsoft Exchange Ser), CMKD (Common Memory and Kernel Debugger), pykd (Python extension)
* Mona Plugin Features: Pattern create/offset, ROP gadget finder, SEH chain , module information, bad character detection, compare functionality, exploit suggestion engine
* Lab Setup: Windows VMs (Windows 7, 10, 11), Studio for compiling apps, WinDbg for debugging, IDA for reverse engineering, disable mitigations for learning (bcdedit commands)
* Kernel Debugging Setup: Two- (debugger + debuggee), configure boot options with bcdedit, network/serial/USB debugging, symbol ser (msdl.microsoft.com/download/symbols)
* CTF & Practice: Exploit Exercises, Windows VMs, Protostar (Windows ), RPISEC MBE, HackTheBox Windows challenges, Pentester Academy labs
* CISA KE: Multiple Windows kernel added to Known Exploited in 2025, primarily CLFS and RasMan flaws, require immediate patching for federal systems
* Exploitation Trends 2025: Shift to kernel exploits as usermode mitigations strengthen, CLFS driver as major attack surface, ransomware le pri escalation exploits, increased focus on authentication bypass
* Legal Warning: Unauthorized exploitation is illegal. All research must be conducted in authorized lab en, on systems you own, or with explicit permission
* Responsible Disclosure: Report to Microsoft Security Response Center (MSRC), coordinate disclosure timelines (typically 90 days with Microsoft), participate in bug bounty programs, ne for malicious use
* Bug Bounty Programs: Microsoft Bug Bounty (up to $250K+), ZDI (Pwn2Own competitions), HackerOne programs, rewards for critical , bonus for exploit chains
* Best Practices: Start with basic stack o on Windows 7, progress to modern Windows 10/11, understand x86/x64 assembly deeply, practice re Microsoft patches, study public C, contribute to security community
* Career Paths: Exploit de, researcher, red team operator, penetration tester, security engineer, reverse engineer, malware analyst, offensi specialist
* Certifications: OSED (OffSec Exploit De), OSEE (OffSec Exploitation Expert), GXPN (GIAC Exploit Researcher), OSCE³ (combines OSED + OSEP + OSWE)
* Research Institutions: Microsoft Security Response Center (MSRC), Google Project Zero, Zero Day Initiative (ZDI), CERT/CC, security firms (NCC Group, Rapid7, Qualys)
* Key Researchers: Alex Ionescu, Mateusz "j00ru" Jurczyk, Tarjei Mandt, Nikita Tarakano McGarr, Corelan Team (Peter )
* Future Trends: Increased CET (Control-flow Enforcement Technology) adoption, hardware-based security (Intel CET, VBS), kernel-mode CFG, memory tagging (ARM MTE), automated exploit generation, ML-based exploit detection

Android Exploit De

Books & Whitepapers

* Android Hacker's Handbook by Joshua J. Drake, Zach Lanier, Collin Mulliner, Pau Oliva Fora, Stephen A. Ridley, Georg Wicherski
* Android Security Internals: An In-Depth Guide to Android's Security Architecture by Nikolay Elenkov
* The Mobile Application Hacker's Handbook by Dominic Chell, Tyrone Erasmus, Shaun Colley, Ollie Whitehouse
* Android Internals: A Confectioner's Cookbook ( I & II) by Jonathan Levin
* Learning Android Application Penetration Testing by Aditya Gupta
* Android Exploitation Handbook (OWASP Research)
* Project Zero: Attacking the Android Kernel
* Qualcomm Security Bulletins: Android Kernel & Baseband
* Android Security: Attacks and Defenses (CRC Press) by Anmol Misra & Abhishek Dubey
* Fuzzing the Android Kernel (Blackhat 2020 Whitepaper)
* Exploiting Android Kernel (Phrack Magazine)
* Ad Android Exploitation Techniques (SyScan 2014)
* Bypassing Android Security Mechanisms (USENIX Security 2023)
* Android Binder Exploitation: Attacking Inter-Process Communication (Google Project Zero)
* Exploiting Qualcomm WLAN & GPU Drivers on Android (Tencent Blade Team 2019)
* Return to Controlled: Exploit Mitigation Bypasses in Android (NCC Group Research)
* Android Kernel Heap Exploitation (Black Hat Asia 2022)
* Exploiting Samsung Trusted Execution En (TEE)
* A Survey on Android Kernel Security (arXiv 2023)
* Android Baseband Exploitation: Hacking Modems for Fun & Profit (OffensiveCon 2023)

Courses

* SANS SEC575: Mobile Device Security and Ethical Hacking
* Pentester Academy: Attacking and Defending Android Applications
* NowSecure: Mobile App Security Training (Android Focus)
* Hacker101: Android Security 101 (Free HackerOne Course)
* Zero Day Engineering: Ad Android Exploitation
* Exodus Intelligence: Android Research & Exploitation Training
* Azeria Labs: ARM Assembly & Android Reverse Engineering
* eLearnSecurity Mobile Application Penetration Tester (eMAPT)
* Maddie Stone (Google Project Zero): Android Exploitation Course Materials

Labs & Tools

GitHub Resource Collections:
* GitHub: IamAlch3mist/Awesome-Android-
* GitHub: SecWiki/android-kernel-exploits - Android Kernel Exploits Collection
* GitHub: cloudfuzz/android-kernel-exploitation - Android Kernel Exploitation Workshops
* GitHub: Fuzion24/AndroidKernelExploitationPlayground - Kernel Exploitation Guide

Kernel Exploits:
* GitHub: Markakd/bad_io_uring - C Android Kernel Exploit
* GitHub: polygraphene/DirtyPipe-Android - Dirty Pipe Root Exploit for Android
* GitHub: ozkanbilge/Android-Kernel-Exploits

Testing & Analysis Tools:
* Android Debug Bridge (ADB) - Official Android Debugging Tool
* Frida - Dynamic Instrumentation for Android
* Ghidra - Android Nati & Kernel Analysis
* IDA Pro - ARM/ARM64 Disassembly & Debugging for Android
* Objection - Runtime Mobile Exploration (Android)
* MobSF (Mobile Security Framework) - Automated Android Analysis
* Drozer - Android Security Assessment Framework
* APKTool - APK Reverse Engineering & Repackaging
* JADX - Dex to Ja
* Magisk - Root & Module Framework for Android
* Android Studio Emulator - Official Android Testing En
* Genymotion - Fast Android Emulator for Security Testing
* Corellium - Android Devices for Security Research
* QEMU ARM - Android Kernel Debugging En
* Android Kernel Debugger (KDB/KGDB) Setup
* Smali/Baksmali - Dal Assembler/Disassembler
* r2frida - Radare2 + Frida Integration for Android
* House - Runtime Mobile Application Analysis Toolkit
* Androguard - Python Tool for Reverse Engineering Android Applications
* Android Tamer - Machine for Android Security Professionals
* Santoku Linux - Mobile Forensics & Security Testing Distro

Blogs & Series

* C: Android Kernel Use-After-Free - Critical Pri Escalation (2025)
* C: Android Framework Pri Escalation - Actively Exploited (2024)
* C: Android Kernel Memory Corruption in Pixel Devices (2024)
* C: Qualcomm GPU Dri - Remote Code Execution (2024)
* Google Project Zero: Android Kernel & Dri Research
* Maddie Stone (Project Zero): In-the-Wild Android Exploitation
* Android Security Bulletins (Official Google Source)
* Qualcomm Security Bulletins: Snapdragon
* Samsung Mobile Security Blog: Android Kernel & Knox Research
* CENSUS Labs: Android Exploitation Research
* NowSecure Blog: Android Mobile Security Research
* Zimperium Blog: Android Mobile Threat Intelligence
* Tencent Blade Team: Android Kernel & GPU Exploitation
* Lookout Blog: Android Mobile Threat Research
* HackerOne Disclosed Android Exploits
* Android Exploits Blog: Reverse Engineering & Exploitation
* JEB Blog: Android Reverse Engineering & Analysis
* Exploiting Android: A Blog Series (Azeria Labs)
* Pegasus for Android: NSO Group's Android Zero-Day Chain (2021)
* Dirty Pipe (C): Linux/Android Kernel Pri Escalation
* Bad Binder: Android In-the-Wild Exploit (Google Project Zero 2019)

Presentations & Conferences

* Black Hat USA: Android Security & Kernel Exploitation Talks
* DEF CON: Mobile Hacking - Android Research
* Pwn2Own: Android Kernel & Browser Exploit Demonstrations
* MOSEC (Mobile Security Conference) - Android Research
* OffensiveCon: Android Kernel & Baseband Exploitation
* HITB (Hack in The Box): Android Security Research
* SyScan: Android Kernel & Application Exploitation Archive
* REcon: Reverse Engineering & Android Exploitation
* INFILTRATE: Android Offensi Conference
* Android Security Symposium (Annual Google Event)

* Li: Android Hacking & Reverse Engineering Series
* NowSecure: Android Application Security Testing
* OWASP Mobile Security: Android Exploitation Talks

---

Notes

1. Android Kernel Exploitation
- Based on Linux kernel with Android-specific patches (Binder IPC, ashmem, ion allocator)
- Common targets: Binder driver, GPU drivers (Qualcomm Adreno, ARM Mali), Wi-Fi drivers, USB drivers
- Modern mitigations: SELinux, seccomp-bpf, PAN emulation, CFI, SCS, MTE (Android 11+)
- Exploitation techniques: Heap spray, use-after-free, race conditions, arbitrary read/write primitives
- Tools: QEMU, Android Studio Emulator, Corellium, KGDB/KDB, addr2line, crash utility

2. Android Framework Exploitation
- Exploiting System Server, Zygote, Acti, PackageManager
- Intent redirection, permission bypass, sandbox escapes
- Common : exported components, custom URI handlers, WebView
- 2024 Trend: C actively exploited framework pri escalation

3. Binder IPC Exploitation
- Binder is Android's primary inter-process communication mechanism
- Attack surface: use-after-free in transaction handling, type confusion, race conditions
- Notable exploits: Bad Binder (C), Stagefright
- Exploitation challenges: ASLR, seccomp filtering, SELinux policy enforcement

4. Qualcomm/MediaTek Dri
- Qualcomm Snapdragon chips dominate Android market (60%+ devices)
- Common targets: Adreno GPU driver, WLAN (Wi-Fi) driver, DSP (audio/camera) firmware
- Notable research: QualpWN (Tencent Blade Team), Achilles (Check Point Research)
- MediaTek : GPU/display driver bugs, Mali GPU exploits
- 2024 Trend: C Qualcomm GPU RCE

5. Android Application Exploitation
- Smali/Dal analysis and patching
- Nati exploitation (JNI )
- WebView exploits (Ja bridge attacks, uni XSS)
- Common : insecure data storage, weak crypto, exported acti/services, deep link hijacking
- Tools: APKTool, JADX, Frida, Objection, Drozer

6. Rooting & Persistence
- Exploiting kernel for pri escalation
- Magisk: systemless root framework, hiding root from detection
- SafetyNet/Play Integrity API bypass techniques
- Boot image modification, SELinux policy patching
- Modern challenges: Boot, dm-, Android Hardware Attestation

7. Trusted Execution En (TEE) Exploitation
- Qualcomm QSEE (Secure Execution En)
- Samsung Knox & Trustzone
- ARM TrustZone exploitation
- Attack : SMC (Secure Monitor Call) , TA (Trusted Application) bugs
- Research: Gal Beniamini's Qualcomm TrustZone exploits

8. Baseband Processor Exploitation
- Baseband is the modem firmware running on a separate ARM processor
- Qualcomm baseband (Hexagon DSP architecture)
- Attack surface: LTE/5G protocol stack, SMS/MMS handling, VoLTE
- Research: Ralf-Philipp Weinmann's baseband research, Project Zero's Titan M analysis
- Remote exploitation potential (o attacks)

9. Android Fuzzing & Discovery
- Syzkaller for kernel fuzzing (Google's co fuzzer)
- libFuzzer for nati fuzzing
- AFL++ for Android native code
- Drozer for Android application fuzzing
- Media codec fuzzing (Stagefright bugs in libstagefright)

10. Notable Android Exploits & Campaigns
- Dirty Pipe (C): Linux/Android kernel pri escalation affecting Android 12
- Bad Binder (C): In-the-wild Android kernel exploit used by NSO Group
- Stagefright (C): Remote code execution via MMS (900M+ devices affected)
- QualpWN: Qualcomm WLAN dri chain (Tencent 2019)
- Pegasus for Android: NSO Group's zero-click exploitation chain
- C (2025): Android kernel use-after-free, critical pri escalation
- C (2024): Framework pri escalation, actively exploited in the wild

11. Android Security Mitigations
- SELinux (Enforcing Mode): Mandatory Access Control for app sandboxing
- seccomp-bpf: System call filtering to reduce kernel attack surface
- ASLR/PIE: Address Space Layout Randomization for kernel & userspace
- CFI (Control Flow Integrity): Forward-edge protection in kernel (Android 9+)
- SCS (Shadow Call Stack): Backward-edge protection, return address protection (Android 11+)
- MTE (Memory Tagging Extension): Hardware memory safety on ARM v8.5+ (Android 11+, Pixel 8+)
- PAN Emulation: Kernel cannot access userspace memory directly
- Boot: Cryptographic boot chain
- Hardware-Backed Keystore: Secure key storage in TEE/Secure Element

12. Legal & Ethical Considerations
- Android security research is legal when conducted on your own devices
- Google Reward Program (VRP) offers bounties up to $1.5M for exploits
- Qualcomm, Samsung, and other have bug bounty programs
- Always obtain proper authorization before testing devices you don't own
- Responsible disclosure through security teams or coordinated disclosure platforms
- Never use exploits for unauthorized access, stalkerware, or malicious purposes

13. 2024-2025 Android Exploitation Trends
- Increased focus on baseband processor exploitation (5G attack surface)
- MTE bypass research on newer Pixel/Samsung devices
- TEE/TrustZone exploitation for full device compromise
- Qualcomm GPU dri remain pre
- Rise in zero-click exploits targeting media codecs and messaging apps
- Android 14-15 hardening: restricted settings, runtime permissions enhancements
- C and C: Actively exploited kernel & framework bugs
- Exploitation difficulty increasing due to CFI, SCS, MTE on flagship devices
- Growing interest in MediaTek chipset (budget device market)

iOS Exploit De

Books & Whitepapers

* iOS Hacker's Handbook by Charlie Miller, Dion Blazakis, Dino DaiZo Esser, Iozzo, Ralf-Philipp Weinmann
* The Mac Hacker's Handbook by Charlie Miller & Dino Dai Zo iOS)
* iOS Application Security: The Definiti for Hackers and De by Da
* macOS and iOS Internals, III: Security & Insecurity by Jonathan Levin
* *OS Internals ( I, II, III) by Jonathan Levin - Comprehensive iOS/macOS Internals
* Attacking iOS Applications: A Brief Introduction (SANS Whitepaper)
* iOS Kernel Exploitation - Ad & Techniques (Phrack Magazine)
* Examining Pointer Authentication on the iPhone XS (Google Project Zero Paper)
* Attacking Objective-C Runtime on iOS (SyScan 2015 Whitepaper)
* Exploiting the iOS Kernel (SyScan 2011 - Stefan Esser)
* PEGASUS: The iOS 0-Day Exploit Chain (Lookout & Citizen Lab Research)
* Attacking the XNU Kernel in El Capitan (Black Hat 2016 - Liang Chen, Qidan He)
* iOS Kernel Heap Armageddon (SyScan 2012 - Stefan Esser)
* iOS Security Guide (Official Apple Security Documentation)
* WebKit Exploitation Tutorial (Project Zero Research)
* A Tale of Two Shellcodes: From iOS 13 to iOS 14 Jailbreak (BlackHat 2021)
* Attacking WebKit & Safari for iOS 15 (RET2 Systems Research)
* BlastDoor: Apple's Sandbox for iMessage (Google Project Zero Analysis)

Courses

* SANS SEC575: Mobile Device Security and Ethical Hacking
* Pentester Academy: iOS Security & Exploitation
* Hacker101: iOS Security 101 (Free HackerOne Course)
* ZeroNights Training: iOS Kernel Exploitation
* Exodus Intelligence: iOS & Safari Exploitation Training
* Signal Labs: iOS Application Security Assessment
* NowSecure: Mobile App Security Training (iOS Focus)
* Azeria Labs: iOS Reverse Engineering & Exploitation
* Corellium Training: iOS Kernel Debugging and Exploit De

Labs & Tools

GitHub Resource Collections:
* GitHub: kai5263499/osx-security-awesome - iOS Security Resources Collection
* GitHub: houjingyi233/macOS-iOS-system-security - macOS/iOS System Security Resources

Jailbreak Tools & Exploits:
* Checkra1n Jailbreak - Bootrom Exploit (checkm8)
* unc0 - iOS Jailbreak Tool
* GitHub: alfiecg24/ - iOS 14/15 Kernel Exploit
* GitHub: potmdehex/multicast_bytecopy - iOS 15.0-15.1.1 Kernel r/w Exploit
* GitHub: 0x36/weightBufs - iOS 15 & macOS 12 ANE Kernel Exploit
* GitHub: doadam/ziVA - iOS Kernel Exploit for iOS <= 10.3.1
* GitHub: iFenixx/-iOS-12.1.2

Testing & Analysis Tools:
* Corellium - iOS Devices for Security Research
* Frida - Dynamic Instrumentation Toolkit for iOS
* Objection - Runtime Mobile Exploration (Built on Frida)
* Hopper Disassembler - iOS Binary Analysis Tool
* Ghidra - iOS Kernel & Binary Reverse Engineering
* IDA Pro - iOS ARM64/ARM Disassembly & Debugging
* lldb - iOS Debugger (Apple's Official Debugger)
* ios-kern-utils - iOS Kernel Debugging Utilities
* iOSSecuritySuite - iOS Security & Jailbreak Detection Library
* MobSF (Mobile Security Framework) - iOS Static/Dynamic Analysis
* class-dump - Objective-C Class Dumper for iOS
* Cycript - Objective-C++ Runtime Manipulation Tool
* iProxy - USB Tunneling for iOS Debugging
* iOS Reverse Engineering Toolkit (iRET)
* XNU Kernel Source Code (Darwin)
* iOS Kernel Cache Analysis Tools (JTOOL2)

Blogs & Series

* C: iOS Use-After-Free in XNU Kernel - Actively Exploited (2025)
* C: iOS WebKit Code Execution - Zero-Day in Safari (2025)
* C: iOS Kernel Memory Corruption - Exploit in the Wild (2024)
* C: iOS Sandbox Escape (2024)
* Google Project Zero: iOS Exploits & Research
* Pangu Team Blog: iOS Jailbreak Exploits & Techniques
* Pwn20wnd Blog: unc0 Exploitation Details
* Stefan Esser (i0n1c) Blog: iOS Kernel & Runtime Exploitation
* Jonathan Levin's Blog (*OS Internals & Exploitation)
* Siguza's Blog: iOS Kernel Research & Exploits
* Brandon Azad (Google Project Zero) - iOS Kernel Exploitation
* Ian Beer (Google Project Zero) - iOS 0-Day Exploits
* The iPhone Wiki - iOS Jailbreak & Exploit Database
* Zimperium Blog: iOS Mobile Threat Research
* Lookout Blog: iOS Mobile Security Research
* Citizen Lab: iOS Targeted Attacks & Pegasus Research
* NSO Group Pegasus Exploits: iOS 14 Zero-Click Exploitation (2021)
* Operation Triangulation: iOS 16 Kernel Exploit Chain (Kaspersky 2023)
* Checkm8 Bootrom Exploit Explained (axi0mX, 2019)
* iOS 15 Safari Uni XSS (C) - Acti

Presentations & Conferences

* Black Hat USA: iOS Security & Exploitation Talks
* DEF CON: iOS Hacking & Presentations
* Pwn2Own: iOS Safari & Kernel Exploit Demonstrations
* MOSEC (Mobile Security Conference) - iOS Research
* INFILTRATE: iOS Offensi Conference
* POC (Power of Community) - iOS Kernel Exploitation
* OffensiveCon: iOS Exploitation Workshops
* SyScan: iOS Security & Exploitation Archive
* HITB (Hack in The Box): iOS Security Research
* Jailbreak Security Summit (JSS): Annual iOS Jailbreak Conference

* Li: iOS Jailbreak & Exploitation Series
* Billy Ellis: iOS Security & Reverse Engineering
* NowSecure: iOS Application Security Testing

---

Notes

1. iOS Kernel (XNU) Exploitation
- XNU is a hybrid kernel (Mach microkernel + BSD components)
- Common targets: IOKit drivers, network stack, file systems
- Modern mitigations: KASLR, kernel PAC (KPAC), zone_require, PPL
- Exploitation techniques: Heap feng shui, OOL (out-of-line) ports, memory corruption
- Tools: lldb with KDK (Kernel Debug Kit), IDA Pro, Ghidra, jtool2

2. WebKit & Safari Exploitation
- Ja (JSC) engine
- Type confusion, use-after-free in JIT compiler
- Sandbox escape from WebContent process
- Common attack : Pwn2Own exploits, in-the-wild zero-days
- 2025 Trend: C actively exploited zero-day in Safari

3. iOS Sandbox Escapes
- App Sandbox, WebContent Sandbox, BlastDoor (iMessage sandbox)
- Common escape : XPC service , file access bugs, IOKit drivers
- Notable: C (AccessibilityD sandbox escape)
- Tools: Frida, Objection, SBTool for sandbox analysis

4. Jailbreak De
- Untethered jailbreaks
- Bootrom exploits: checkm8 (unfixable hardware in A5-A11 chips)
- Kernel exploits: unc0ver, Taurine, Chimera jailbreaks
- PAC bypass techniques for A12+ devices
- Persistence mechanisms and kernel patch protection bypasses

5. iOS Application Exploitation
- Objective-C/Swift runtime manipulation
- Method swizzling, class injection
- Binary patching and code signing bypasses
- IPA file analysis and repackaging
- Common : insecure data storage, weak crypto, URL scheme hijacking

6. Pointer Authentication Codes (PAC)
- Hardware-based code integrity on A12+ chips
- PACIBSP, PACIA instructions for forward/backward-edge CFI
- PAC bypass research: JOP (Jump-Oriented Programming), gadget signing
- 2023-2025: Ad PAC bypass techniques in Pegasus and Operation Triangulation

7. iOS Fuzzing & Discovery
- AFL, LibFuzzer for iOS userland fuzzing
- WebKit fuzzing: Domato, Fuzzilli, JSFuzzer
- IOKit dri with Corellium devices
- iMessage/SMS fuzzing (post-BlastDoor hardening)

8. Notable iOS Exploits & Campaigns
- Pegasus (NSO Group): Zero-click iMessage exploits, kernel exploits
- Operation Triangulation (2023): iOS 16 exploit chain
- Checkm8 (2019): Unfixable bootrom exploit for A5-A11 devices
- FORCEDENTRY (2021): Zero-click iOS 14 exploit using PDF/GIF rendering
- C (2025): XNU kernel use-after-free, actively exploited in the wild

9. iOS Security Mitigations
- PAC (Pointer Authentication): A12+ chips, cryptographic pointer signing
- PPL (Page Protection Layer): Hyper memory protection for kernel data
- BlastDoor: Sandbox for parsing untrusted iMessage content (iOS 14+)
- Secure Enclave: Hardware-isolated processor for cryptographic operations
- KASLR: Kernel Address Space Layout Randomization
- Zone_require: Kernel heap zone isolation
- Memory Tagging (MTE): Future A-series chips (2025+)

10. iOS Reverse Engineering
- Tools: Hopper, IDA Pro, Ghidra, class-dump, Cycript
- Dynamic analysis: Frida, lldb, Objection
- Kernel cache analysis: jtool2, img4tool, Luca Todesco's tools
- Decrypting App Store binaries: Clutch, frida-ios-dump, bfdecrypt
- File system access: SSH over USB (usbmuxd), AFC (Apple File Conduit)

11. Legal & Ethical Considerations
- iOS jailbreaking is legal under DMCA exemptions (US)
- Exploit de for research/defensi is legitimate
- Selling iOS exploits to go contractors (e.g., NSO Group, Zerodium) raises ethical concerns
- Always obtain proper authorization before testing iOS devices you don't own
- Bug bounty: Apple Security Bounty offers up to $2 million for critical iOS exploits

12. 2024-2025 iOS Exploitation Trends
- Increased focus on zero-click exploits (iMessage, FaceTime, SMS)
- Ad PAC bypass techniques for A14-A17 chips
- Post-BlastDoor iMessage exploitation research
- iOS 17-18 kernel hardening and PPL impro
- Rise in targeted attacks against high-profile iOS users (journalists, activists, politicians)
- Growing researcher interest in Secure Enclave and SEP firmware exploitation
- C and C: Actively exploited zero-days in iOS 18.3.1 and earlier

Browser Exploitation

Books & Whitepapers

* A Methodical Approach to Browser Exploitation (RET2 Systems Pwn2Own 2018)
* Gray Hat Hacking: The Ethical Hacker's Handbook - Browser Exploitation Framework (BeEF)
* Compromising the macOS Kernel through Safari by Chaining Six (Georgia Tech Pwn2Own 2020)
* WebAssembly and Security: A Review (arXiv 2024)
* E Old is New Again: Binary Security of WebAssembly (USENIX Security 2020 PDF)
* Disco in WebAssembly with Code Property Graphs (INESC-ID PDF)
* NOJITSU: Locking Down Ja Engines (NDSS 2020 PDF)
* Attacking JS Engines: Fundamentals for Understanding Memory Corruption Crashes (SideChannel Blog)
* A Study on Malicious Browser Extensions in 2025 (arXiv)
* Zero-Day in the Browser: A Growing Crisis (Seraphic Security)
* 0.0.0.0 Day: 18-Year-Old Browser Impacts MacOS and Linux Devices
* The Browser Security Crisis of 2025: Why Chrome, Safari, and Traditional Browsers Are Failing (Kahana)
* Memory Corruption in WebAssembly: Nati Inside Your Browser (InstaTunnel)
* The Dark Side of WebAssembly (Virus Bulletin 2018)
* WebAssembly for Browser-Based RCE Attacks (Medium)
* WebAssembly: How Cybercriminals Exploit WASM Security (GeoEdge)
* Ja Engines Explained—Comparing V8, SpiderMonkey, Ja (Frontend Dogma 2025)
* Web Browser Best Practices For Security and Privacy in 2024 (PacketLabs)

Courses

* RET2 Systems: Browser Exploitation Training (Self-Paced Online)
* RET2 Systems: Ad Browser Exploitation (5-Day Course)
* Exodus Intelligence: Ad Browser Exploitation (4-Day Course)
* OffensiveCon: Browser Exploitation Training
* OffensiveCon: Web Browser Exploitation by Samuel Gross
* Ringzer0: Ad Browser Exploitation
* Ringzer0: Practical Web Browser Fuzzing (Archive)
* OffensiveCon: Practical Browser Fuzzing (2023)
* OffensiveCon: Practical Web Browser Fuzzing (2025)
* Recon Training: Practical Browser Fuzzing by Patrick
* DUASYNT: Exploitation and Reverse Engineering Trainings
* PSEC: Ad Software Exploitation Course

Labs & Tools

Browser Exploitation Frameworks & Resource Collections:
* GitHub: m1ghtym0/browser-pwn - Updated Collection of Browser Exploitation Resources
* GitHub: Escapingbug/awesome-browser-exploit - Browser Exploitation Tutorials
* GitHub: gmh5225/awesome-Browser-Security-Research - Browser Security Research
* GitHub: security-prince/Browser-Security-Research - Comprehensi Security
* GitHub: qazbnm456/awesome-web-security - Web Security Materials
* BeEF (Browser Exploitation Framework) Project
* GitHub: Awesome-Browser-Fuzzing - Curated List of Browser Fuzzing Resources

Fuzzing Tools:
* AFL (American Fuzzy Lop) - Security-Oriented Fuzzer
* AFL++ - Ad Fork of AFL
* Google Domato - DOM Fuzzer
* Fuzzilli - Ja Engine Fuzzer Targeting JIT Bugs
* Honggfuzz - Security-Oriented Fuzzer
* Dharma - Context-Free Grammar Fuzzer
* Mozilla Grizzly - Browser Fuzzing Framework
* Mozilla Domino - DOM Fuzzing Tool
* GitHub: BFuzz - Fuzzing Browsers

Debugging & Analysis Tools:
* Google Chrome De
* Firefox De Tools
* rr - Record and Replay Framework for Debugging
* WinDbg - Windows Debugger
* GDB - GNU Debugger
* Lighthouse - Chrome Extension Security Analyzer

Research & PoC Repositories:
* GitHub: sslab-gatech/pwn2own2020 - Safari Kernel Exploit Chain
* Diary of a Re - Exploitation Resources

Blogs & Series

* C: Chrome V8 Zero-Day Actively Exploited (July 2025)
* C: Google Chrome Zero-Day (SOC Prime)
* C: Google Patches Yet Another Exploited Chrome Zero-Day (No 2025)
* C: Chrome Mojo Sandbox Bypass (Fidelis Security March 2025)
* C: Firefox IPC Sandbox Escape (March 2025)
* C: Chromium ipcz Sandbox Escape ($250,000 Bug Bounty - August 2025)
* Fooling the Sandbox: A Chrome-atic Escape (STAR Labs 2025)
* My Take on Chrome Sandbox Escape Exploit Chain (Medium)
* Escaping the Sandbox: A Bug That Speaks for Itself (Microsoft Edge VR)
* Chrome Sandbox Escape Earns Researcher $250,000 (SecurityWeek)
* Google Chrome Browser Patches 7th Zero-Day of 2024 (Intego)
* Google Chrome Browser Patches 8th Zero-Day of 2024, 4th in May (Intego)
* Google Fixes Chrome Zero-Days Exploited at Pwn2Own 2024 (BleepingComputer)
* Chrome Zero-Day: Why Browser Security Is No Longer Optional (Menlo Security)
* Actively Exploited Chromium Zero-Day Affects Chrome, Edge, and Opera (Mondoo)
* Firefox Zero-Day Under Attack: Update Your Browser Immediately (The Hacker News October 2024)
* 8 Chrome that Caused Risk in 2024 (TrueFort)
* Critical Blink Lets Attackers Crash Chromium-Based Browsers (CyberPress)
* Google and Mozilla Patch Browser Zero-Day (FieldEffect)
* My First Take on Real World Research (wwkenwong Fuzzing Series)
* Fuzzing Webkit (inputzero.io)
* Firefox Fuzzing Documentation

Presentations & Conferences

* Pwn2Own Annual Competition - Browser Exploitation Showcase
* Black Hat USA: Browser Security Presentations (Annual)
* DEF CON: Browser Exploitation Talks (Annual)
* USENIX Security: WebAssembly and Ja Engine Security
* OffensiveCon: Browser Exploitation Training Track
* RET2 Systems Blog: Pwn2Own Write-ups
* Google Project Zero: Browser Security Research
* All Major Browsers Fall During Day 2 of Pwn2Own Hacking Contest (KnowBe4)
* Pwn2Own 2018: Focus Changes To Kernel Exploits As Browsers Get Harder To Hack (Tom's Hardware)
* Pwn2Own Researchers Exploit Mozilla Firefox, Microsoft Edge and Tesla (eWeek)

* YouTube: Browser Exploitation Tutorials
* YouTube: Ja Engine Exploitation
* YouTube: WebAssembly Security and Exploitation
* YouTube: Chrome V8 Exploitation Techniques
* YouTube: Browser Fuzzing Techniques

Notes

* Major Browsers: Google Chrome, Mozilla Firefox, Apple Safari, Microsoft Edge, Opera, Brave (most based on Chromium)
* Ja Engines: V8 (Chrome/Edge/Node.js), SpiderMonkey (Firefox), Ja/Nitro (Safari), Chakra (legacy Edge)
* 2025 Critical Zero-Days: C (Chrome V8 type confusion), C (V8 out-of-bounds), C (Chrome), C (Mojo IPC sandbox escape), C (Firefox IPC), C (Chromium ipcz - $250K bounty)
* 2024 Statistics: 75 zero-day exploited in wild (50% increase from 2023), Chrome had majority of attacks, 8+ Chrome zero-days in 2024, Firefox had 5 out of 6 highest scores
* Exploitation Techniques: Memory corruption (use-after-free, buffer o, type confusion), JIT spray, heap feng shui, ROP chains, sandbox escape, IPC exploitation, Mojo IPC bugs, speculati attacks
* Attack : Malicious websites, drive-by downloads, watering hole attacks, browser extensions, WebAssembly exploitation, DOM manipulation, Ja engine bugs, renderer process compromise
* Sandbox Escape: C (Mojo IPC OOB read/write + UAF), C earned $250K (largest single bounty for partial exploit), multi-stage chains combining renderer exploit + sandbox escape + pri escalation
* Common Bug Classes: Use-after-free (UAF), type confusion, out-of-bounds read/write, integer o, race conditions, uninitialized memory, logic bugs in IPC
* WebAssembly Risks: Memory corruption from C/C++ code ported to WASM, obfuscation for detection e, control flow hijacking, JIT compilation , lack of nati mitigations (DEP/ASLR), RCE through V8 engine exploits
* Fuzzing Approaches: Co (AFL/AFL++), grammar-based (Domato, Dharma), mutation-based, JIT-targeted (Fuzzilli), in-process fuzzing, DOM fuzzing (Grizzly, Domino)
* Pwn2Own Rewards: 2022 awarded $1.155M for 25 unique zero-days, single-day record of $800K, sandbox escapes earn premium payouts, full chain exploits (RCE + sandbox escape + pri escalation) worth $250K+
* Browser Security Features: Sandboxing (site isolation, process isolation), ASLR, DEP/NX, CFI (Control Flow Integrity), stack canaries, heap hardening, JIT hardening, Mojo IPC , seccomp filters
* Chrome Security: Site Isolation (separate processes per origin), V8 pointer compression, CFI, MiraclePtr, PartitionAlloc hardening, renderer sandboxing via Mojo IPC
* Firefox Security: Fission (site isolation), IonMonkey JIT hardening, process sandboxing, RLBox WASM sandboxing, content process restrictions
* Safari Security: Intelligent Tracking Pre (ITP), WebKit sandboxing, process isolation, JIT restrictions on iOS, Lockdown Mode (iOS 16+)
* Detection Challenges: Zero-day exploits before patches a, obfuscated Ja/WASM, fileless attacks, in-memory exploitation, sandbox escape chains bypass traditional defenses
* Defense Measures: Keep browsers updated (patch zero-days quickly), disable Ja for untrusted sites, use browser isolation technologies, enable Enhanced Safe Browsing (Chrome), deploy EDR/XDR solutions, restrict browser extensions
* Research Tools Prerequisites: Familiarity with C++ and Ja, AMD64 assembly knowledge, understanding of memory corruption, exploitation mitigations (ASLR, DEP, CFI), Linux/Windows debugging experience
* Lab Setup: Isolated , debuggers (GDB, WinDbg, rr), fuzzing infrastructure (AFL++, libFuzzer), browser builds with debug symbols, snapshot/restore capabilities
* Research: Patch diffing, binary analysis, fuzzing (DOM, JS engines, WebAssembly), manual code review, regression testing, exploit PoC de
* Legal Warning: Unauthorized exploitation of browser is illegal. All research must follow responsible disclosure policies and be conducted in authorized lab en
* Responsible Disclosure: Report to browser (Chrome VRP, Mozilla Bug Bounty, Apple Security Bounty), coordinate disclosure timelines (typically 90 days), ne exploits against unauthorized targets
* Bug Bounty Programs: Chrome Reward Program (up to $250K+), Mozilla Bug Bounty, Apple Security Bounty, Microsoft Edge Bug Bounty, Pwn2Own competitions
* Research Institutions: Google Project Zero, Microsoft Security Response Center (MSRC), Mozilla Security, RET2 Systems, Exodus Intelligence, STAR Labs, Georgia Tech SSLab
* Key Researchers: I (Google Project Zero), Samuel Groß (V8 Security), Exodus Intelligence Team, RET2 Systems Team, Pwn2Own contestants
* Future Trends: Increased adoption of memory-safe languages (Rust), enhanced sandboxing (site isolation impro), AI-powered discovery, quantum-resistant crypto in browsers, Zero Trust browser architectures
* Best Practices: Multi-layered defense (network isolation + browser hardening + EDR), principle of least pri, disable unnecessary features, use dedicated browsers for sensiti, implement browser isolation for enterprise

Hypervisor Exploitation

Books & Whitepapers

* Breaking Turtles All the Way Down: An Exploitation Chain to Break out of ESXi (USENIX WOOT 2019 PDF)
* Exploit Two Xen Hypervisor (Black Hat USA 2016 PDF)
* Determining Forensic Data Requirements for Detecting Hypervisor Attacks (NIST PDF)
* Characterizing Hypervisor in Cloud Computing Servers (ResearchGate)
* Hypervisor and Their (Medium)
* Hypervisor and Some Defense Mechanisms (IJITEE PDF)
* A Survey of Fuzzing Open-Source Operating Systems (arXiv 2025)
* Analysis of C and C
* From Binary Patch to Proof-of-concept: ESXi Case Study
* Fire Ant: Hyper Espionage Targeting ESXi & (Sygnia)
* Complete List of Hypervisor (HiTech Nectar)
* Securing En - Hypervisor Security Best Practices
* Machine Escape - Wikipedia
* What Is A Machine Escape? (Twingate)
* Understanding : Risks and Precautions (Spyboy Blog 2024)
* Understanding : A Threat to En (Blue Goat Cyber)
* : Speculation Attacks Against TEEs (ACM CCS 2024)
* Spectre BTI Attack Breaks on AMD and Intel CPUs (CSO Online)
* Under Siege: 's Hypervisor Security Nightmare (CyberSRC March 2025)
* Breaking the Barrier: From Web-Shell to Ransomware (Sygnia)
* Forensic Analysis Helps Close Gaps in Hypervisor (TheSer)

Courses

* Zero Day Engineering: Ad Hypervisor Exploit De (4-Day Bootcamp)
* Zero Day Engineering: Hypervisor Research
* Signal Labs: Hypervisor Internals 1
* OffensiveCon: Hypervisor De for Security Analysis
* Recon Training: Hypervisor De for Security Analysis by Satoshi Tanda
* SANS SEC760: Ad Exploit De for Penetration Testers
* Winsider Seminars: Hyper-V and Ad Exploitation Techniques
* Class Central: 90+ Hyper- Courses for 2025

Labs & Tools

Hypervisor De Frameworks:
* GitHub: SimpleVisor - Simple Intel VT-x Hypervisor by Alex Ionescu
* GitHub: hvpp - Lightweight Intel x64/VT-x Hypervisor in C++
* GitHub: Hyper - Tutorial Series with Source Code
* GitHub: HyperDbg Debugger - Hyper Debugger

Exploitation & Research:
* GitHub: Wenzel/awesome- - Comprehensi Resources
* GitHub: WinMin/awesome- - VM & QEMU Escape Exploits
* GitHub: xairy/ - Escape Exploits Collection
* GitHub: shogunlab/awesome-hyper- - Hyper- & Exploitation
* GitHub: husseinmuhaisen/Hypervisor - Comprehensi Resources
* GitHub: IACapstone - Hypervisor Security Assessment
* Metasploit VASTO Module - Assessment Toolkit

Fuzzing Tools:
* Red Hat Morphuzz - Hypervisor Fuzzer for QEMU
* AFL++ - Ad Fuzzing Framework
* libFuzzer - LL Fuzzer
* ClusterFuzz - Google's Fuzzing Infrastructure
* kAFL - Hyper Fuzzer

Analysis & Debugging Tools:
* PulseDBG - Hypervisor Debugger
* Windbg - Windows Debugger with Hyper-
* GDB with QEMU/K Support

Scanners:
* Nessus - Scanner
* OpenVAS - Open Assessment Scanner

Blogs & Series

* Ransomware Operators Exploit ESXi Hypervisor (Microsoft Security Blog July 2024)
* Unknown Attackers Exploit Hyper Holes (The Register March 2025)
* Three Zero-Day Discovered in Products (Cybereason 2025)
* ESXi : How to Find Impacted Assets (Runzero)
* Mass Exploitation of ESXi Hosts (Orange Cyber Defense)
* Threat Actors Exploiting New ESXi (Arete IR)
* Embattled ESXi Hypervisor Flaw Exploitable in Myriad Ways (Dark Reading)
* Attacks on ESXi (Uni of West Oahu Cyber Research)
* Hypervisor Security – Critical USB Controller (Entrust May 2024)
* Securing Machines in QEMU on Linux (Security Boulevard May 2024)
* Rootless Machines with KVM and QEMU (Red Hat De December 2024)
* XEN Hypervisor (ADS Security)
* VENOM - Xen, KVM, and QEMU Ad (NetWorks Group)
* Zero-Day Details and Exploit Publicly A (BleepingComputer)
* Oracle NAT Network DoS (Fortinet Blog)
* C Detection: Critical Pri Escalation (SOC Prime)
* SentinelLabs Finds Three in Oracle (Born's Tech)
* Weekly Recap: Hyper-, RDP Exploits (The Hacker News No 2025)

Presentations & Conferences

* USENIX WOOT 2019: Breaking Turtles All the Way Down - ESXi Exploitation
* Black Hat USA 2016: Ouroboros - Tearing Xen Hypervisor with The Snake
* Black Hat USA 2017: Security Presentations
* USENIX Security 2024: and Cloud Security Sessions
* K 2024: Security and Confidential Computing Track
* K 2025: Ad Security
* DEF CON: Hypervisor and Security Talks (Annual)
* Black Hat: Security Briefings (Annual)
* HITBSecConf: Hypervisor Security Presentations

* YouTube: Hypervisor From Scratch Tutorial Series
* YouTube: ESXi Exploitation Techniques
* YouTube: Hyper- and Exploitation
* YouTube: K Hardening
* USENIX: Security Conference Talks

Notes

* Attack : Guest-to-host , hypervisor pri escalation, denial of service, information leakage, arbitrary code execution, USB controller exploitation, device
* Primary Attack Sources: Guest OS users (76% Xen, 85% KVM), cloud administrators, guest OS administrators, remote users
* Common Attack Types: DoS (44% Xen, 63% KVM), pri escalation (30% Xen, 11% KVM), information leakage (14% Xen, 19% KVM), arbitrary code execution (7% both)
* Major Hyper Targeted: ESXi//Workstation/Fusion, Microsoft Hyper- KVM/QEMU, Xen, Oracle , Parallels Desktop
* 2025 Critical Zero-Days: C (CVSS 9.3), C (CVSS 8.2), C (CVSS 7.1) - actively exploited in the wild, allowing full and hypervisor compromise
* 2024 ESXi Authentication Bypass: C - exploited by ransomware groups (Helldown, Black Basta, Akira, Medusa, Scattered Spider) for mass encryption attacks
* 2024 USB Controller : Four critical flaws in ESXi allowing sandbox and hypervisor bypass with pri guest access
* : C (pri escalation to NT AUTHORITY\SYSTEM), C ( via VBVA), multiple NAT DoS
* Xen : XSA-148, XSA-182 (exploitable logic issues), x86 emulator pri flaws enabling sensiti emulation
* KVM/QEMU Issues: 41+ guest-triggerable C 2009, VENOM , 9pfs implementation flaws, e1000e heap use-after-free, VNC DoS
* Techniques: Hyper attacks (exploit hypervisor code), guest-le (exploit guest OS/applications), buffer o, command injection, shared hardware cache exploitation
* Ad Attacks: (Spectre BTI attack breaking on AMD/Intel), Fire Ant (hyper espionage), BluePill (theoretical hypervisor rootkit)
* Fuzzing Approaches: Morphuzz (Red Hat's QEMU fuzzer using libFuzzer), AFL++ with hypervisor injection, kAFL (hyper OS fuzzing), pattern-based seed generation
* Technology: Intel VT-x, AMD-V (AMD SVM), EPT (Extended Page Tables), VPID ( Processor ID), VMCS ( Machine Control Structure)
* Security Features: VBS ( Based Security), Hyper- Secure Mode (VSM), HVCI (Hyper Code Integrity), SEV-SNP (Secure Encrypted )
* Ransomware Targeting: exploits highly sought after by nation-state actors and organized crime for pri escalation a and reduced detection footprint
* Impact: Full infrastructure compromise, lateral mo across VMs, ransomware deployment at scale, data exfiltration, persistent access
* Detection Challenges: Hyper attacks operate below OS , minimal forensic artifacts, difficult to detect with traditional EDR/A
* Defense Measures: Regular patching (hypervisor, host OS, guest OS), network segmentation, least pri access, disable unnecessary devices, enable security features (VBS, SE hypervisor logs
* Testing En: Build isolated lab with nested support, use snapshots for clean state re, avoid testing on production systems
* Sources: C (, Oracle, Xen, KVM), security ad, CISA KE, security research publications
* Research Institutions: Microsoft Threat Intelligence (MSTIC), Sygnia, Zero Day Engineering, Red Hat Research, Google Project Zero, SentinelLabs
* Legal Warning: Unauthorized exploitation of hypervisor is illegal. All research must be conducted in authorized en with proper permissions
* Ethical Considerations: Responsible disclosure to , coordinated disclosure programs, focus on defensi and improving security
* Best Practices: Keep hyper updated, minimize attack surface (disable unused features), implement defense-in-depth, monitor for unusual , use hardware security features
* Certification Requirements: CISA mandated federal agencies patch critical by March 25, 2025; compliance frameworks (FedRAMP, PCI-DSS) require hypervisor security controls
* Future Trends: Confidential computing adoption (Intel TDX, AMD SEV-SNP, ARM CCA), AI-powered discovery, quantum-resistant hypervisor cryptography, automated exploit detection

Drones Hacking

Books & Whitepapers

The Big Book of Drones

Drone Hacking: Wireless Exploits, GPS Spoofing, and UA

Hacking and securing the AR.Drone 2.0 quadcopter

Drone Hacking: Exploitation and

Drone Hacking with Raspberry-Pi 3 and WiFi Pineapple

Hacking a Commercial Drone

UA: A New Domain for Cyber Power

SoK: Security and Privacy in the Age of Drones

SoK: Security and Privacy in the Age of Commercial Drones

Unmanned Aerial (UA: The Good, The Bad, and the Unaddressed

Continuous authentication of UA command data using beha

Cyber security threat analysis and modeling of an unmanned aerial system

Cyber4Drone: A Systematic Review of Cyber Security and Forensics

Detection of UA and malfunctions in flight data statistics

Hacking a Commercial Drone with Open-Source Software

An Internet of Drones

DRAT: A Penetration Testing Framework for Drones

Penetration testing a ci drone

Attacks, Detection, and Pre on Commercial Drones: A Review

Survey on Anti-Drone Systems: Components, Designs, and Challenges

Jamming and Spoofing Techniques for Drone Neutralization

Assessing the Impact of A Security on Cyber Power

Security Analysis of the Drone Communication Protocol

Protecting Against the Threat of Unmanned Aircraft Systems (CISA)

Drone Security & Privacy (New Prairie Press)

DJI Drone Security White Paper

Drone Security (Scribd)

Drone Hacking (DronXploit PDF)

Analysis of Camera Drones

Counter-UAS Systems Market Report 2024-2025

Drone Security Market Analysis 2024-2030

UA Threats and Mitigation Strategies 2024

DJI Security: 2024 Update on Commercial Drone Security

Parrot Drone Security Documentation

Courses

Beginner to Ad Drone Security Bundle (DroneSec)

C-UAS Site Assessments (DroneSec)

Drone Wi-Fi Hacking (Hakin9)

Drone Hacking Workshop (EC-Council)

Drone Hacking and Forensics Course (CyberFox)

Drone Training (NobleProg)

Certified Drone Cyber Defense Specialist (Tonex)

Drone OSINT In (CUAS Hub)

Aerial Assault: Combining Drones and Pentesting (PentestMag)

Udemy: Drone Security & Penetration Testing 2024

SANS: Securing IoT and UA

Class Central: 30+ Drone Security Online Courses for 2025

Labs

Damn Drone (DVD)

Hack-a-Drone Workshop

Hack-a-Drone (Ordina JTech)

DroneWolf Workshop

Drone Wars Competition

HackTheDrone CTF

Build Your Own Drone Hacking Lab (Tutorial)

DJI Tello EDU Programming Lab

Blogs & Series

Looking at the sky: the world of Drone Pentesting

Drone Penetration Testing & Facility Security

Hacking the DJI Phantom 3

Russian software company hacks DJI drones

CopterSafe (Archives)

How to penetrate a drone using a Flipper Zero

Drone C2 Research: Security Threats and Mitigation

C-UAS Drone Forensics (JAPCC)

DroneSec Blog: Latest UA Insights

GPS Spoofing and Drone Hijacking: A Comprehensi

MAVLink Protocol Security Analysis

Wi-Fi Deauthentication Attacks on Consumer Drones

Counter-Drone Technologies and Legal Implications 2024

Presentations & Conferences

Game of Drones: Drone Defense Market (DEF CON 25)

Drone Hacking Presentation (Bishop Fox)

Hacking Drones (DEF CON 24 Video)

Hacking the Drones (OWASP Slides)

Drone Hacking Workshop Slides

Drone Wars / Hack Drones Slides

Controlling UAVs with Hijacked Radio Links (USENIX)

DroneSploit - BlackHat EU Arsenal

Hacking a Professional Drone (Asia 16)

OWASP Drones Presentation

DEF CON 32 (2024): UA Talks

Black Hat USA 2024: Counter-Drone Technologies and Detection Systems

DroneCon 2024: Cybersecurity Talks

Unmanned Systems Summit 2024: Security Track

Introduction to Drone Hacking (Video)

Hacking Drones with Flipper Zero (Video)

Drone Hacking Demo (Video)

Drone Security Talk (Video)

YouTube: Drone Hacking Tutorial Series 2024

YouTube: GPS Spoofing and Drone Attacks

YouTube: MAVLink Protocol Security

Tools & Frameworks

Drone Hacking Frameworks:
* DroneSploit: Automated Exploitation Framework for Drones
* Snoopy: Distributed Tracking and Profiling Framework (Drones)
* DRAT: Drone Reconnaissance and Auditing Toolkit
* Maldrone: Malicious Drone Research Framework

GPS Spoofing & Jamming:
* GPS-SDR-SIM: GPS Signal Simulator
* HackRF One: Software Defined Radio for GPS Spoofing
* BladeRF: Software Defined Radio Platform
* GNSS-SDR: Open Source GNSS Software Defined Receiver

Wi-Fi Deauthentication & Attack Tools:
* Flipper Zero: Multi-tool for Pentesters (Wi-Fi, Sub-GHz)
* WiFi Pineapple: Wireless Auditing Platform
* Aircrack-ng: Wi-Fi Network Security Testing Suite
* Wifiphisher: Automated Phishing Attacks Against Wi-Fi Networks
* ESP32 Jammer: Wi-Fi/Bluetooth Jammer

MAVLink Protocol Testing:
* MA: Lightweight GCS for MAVLink
* QGroundControl: Ground Control Station for Drones
* DroneKit: Python API for Drone De
* PyMAVLink: Python Implementation of MAVLink Protocol

Drone Detection & Counter-Drone:
* OpenDroneID: Drone Identification and Tracking
* DroneDetect: RF-based Drone Detection System
* C-UAS Technologies: Commercial Counter-Drone Solutions

Forensics & Analysis:
* UA Toolkit
* DJI Flight Log Analyzer
* DroneLogbook: Flight Data Analysis
* Litchi CS: DJI Flight Mission Analysis

OSINT & Reconnaissance:
* Drone Tracking
* FlightRadar24: Real-Time Flight Tracking
* OpenSky Network: Open A Data
* Sky: Aeronautical Charts and Flight Planning

GitHub Resources & Collections:
* Awesome Drone Hacking List
* Drone Hacking Guideline
* Drone Security (GitHub)
* Countermeasures against Drone Hacking
* Hacker Drone
* Drone Hacking Tools
* DJI Phantom
* Drone Hacking Tool

Notes

* Setup your own drone hacking lab using consumer drones (DJI Tello, Parrot AR.Drone, DJI Phantom), SDR hardware (HackRF, BladeRF), and Wi-Fi auditing tools
* 2024-2025 Statistics: Counter-UAS market projected to reach $6.98 billion by 2029 (CAGR 26.8%); 1.6M+ commercial drones registered in US alone
* Market Growth: Global drone security market expected to reach $7.5 billion by 2030; compound annual growth rate (CAGR) of 24.3%
* Security Incidents: 2,000+ reported drone security incidents globally in 2024; 60% invol sur, 25% critical infrastructure threats
* Attack : GPS spoofing (85% success rate on consumer drones), Wi-Fi deauthentication (95% on older models), MAVLink hijacking, RF jamming
* Common Protocols: MAVLink (ArduPilot, PX4), Lightbridge (DJI), OcuSync (DJI), Parrot SDK, DroneKit API
* Communication Channels: 2.4GHz/5.8GHz Wi-Fi, 433MHz/915MHz radio control, GPS L1/L2 bands, 4G/5G cellular
* Popular Targets: DJI Phantom series (35% of consumer market), DJI Ma (30%), Parrot AR.Drone (legacy testing), DJI Tello EDU (educational)
* Attack Types:
- GPS spoofing and location manipulation
- Wi-Fi deauthentication and man-in-the-middle attacks
- MAVLink protocol injection and command hijacking
- RF jamming and signal disruption
- Firmware exploitation and backdoor installation
- Video feed interception and manipulation
- Autonomous flight takeover
* GPS Spoofing Success: 85%+ of consumer drones to GPS spoofing; can redirect drones up to 10km from intended location
* Wi-Fi : 95% of older drone models (pre-2020) to Wi-Fi deauth attacks; modern DJI OcuSync more resilient
* MAVLink Security: Unencrypted by default; allows command injection, telemetry interception, mission manipulation on ArduPilot/PX4 systems
* DJI Security Updates: 2024 security patches address firmware , encrypted communications, geo-fencing impro
* Regulatory Context: FAA Remote ID (2023), EASA drone regulations (2024), NIST cybersecurity framework for UAS
* Legal Warning: Unauthorized interference with aircraft (including drones) is a federal crime in most countries. All testing must be performed on personally owned drones in controlled en with explicit permission
* Ethical Use: These tools are for authorized security research, penetration testing of owned systems, and defensi only
* Lab Hardware: Use DJI Tello EDU ($99), HackRF One ($350), Flipper Zero ($169), WiFi Pineapple ($119), RTL-SDR dongles ($25)
* Software Stack: Kali Linux, DroneSploit, Aircrack-ng, MA, QGroundControl, GPS-SDR-SIM, Wireshark
* Best Practices: Test in isolated en away from airports/restricted airspace, ne flight safety, follow responsible disclosure
* Counter-Drone Technologies: RF detection systems, radar-based tracking, optical/thermal cameras, GPS jamming, net guns, directed energy weapons
* Forensics Capabilities: Extract flight logs, analyze telemetry data, reco footage, identify pilot location, timeline reconstruction
* OSINT Applications: Track drone registrations, identify operators, analyze flight patterns, monitor drone activity near critical infrastructure
* Certification Path: DroneSec certifications, Certified Drone Cyber Defense Specialist (CDCDS), EC-Council Drone Hacking Workshop
* Continuous Learning: Follow DroneSec blog, monitor CVEs for drone firmware, participate in Drone Wars competitions, study C-UAS technologies
* Notable (2023-2024):
- C: DJI firmware buffer o allowing arbitrary code execution
- C: Parrot SDK authentication bypass
- Multiple MAVLink protocol in ArduPilot/PX4 (ongoing research)
* Defense Strategies: Enable Remote ID, use encrypted communication protocols, implement geo-fencing, keep firmware updated, monitor for GPS anomalies
* Emerging Threats (2024-2025): AI-powered autonomous attack drones, swarm coordination exploits, 5G network , quantum-resistant encryption needs

MedTech Hcking

Books & Whitepapers

* Medical Device Cybersecurity for Engineers and Manufacturers (2nd Edition) – *The definiti guide.*
* Hacking Medical Devices (ERNW) – *Technical presentation/whitepaper on device exploitation.*
* Hacking Medical Devices (Slides) – *Technical slides co attack surfaces and protocols.*
* Medical Device Product Security – *Uni of Minnesota (Open Textbook).*
* Medical Instrument Design and De – *Springer.*
* Pre Bluetooth and Wireless Attacks in IoMT Healthcare Systems – *Wiley.*
* Connected Health: The Medical Internet of Things – *NCC Group Whitepaper.*
* Hacking Healthcare: A Guide to Standards, Workflows, and Meaningful Use – *O'Reilly (Essential for hospital infrastructure).*
* Healthcare Information System Hacking & Protection
* Hacking Healthcare: How AI Will Reboot an Ailing System
* Hacking Health: How to Make Money and Sa
* Hacking Medical Devices (Whitepaper) – *Jay Radcliffe (Black Hat).*
* Security and Privacy Issues in Internet of Medical Things
* Deep Learning for Internet of Things Infrastructure – *Wiley Online Library.*
* Playbook for Threat Modeling Medical Devices – *MITRE/FDA (Highly Recommended).*
* FDA: Cybersecurity in Medical Devices - Final Guidance (June 2025) – *Official FDA guidance for premarket submissions.*
* Cybersecurity in Medical Devices (PMC) – *Complex en and multifaceted problem analysis.*
* Unpatched and Outdated Medical Devices Cyber Threats (IC3/FBI) – *FBI Cybersecurity Ad 2022.*
* IoMT Security Frameworks for Risk Assessment (PMC) – *Scoping review of security frameworks.*
* Design of Hack-Resistant Diabetes Devices (PMC) – *Cyber safety disclosure research.*
* 60 Healthcare and Medical Device Cybersecurity Statistics for 2025 (C2A Security)
* Integrating Security into CI/CD Pipelines for Medical Devices (ResearchGate)

Courses

* TÜV SÜD: Medical Device Cybersecurity Training (US)
* TÜV SÜD: Medical Device Software & Security (UK)
* TÜV SÜD: Medical Device Cybersecurity Risk Assessment (E-Learning)
* Tonex: Medical Device Cybersecurity Training
* Tonex: IoMT Security Bootcamp
* CodeRed: Cybersecurity for Healthcare - Part 1
* CodeRed: Cybersecurity for Healthcare - Part 2
* Coursera: Medical Technology and E Specialization – *Univ of Minnesota.*
* IEEE: Medical Device Cybersecurity Certification Program
* Uni of Minnesota: Introduction to Medical Device Cybersecurity (Short Course)
* St. Petersburg College: Medical Device Networking and Cybersecurity Certificate
* CertX: Cybersecurity for Medical Devices – Crash Course
* Oriel Stat: Medical Device Cybersecurity Risk Management Training
* TriMedX: Medical Device Cybersecurity Training and De
* UL Solutions: Medical Device Cybersecurity Certification
* Class Central: 30+ Medical Device Security Online Courses

Labs

*Since actual medical hardware is hard to get, use these software simulators:*

* OpenEMR: Open-source electronic medical record system. Install to practice attacking patient data databases and web .
* Orthanc DICOM Server: Open-source server for medical imaging. Use this to practice attacking DICOM protocols and image manipulation.
* DCM4CHE: Ja for the DICOM standard. Essential for analyzing medical network traffic.
* Biohacking CTF: Keep an eye on .io for their CTF challenges (often released during DEF CON).
* HoneyPots: Look into Conpot (ICS honeypot) and configure it to simulate medical device profiles.
* CICIoMT2024 Dataset: Research dataset with 18 cyberattacks targeted at 40 IoMT devices.
* Horos DICOM : Open-source medical image for macOS.
* Mirth Connect: Open-source HL7 interface engine for healthcare integration testing.

Blogs, Articles & News

* IOActi Testing of the DICOM Protocol – *Deep dive into real-world attacks on medical imaging protocols.*
* BleepingComputer: Medical IoT Devices with Outdated OS Exposed
* DarkReading: Black Hat Flashback - Deadly Consequences of Weak Security
* Medium (Case Study): What Happens When a Glucose Monitor Gets Hacked
* Medium: Why Medical Devices are the Next Big Cybersecurity Risk
* Medium: Medical Devices to Cyber Attacks
* Medium Article: Security Insights
* Biohacking Blog: Updates from the premier medical hacking community.
* MedCrypt Blog: Technical deep-dives on device encryption and security.
* Armis Labs Blog: Famous for disco "Urgent11" and other critical hospital .
* Claroty Medigate: Focuses on IoMT and clinical en security.
* IoMT Statistics & Security Trends 2025 (DeepStrike)
* Forescout: 162 in Connected Medical Devices (Industrial Cyber)
* State of Cybersecurity in Healthcare 2025 (Echelon Risk + Cyber)
* Secureworks: Hacking Intelligent Medical Devices
* Healthcare Cybersecurity 2025: Claroty's Medigate & IoMT (Elisity)
* How Secure Are Health Devices? (Nature npj Digital Medicine)
* Safeguarding Healthcare from IoMT Risks (Le)
* Pacemakers and Insulin Pumps Can Be Hacked (UPI)
* CBS News: How Medical Devices Can Be Hacked
* AAMC: Exposing in Medical Devices
* Insulin Pumps Recalled After Hacking (AFERM)
* Armis: A History of Medical Device Hacking
* CSO Online: Hacking Pacemakers, Insulin Pumps in Real Time
* Patient Insecurity: Explosion of IoMT (Cybersecurity )
* How I Got Into Hacking Ultrasound Machines (Medium)
* FDA Cybersecurity Guidelines for Medical Devices 2024 (Sternum IoT)
* C2A Security: FDA's Final Cybersecurity Guidance June 2025
* Johner Institute: FDA Guidance on Cybersecurity

Presentations & Conferences

* Biohacking Official Channel – *Start here. Contains years of DEF CON talks.*
* Talk: Hacking Medical Devices (Demo)
* Talk: Anatomy of a Medical Device Hack
* Talk: Medical Device Security
* Talk: Real-world IoMT Attacks
* Talk: Securing the Hospital of the Future
* Conference: DefCon/BlackHat Medical Talks
* Talk: The Reality of Medical Device Security
* Demo: Pacemaker/Insulin Pump Security
* Lecture: Medical Device Risk Management
* Talk: Hospital Network Penetration Testing
* Webinar: FDA Cybersecurity Guidelines
* Documentary: Cyber Attacks on Hospitals
* Talk: Biomedical Engineering & Security
* Talk: Wireless Medical Device Attacks
* Talk: Embedded Security in MedTech
* Talk: The Future of IoMT Security
* Talk: Clinical Engineering Perspective
* Talk: Healthcare Cybersecurity Landscape

Tools & Frameworks

DICOM Protocol Tools

* pydicom: Python library for working with DICOM files.
* Pynetdicom3: Python implementation of DICOM network protocol.
* DICOM Toolkit (sdnewhop): Essential toolkit for analyzing and testing DICOM implementations.
* DCM4CHE: Ja for the DICOM standard.
* Radamsa: General purpose fuzzer for DICOM testing.
* PowerTools DICOM & HL7 Utilities: Commercial suite for de and testing.

HL7 Protocol Tools

* HL7Magic (WithSecure): Tool for proxying, parsing and amending HL7 messages (DEF CON 2023).
* hl7 (Python): Python library to parse HL7 messages (hospital data protocol).
* Mirth Connect: Open-source HL7 interface engine.
* MedAudit: Graphical interface for testing devices using HL7 (BlackHat 2017).

Wireless & Network Testing

* KillerBee: Framework for ZigBee exploitation (common in older medical devices).
* Ubertooth: Tools for Bluetooth Low Energy (BLE) monitoring (common in modern wearables).
* Wireshark: Network protocol analyzer with DICOM dissectors.

Medical Device Simulators

* OpenEMR: Open-source electronic medical record system.
* Orthanc: Open-source DICOM server for medical imaging.
* Conpot: ICS/SCADA honeypot that can simulate medical device profiles.

Security Platforms

* Medigate (Claroty): IoMT security platform for clinical en.
* Armis: Agentless device security platform.
* Forescout: Device and control platform.
* MedCrypt: Cybersecurity platform for medical device manufacturers.
* C2A Security: Risk-dri platform for medical devices.

Notes

* FDA Guidance: Mandatory reading for US compliance.
* MDR (Medical Device Regulation): The new European standard for device safety.
* HIPAA Security Rule: US federal law protecting patient health information (PHI).
* ISO 14971: The global standard for risk management to medical devices.
* UL 2900: Standard for Software Cybersecurity for Network-Connectable Products.
* IEC 62304: Medical device software lifecycle processes.
* IEC 81001-5-1: Health software and health IT systems safety, effecti and security.
* IEEE 2621.2: Wireless medical devices cybersecurity assurance.
* MDCG 2019-16: EU guidance on cybersecurity for medical devices.
* IMDRF Principles and Practices for Medical Device Cybersecurity: International framework.

Misc (GitHub Repos, , Reports)

* GitHub: DICOM Toolkit (sdnewhop) – *Essential toolkit for analyzing and testing DICOM implementations.*
* Shared Resource Collection – *Additional materials/drive link.*
* Akitra: Cybersecurity in the IoMT (Article/Report).
* pydicom: Python library for working with DICOM files.
* hl7 (Python): Library to parse HL7 messages (hospital data protocol).
* KillerBee: Framework for ZigBee exploitation (common in older medical devices).
* Ubertooth: Tools for Bluetooth Low Energy (BLE) monitoring (common in modern wearables).
* D1T2 - How to Hack Medical Imaging Applications - Maria Nedyak.pdf

GitHub - sdnewhop/dicom: DICOM secuirty

zn-2019-hm.pdf

Penetration Testing of the DICOM Protocol: Real-World Attacks - IOActi://share.google/

ERNW_CSA-No-Summit_Hacking_Medical_De.pdf

Playbook-for-Threat-Modeling-Medical-Devices.pdf

CPU Exploitation

Books & Whitepapers

* Processor Microarchitecture Security (ACM Guide)
* A Survey of Microarchitectural Timing Attacks (IACR eprint)
* A Survey of Microarchitectural Side-channel , Attacks, and Defenses in Cryptography (ACM Computing Surveys)
* Microarchitectural Attacks in Heterogeneous Systems: A Survey (ACM Computing Surveys)
* A Systematic E of Transient Execution Attacks and Defenses (arXiv)
* A Systematic E of Transient Execution Attacks and Defenses (Daniel Gruss)
* Spectre Attacks: Exploiting Speculati (PDF)
* On the Spectre and Meltdown Processor Security (Mark D. Hill)
* Survey of Transient Execution Attacks (Chinese Academy of Sciences)
* Disco No Security in Modern Processors (MIT)
* Secure Processor Architectures (Springer)
* Secure Computer Architecture in the Post-Meltdown World (SIGARCH)
* Microarchitectural Introduced, Exploited, and Accelerated by Heterogeneous FPGA-CPU Platforms (Springer)
* A New Approach for Rowhammer Attacks (Stony Brook Uni PDF)
* Defeating Software Mitigations against Rowhammer: a Surgical Precision Hammer (VUSec PDF)
* Rowhammer Attacks in Dynamic Random-Access Memory and Defense Methods (PMC)
* Memory Under Siege: A Comprehensi of Side-Channel Attacks on Memory (arXiv)
* A Survey of Side-Channel Attacks and Mitigation for Processor Interconnects (MDPI)
* Cache and Speculative Side Channel Attacks: A Comprehensi (Springer)
* Survey of CPU Cache-Based Side-Channel Attacks: Systematic Analysis, Security Models, and Countermeasures (Hindawi)
* Cache Side Channel Attack: Exploitability and Countermeasures (Black Hat Asia 2017 PDF)
* Security, Performance and Energy Trade-offs of TEEs (arXiv)

Courses

* MIT OpenCourseWare: Lecture 16 - Side-Channel Attacks (Computer Systems Security)
* Class Central: 200+ Side Channel Attacks Online Courses for 2025
* Side Channel Attacks for Hardware N00BZ - Securing Hardware Workshop
* CASS-KUL: Session 7 - Caches and Microarchitectural Timing Attacks
* MIT 6.5950/6.5951: Cache Attacks Lab

Labs

Official Sites:
* Meltdown and Spectre Official Website
* Spectre Attack Official Website

GitHub Resource Collections:
* GitHub: speed47/spectre-meltdown-checker - Checker for Multiple Attacks
* GitHub: IAIK/meltdown - Meltdown Bug Demonstration Applications
* GitHub: paboldin/meltdown-exploit - Meltdown Exploit PoC
* GitHub: Frichetten/meltdown-spectre-poc - Combined Meltdown & Spectre PoCs
* GitHub: kianenigma/meltdown-spectre - PoC Implementation with Tutorial
* GitHub: jarmouz/spectre_meltdown - CPU Explained & Exploited
* GitHub: adamalston/Meltdown-Spectre - Exploited

Attack Tools & Frameworks:
* GitHub: cache_template_attacks - Cache Template Attack Tools (IAIK)
* GitHub: Security-RISC - Microarchitectural Attacks on RISC-V CPUs (CISPA)
* GitHub: Mastik Toolkit - Cache-based Side-Channel Attacks (Yu)
* GitHub Topics: Cache Attack Repositories
* GitHub Topics: Side-Channel Attacks Repositories
* GitHub Topics: Microarchitectural Attack Repositories
* GitHub: uarchsec - Microarchitecture Security Resources
* Hammertime: Rowhammer Testing Suite
* MemTest86 v5.0: Rowhammer Test

Blogs & Series

* What are the Spectre and Meltdown CPU (Cybereason)
* New Research Reveals Spectre Persists in Latest AMD and Intel Processors (The Hacker News 2024)
* TEE.Fail: Researchers Break Intel SGX/TDX and AMD SEV-SNP (Security Online)
* TEE.Fail Attack Breaks Confidential Computing on Intel, AMD, NVIDIA CPUs (BleepingComputer)
* New TEE.Fail Side-Channel Attack Extracts Secrets from Intel and AMD DDR5 Secure Enclaves (The Hacker News)
* Intel SGX and AMD SE to Physical Attacks (WebProNews)
* Cheap Hardware Hacks Shatter Nvidia, AMD, Intel Encla (WebProNews)
* ρHammer: Re RowHammer Attacks on New Architectures (ACM)
* Using Rowhammer Attacks on DDR4 Memory in Modern Systems (Medium)
* Rowhammer Attacks: Exploiting DRAM in Modern Systems (Medium)
* Side-Channel Attacks: Methods Exploits and Defense Guide (Startup Defense)
* What is Side Channel Attacks? (Training Camp)
* CPU Cache Side-Channel Attacks: Meltdown & Spectre (Guanzhou Hu)
* What is a Timing Attack? (TechTarget)
* What is a Side Channel Attack? (Comparitech)
* Fundamentally Understanding and Solving RowHammer (ACM)
* When Mitigations Backfire: Timing Channel Attacks for PRAC-Based RowHammer Mitigations (arXiv)
* DEACT: Hardware Solution to Rowhammer Attacks (Science Publications)

Presentations & Conferences

* Black Hat USA: CPU Exploitation Presentations
* DEF CON: Hardware Hacking and CPU Security Talks
* Black Hat USA 2024: Arbitrary Data Manipulation and Leakage with CPU Zero-Day Bugs on RISC-V
* Black Hat 2025 & DEF CON 33 August 2025 Las Vegas
* USENIX Security: Lord of the Ring(s) - Side Channel Attacks on CPU Ring Interconnect
* ACM SIGARCH: Secure Computer Architecture in Post-Meltdown World
* IEEE S&P 2023: A Security RISC - Microarchitectural Attacks on Hardware RISC-V CPUs
* ACM Microarchitecture Symposium: ρHammer Presentation
* ACM CCS 2017: Cache Side Channels Tutorial

* YouTube: Meltdown and Spectre Explained
* YouTube: CPU Cache Side-Channel Attacks Tutorial
* YouTube: Rowhammer Attack Demonstration
* YouTube: Intel SGX Attacks Explained
* YouTube: Spectre and Meltdown DEF CON Talks
* YouTube: CPU Timing Attacks Tutorial

Tools & Frameworks

Spectre & Meltdown Tools:
* Spectre & Meltdown Checker Scripts
* InSpectre: Spectre/Meltdown Scanner
* Microsoft Hardware Readiness Tool

Cache Attack Tools:
* Cache Template Attacks Framework
* Mastik: Microarchitectural Side-Channel Toolkit
* Flush+Reload Attack Tools
* Prime+Probe Implementation

Rowhammer Tools:
* Hammertime: Rowhammer Testing Suite
* RAMBleed Exploit
* BLACKSMITH: Rowhammer Fuzzer
* TRRespass: Rowhammer Attacks Toolkit

SGX/TEE Attack Tools:
* SGX-Step: A Framework for Intel SGX Attacks
* Foreshadow Attack POC
* SGAxe: Side-Channel Attack on SGX
* TEE.Fail Research Code

Side-Channel Analysis:
* ChipWhisperer: Side-Channel Analysis Platform
* SCALib: Side-Channel Analysis Library
* Riscure Inspector: Side-Channel Analysis Tool

Research & De:
* Security-RISC: RISC- Attacks
* MicroScope: Microarchitecture Modeling Framework
* Transient Fail: Transient Execution Attacks

Notes

* 2024-2025 Major Attacks: Training Solo (May 2025) affects all Intel CPUs with eIBRS; Branch Pri Injection (May 2025) affects Intel 9th gen+; (September 2025) exploits incomplete isolation in branch predictor between VMs
* 2024 Notable Attacks: BHI exploitable in Linux user space; TikTag attack against ARM v8.5A Memory Tagging Extension; Indirector attack on Intel Alder/Raptor Lake; TSA attacks on AMD Zen 3/4
* Transient Execution Attacks: Exploit processor optimizations to bypass security checks and exfiltrate sensiti through covert channels; affects Intel, AMD, and ARM processors
* Spectre Family: Exploits speculati to access unauthorized memory; multiple discovered (v1, v2, BTI, PHT, STL); persists in latest processors despite mitigations
* Meltdown: Breaks isolation between user applications and operating system; allows reading kernel memory from user space; primarily affects Intel processors
* TEE.Fail Attack (October 2025): Breaks Intel SGX/TDX and AMD SEV-SNP using sub-$1,000 DDR5 memory bus attack; extracts attestation keys and cryptographic material; built using off-the-shelf hardware
* Rowhammer: Exploits DRAM cell interaction to flip bits in adjacent memory rows; affects DDR3, DDR4, and DDR5 memory; include BLACKSMITH, TRRespass, ρHammer
* Cache Timing Attacks: Exploit CPU cache behavior to infer secret information; techniques include Flush+Reload, Prime+Probe, Evict+Time, Flush+Flush
* Side-Channel Attacks: Le timing, power consumption, electromagnetic emissions, or acoustic signatures; target cryptographic implementations and secure enclaves
* Intel SGX Attacks: SGAxe, Foreshadow, Spectre-SGX, SGX-Step; exploit speculati and cache timing; compromise encla
* AMD SE: SEVered, SE, CrossLine; exploit memory encryption weaknesses; affect confidential computing in cloud en
* RISC-: Emerging attack surface; Security-RISC demonstrates Spectre-v1 and cache attacks on hardware RISC- mitigations
* Mitigation Challenges: Microcode updates impact performance (5-30% o); some attacks have no complete mitigation; ongoing cat-and-mouse between attackers and defenders
* Responses: Intel implements eIBRS, IBPB, STIBP; AMD uses LFENCE dispatch serialization; ARM introduces CSV2, CSV3 mitigations; physical attacks often out-of-scope
* Attack Prerequisites: Some require local access, others remote timing obser; vary from user-mode to kernel pri; physical attacks require hardware interposition
* Testing Tools: MemTest86 for Rowhammer detection; spectre-meltdown-checker for assessment; ChipWhisperer for side-channel analysis
* Research Institutions: Leading work from MIT, ETH Zurich, Georgia Tech, Purdue, VUSec, IAIK Graz, CISPA; publications in USENIX, IEEE S&P, ACM CCS
* Real-World Impact: Cloud security compromised by ; cryptographic keys extracted from SGX enclaves; browser-based attacks
* Defense Strategies: Hardware fixes (CPU redesign, memory encryption); software mitigations (kernel page-table isolation, retpoline); compiler-based defenses (lfence insertion)
* Performance : Mitigations introduce significant o; context switching costs increase; some features disabled (hyperthreading, speculati)
* Future Trends: Quantum-resistant side-channels; AI-accelerated attack discovery; formal of microarchitectural security; hardware-software co-design for security
* Lab Setup: Use test systems; QEMU for safe experimentation; logic analyzers for hardware attacks; isolated networks for testing
* Legal Warning: Unauthorized exploitation of CPU is illegal; research requires responsible disclosure; testing only on authorized systems with proper permissions
* Ethical Considerations: Coordinate disclosure with (typically 90-day embargo); publish proof-of-concepts responsibly; consider societal impact before public release
* Hardware Requirements: Logic analyzer for memory bus attacks; oscilloscope for power analysis; FPGA for custom attack implementations; DDR interposers for TEE.Fail-style attacks
* Best Practices: Stay updated on latest CVEs; apply security patches promptly; disable hyperthreading if high security required; use constant-time cryptographic implementations
* Detection Methods: Performance anomaly detection; cache occupancy monitoring; memory access pattern analysis; timing detection
* Academic Resources: arXiv for latest preprints; IACR ePrint for cryptographic attacks; ACM/IEEE digital libraries for peer-re research
* Industry Standards: Common and Exposures (C; CERT coordination; security ad; NIST guidelines

GPU Exploitation

Books & Whitepapers

* GPU Computing Gems (Morgan Kaufmann) - Ad GPU Programming
* CUDA by Example: An Introduction to General-Purpose GPU Programming
* OpenCL Programming Guide by Aaftab Munshi, Benedict Gaster, Timothy Mattson
* Exploiting GPU Drivers: Security in Graphics Processing (Black Hat 2017)
* Breaking Down the Boundaries: Attacks on GPU Isolation (USENIX Security 2023)
* GPU Security : Attacks on NVIDIA, AMD, and Intel Graphics (Tencent Blade Team)
* Exploiting Qualcomm Adreno GPU on Android (Tencent 2019)
* C: NVIDIA GPU Dri of Pri (NVD)
* AMD GPU Dri Research (GPUOpen 2024)
* GPU Side-Channel Attacks: Leaking Data Through Graphics (Research Paper)
* GPU Memory Side-Channels: A Survey (IEEE 2023)
* Exploiting GPU in Cloud En ( Research)
* GPU Kernel Dri Techniques (Phrack Magazine)
* Breaking TrustZone on Mobile GPUs (ARM Mali Security Research)
* Intel Graphics Dri: A Deep Di Zero)
* GPU DMA Attacks: Direct Memory Access Exploitation (BlackHat Asia 2021)
* CUDA Security: Exploiting NVIDIA's Parallel Computing Platform
* GPU Security: vGPU Attack Surface Analysis
* AMD ROCm Security Whitepaper (2024)

Courses

* Exodus Intelligence: GPU Security Research Training
* OffensiveCon: GPU Exploitation Workshops
* NVIDIA CUDA Training & Certification
* AMD ROCm De Training
* Khronos OpenCL Training Courses
* Udacity: Intro to Parallel Programming (CUDA)
* Coursera: GPU Programming Specialization

Labs & Tools

GitHub Resource Collections:
* GitHub: xairy/linux-kernel-exploitation - Includes NVIDIA & Mali GPU Exploits
* GitHub: 0xor0ne/awesome-list - Mali GPU Research
* GitHub: CaledoniaProject/dri - Exploitable Drivers Collection
* GitHub: TakahiroHaruyama/VDR - Dri Tool
* GitHub: stong/C - Dri Tutorial
* GitHub: hacksysteam/HackSysExtreme - HEVD for Dri

GPU De & Tools:
* NVIDIA CUDA Toolkit - GPU De En
* AMD ROCm - Open-Source GPU Compute Platform
* Intel oneAPI - Unified GPU/CPU Programming
* GPUOpen - AMD's Open-Source GPU Tools
* NVIDIA Nsight - GPU Debugging & Profiling Tools
* Radeon GPU Profiler (RGP) - AMD Performance Analysis
* Intel Graphics Performance Analyzers (GPA)
* GPU-Z - Graphics Card Information & Monitoring
* MSI Afterburner - GPU O & Monitoring
* Syzkaller - Kernel Fuzzer (GPU Dri)
* AFL++ - GPU Dri Framework
* QEMU GPU Passthrough - GPU Testing
* GPU Ocelot - Dynamic GPU Compiler Framework
* Barra - GPU Scanner
* NVIDIA N - BIOS Flashing Tool
* AMD - GPU BIOS Flashing Utility
* GPU Shark - GPU Monitoring & Analysis
* nvtop - NVIDIA GPU Process Monitor (Linux)
* radeontop - AMD GPU Monitor for Linux

Blogs & Series

* C: NVIDIA GPU Dri Escalation - Critical (2024)
* C: AMD Radeon GPU Dri Corruption (2024)
* C: Qualcomm Adreno GPU Exploit - Remote Code Execution (2024)
* C: Intel Graphics Dri - Actively Exploited (2023)
* Google Project Zero: GPU Dri Research
* NVIDIA Security Bulletins: GPU Dri
* AMD Product Security: Radeon GPU Dri
* Qualcomm Security Bulletins: Adreno GPU
* Tencent Blade Team: QualpWN - Qualcomm GPU Exploitation
* ARM Mali GPU Security Research
* GPU Memory : Lefto Attack (2024)
* Trail of Bits: GPU Security Research Blog
* Kernel Café: GPU Dri Series
* ZDI (Zero Day Initiative): GPU Dri
* GitHub Security Lab: GPU Dri Results
* NCC Group: Graphics Dri Research
* Quarkslab Blog: GPU Exploitation & Reverse Engineering
* GRIMM: GPU Security Research
* OpenGL : Khronos Security Ad
* Security: Graphics API Exploitation Research

Presentations & Conferences

* Black Hat USA: GPU Dri Talks
* DEF CON: Hardware Hacking - GPU Security
* Pwn2Own: GPU Dri Demonstrations
* HITB (Hack in The Box): GPU Security Research
* OffensiveCon: GPU Exploitation Workshops
* REcon: GPU Reverse Engineering Conference
* INFILTRATE: Graphics Dri Research
* SIGGRAPH: GPU Security & Trusted Graphics
* GTC (GPU Technology Conference) - NVIDIA Security Track
* AMD GPU Open De Conference

* Li: GPU Dri Series
* NVIDIA De: CUDA Security Best Practices
* GPU Technology Conference: Security Talks

---

Notes

1. GPU Dri Exploitation
- GPU drivers run in kernel mode with high pri (Ring 0 on x86, EL1 on ARM)
- Common : NVIDIA (GeForce, Quadro, Tesla), AMD (Radeon, RDNA), Intel (Arc, Iris Xe), Qualcomm (Adreno), ARM (Mali)
- Attack surface: IOCTL handlers, memory management (VRAM/system RAM mapping), command submission, shader compilation
- Common : use-after-free, buffer o, integer o, race conditions, type confusion
- Tools: IDA Pro, Ghidra, WinDbg, LLDB, Syzkaller (GPU dri)

2. NVIDIA GPU Dri
- NVIDIA dominates discrete GPU market (80%+ market share)
- Dri: nvidia.ko (Linux), n.sys (Windows)
- Common targets: IOCTL handlers (N* functions), U Memory), CUDA runtime
- C (2024): Critical pri escalation in NVIDIA GPU driver
- Research: Google Project Zero's extensi dri

3. AMD Radeon GPU Dri
- AMD GPU drivers: amdgpu.ko (Linux), amdkmdag.sys (Windows)
- ROCm (Radeon Open Compute): Open-source compute platform
- Common : DRM (Direct Rendering Manager) bugs, memory mapping issues
- C (2024): AMD Radeon dri corruption

4. Qualcomm Adreno GPU Exploitation
- Adreno GPUs dominate Android mobile market (Snapdragon SoCs)
- Attack surface: kgsl (Kernel Graphics Support Layer), GPU firmware, command submission
- QualpWN (Tencent Blade Team 2019): Qualcomm GPU/WLAN dri chain
- C (2024): Adreno GPU remote code execution
- Mobile exploitation: Adreno exploits often used in Android pri escalation chains

5. Intel Graphics Dri
- Intel integrated GPUs (Iris Xe, UHD Graphics, Arc discrete GPUs)
- Drivers: i915.ko (Linux), igdkmd64.sys (Windows)
- Common : Display engine bugs, GuC (Graphics Microcontroller) issues
- C (2023): Intel graphics dri exploited in the wild

6. ARM Mali GPU Exploitation
- ARM Mali GPUs pre in mobile/embedded devices (Samsung Exynos, MediaTek)
- Attack surface: Mali kernel driver, job scheduling, memory management
- TrustZone integration: Mali Protected Mode for secure video playback
- Research: Breaking TrustZone via Mali GPU

7. GPU Side-Channel Attacks
- Timing attacks: Measuring GPU execution time to infer data
- Cache attacks: GPU cache side-channels (similar to CPU Spectre/Meltdown)
- GPU memory side-channels: Leaking data through VRAM access patterns
- Cross-: Exploiting shared GPU in cloud en
- Notable: Lefto (2024) - GPU memory disclosure affecting AMD, Apple, Qualcomm

8. GPU DMA (Direct Memory Access) Attacks
- GPUs can directly access system memory via DMA
- PCIe DMA attacks: GPU as a rogue DMA device
- IOMMU bypass: Exploiting IOMMU (Input-Output Memory Management Unit) misconfigurations
- Physical attacks: GPU DMA for cold boot attacks, memory imaging
- Mitigations: VT-d (Intel), AMD-Vi, PCIe ACS (Access Control Services)

9. GPU Exploitation
- GPU passthrough: Dedicated GPU assignment to VMs (VFIO, SR-IOV)
- vGPU ( GPU): Time-sliced GPU sharing (NVIDIA GRID, AMD MxGPU)
- Attack : via GPU driver bugs, GPU memory isolation bypasses
- Cloud en: Exploiting shared GPU in AWS, Azure, GCP instances
- Research: GPU security research

10. Graphics API
- OpenGL: Legacy graphics API, in shader compilers, extensions
- : Modern low-le API, explicit memory management
- DirectX: Windows graphics API (D3D11, D3D12)
- Metal: Apple's graphics API for macOS/iOS
- Common issues: Shader compiler bugs, invalid API state handling, memory corruption in runtime

11. GPU Firmware Exploitation
- GPU VBIOS/UEFI GOP (Graphics Output Protocol)
- GPU microcontroller firmware: NVIDIA GSP (GPU System Processor), AMD SMU (System Management Unit)
- Firmware update mechanisms: Exploiting insecure BIOS flashing
- Persistent threats: GPU firmware rootkits, BIOS-le
- Tools: NVIDIA N, AMD , GPU-Z BIOS dumping

12. CUDA & GPU Compute Exploitation
- CUDA: NVIDIA's parallel computing platform (widely used in AI/ML)
- GPU compute : Kernel memory leaks, buffer o in CUDA kernels
- OpenCL/ROCm exploitation: Cross-platform GPU compute security
- AI/ML attacks: Poisoning GPU-accelerated machine learning models
- Cryptocurrency mining malware: GPU hijacking for cryptojacking

13. GPU Fuzzing & Discovery
- Syzkaller: Google's kernel fuzzer, supports GPU dri
- AFL++: Fuzzing GPU userspace libraries and APIs
- IOCTL fuzzing: Targeting GPU dri interfaces
- Shader fuzzing: Finding bugs in shader compilers (GLSL, HLSL, SPIR-V)
- Co fuzzing: Instrumented GPU dri for code co

14. Notable GPU Exploits & CVEs
- C (2024): NVIDIA GPU dri escalation - critical se
- C (2024): AMD Radeon dri corruption
- C (2024): Qualcomm Adreno GPU remote code execution
- C (2023): Intel graphics dri exploited
- Lefto (2024): GPU memory disclosure affecting AMD, Apple, Qualcomm GPUs
- QualpWN (2019): Tencent's Qualcomm Adreno GPU chain
- Project Zero: Numerous NVIDIA/AMD/Intel GPU dri disclosed

15. Legal & Ethical Considerations
- GPU security research is legal when conducted on your own hardware
- NVIDIA, AMD, Intel, Qualcomm have bug bounty programs for GPU dri
- Unauthorized exploitation of cloud GPU instances is illegal
- Always obtain proper authorization before testing GPU systems
- Responsible disclosure through security teams or coordinated disclosure platforms

16. 2024-2025 GPU Exploitation Trends
- Increased focus on AI/ML GPU workload security (CUDA exploits)
- Cloud GPU exploitation: Attacking shared GPU in AWS, Azure, GCP
- Lefto GPU memory disclosure
- GPU side-channel attacks for cryptographic key extraction
- NVIDIA H100/A100 security research (datacenter GPUs)
- AMD Instinct MI300 exploitation research (AI accelerators)
- Qualcomm Adreno exploitation for Android pri escalation
- GPU firmware rootkit research (persistent GPU-le)
- C, C, C: Critical GPU dri

macOS Exploitation

Books & Whitepapers

* The Mac Hacker's Handbook by Charlie Miller & Dino Dai Zovi
* macOS and iOS Internals, III: Security & Insecurity by Jonathan Levin
* *OS Internals ( I, II, III) by Jonathan Levin - Comprehensi Internals
* Mac OS X Internals: A Systems Approach by Amit Singh
* Hacking and Securing iOS Applications: Stealing Data, Hijacking Software, and How to Prevent It by Jonathan Zdziarski
* Mac Malware: The Art and Science of Detection (SentinelOne Whitepaper)
* Examining Pointer Authentication on macOS (Google Project Zero Paper)
* macOS Kernel Exploitation: Attacks and Mitigations (SyScan 2014)
* Exploiting the XNU Kernel in El Capitan (Black Hat 2016 - Liang Chen)
* macOS Security and Pri Escalation (Phrack Magazine)
* Ad macOS Exploitation Techniques (USENIX Security)
* XCSSET: macOS Malware Campaign Analysis (Trend Micro 2021)
* Sil: macOS M1 Malware Analysis (Red Canary 2021)
* macOS Transparency, Consent, and Control (TCC) Bypass Research
* macOS Gatekeeper Bypass Techniques (Objecti Research)
* Attacking the macOS XPC Security Model (NCC Group 2020)
* macOS System Integrity Protection (SIP) Bypass Research (Project Zero)
* The Mac Security Blog by Patrick Wardle (Objecti)
* macOS Exploit De: Zero to Hero (OffensiveCon 2023)
* Analyzing FORCEDENTRY: Zero-Click iMessage Exploit (Citizen Lab 2021)

Courses

* Offensi: Ad macOS Control Bypasses (EXP-312)
* Exodus Intelligence: macOS Research & Exploitation Training
* OffensiveCon: macOS Offensi Workshops
* ZeroNights Training: macOS Security & Exploitation
* Azeria Labs: ARM64 Assembly & macOS Reverse Engineering
* Objecti Training: macOS Security Internals
* Signal Labs: macOS Application Security Assessment
* Corellium Training: macOS Kernel Debugging and Exploit De

Labs & Tools

GitHub Resource Collections:
* GitHub: michalmalik/osx-re-101 - OSX/iOS Reverse Engineering Resources
* GitHub: kai5263499/osx-security-awesome - OSX/iOS Security Resources
* GitHub: houjingyi233/macOS-iOS-system-security - macOS/iOS System Security
* GitHub: ashishb/osx-and-ios-security-awesome - macOS Security Tools Collection

Kernel Exploits:
* GitHub: A2nkF/macOS-Kernel-Exploit - C Exploit
* GitHub: jeffball55/intro_to_xnu_exploitation - XNU Exploitation Introduction

Official Sources:
* XNU Kernel Source Code (Darwin)
* Apple OSS Distributions - XNU Kernel

Security Tools:
* Objecti Security Tools - macOS Security Utilities
* lldb - macOS Debugger (Apple's Official Debugger)
* Hopper Disassembler - macOS Binary Analysis Tool
* Ghidra - macOS Kernel & Binary Reverse Engineering
* IDA Pro - macOS ARM64/x86_64 Disassembly & Debugging
* Frida - Dynamic Instrumentation for macOS
* dtrace - macOS Dynamic Tracing Framework
* class-dump - Objective-C Class Dumper for macOS
* Keystone Engine - Assembler Framework for macOS Exploitation
* SuspiciousPackage - macOS Package Inspector
* KnockKnock - macOS Persistence Detection Tool
* BlockBlock - macOS Persistence Monitor
* LuLu - macOS Firewall & Network Monitor
* O - macOS Webcam & Microphone Monitor
* FileMonitor - macOS File System Monitor
* macOS Kernel Debugging with LLDB
* SF Symbols - Apple's macOS Icon Library (for app analysis)

Blogs & Series

* C: macOS XNU Kernel Use-After-Free - Actively Exploited (2025)
* C: macOS TCC Bypass (2024)
* C: macOS Kernel Pri Escalation - Exploit in the Wild (2024)
* C: macOS Gatekeeper Bypass (2024)
* Objecti Blog: macOS Malware & Research
* Patrick Wardle: macOS Security Research & Exploits
* Jonathan Levin's Blog (*OS Internals & Exploitation)
* Google Project Zero: macOS Exploits & Research
* Wojciech Regula: macOS TCC Bypass Research
* Cedric Owens: macOS Red Team Research
* Phil Stokes: macOS Malware Analysis (SentinelOne)
* Thomas Reed: macOS Security & Malwarebytes Research
* Jamf Threat Labs: macOS Security Research
* Csaba Fitzl: macOS Security & Reverse Engineering
* Offensi Research by Cody Thomas
* The Mac Security Blog (Intego)
* FORCEDENTRY: Zero-Click macOS/iOS iMessage Exploit (Citizen Lab 2021)
* XCSSET: macOS Malware Exploiting Xcode Projects (2020-2021)
* SolarWinds Superno Implant Analysis (2021)
* macOS Monterey Security Changes & Bypasses (Wojciech Regula 2021)

Presentations & Conferences

* Black Hat USA: macOS Security & Exploitation Talks
* DEF CON: macOS Hacking & Presentations
* Pwn2Own: macOS Safari & Kernel Exploit Demonstrations
* Objective by the Sea: Annual macOS Security Conference
* OffensiveCon: macOS Exploitation Workshops
* INFILTRATE: macOS Offensi Conference
* POC (Power of Community) - macOS Kernel Exploitation
* SyScan: macOS Security & Exploitation Archive
* HITB (Hack in The Box): macOS Security Research
* RSA Conference: macOS Enterprise Security Track

* Patrick Wardle (Objecti): macOS Security Talks
* Li: macOS Hacking & Reverse Engineering
* Objective by the Sea Conference

Notes

1. XNU Kernel Exploitation
- XNU is a hybrid kernel (Mach microkernel + BSD components), shared with iOS
- Common targets: IOKit drivers, network stack, file systems, kext
- Modern mitigations: KASLR, kernel PAC (KPAC on Apple Silicon), zone_require, PPL (Page Protection Layer)
- Exploitation techniques: Use-after-free, heap feng shui, OOL (out-of-line) ports, arbitrary read/write primitives
- Tools: lldb with KDK (Kernel Debug Kit), IDA Pro, Ghidra, dtrace

2. Gatekeeper Bypass
- Gatekeeper enforces code signing and notarization for downloaded applications
- Historical bypasses: archi exploits, symlink attacks, quarantine attribute manipulation
- C (2024): Recent Gatekeeper bypass allowing unsigned code execution
- Research: Objecti's extensi bypass research (Patrick Wardle)

3. System Integrity Protection (SIP) Bypass
- SIP prevents modification of system files and processes, even with root pri
- Introduced in macOS El Capitan (10.11), restricts access to /System, /usr, /bin, etc.
- Bypass techniques: kernel exploits, NVRAM manipulation, Recovery Mode abuse
- C (2021): SIP bypass XPC service
- Research: Google Project Zero's SIP bypass research

4. Transparency, Consent, and Control (TCC) Bypass
- TCC controls app access to sensitive data (location, camera, microphone, contacts, photos, etc.)
- TCC database: /Library/Application Support/com.apple.TCC/TCC.db (SQLite)
- Bypass techniques: synthetic clicks, accessibility API abuse, database manipulation, XPC exploits
- Notable: C (Music.app TCC bypass), C (Safari TCC bypass)
- Research: Wojciech Regula's extensive TCC bypass research

5. macOS Sandboxing & Entitlements
- App Sandbox restricts application capabilities (file access, network, IPC)
- Entitlements define app pri (e.g., com.apple.security.cs.allow-dyld-en)
- Sandbox profiles written in SBPL (Sandbox Profile Language)
- Exploitation: sandbox escapes via XPC, Mach ports, shared memory

6. XPC Service Exploitation
- XPC (Inter-Process Communication) is macOS's primary IPC mechanism
- Attack surface: pri helper tools, LaunchDaemons, XPC services running as root
- Common : improper entitlement checks, lack of input , race conditions
- Research: NCC Group's "Attacking the macOS XPC Model" (2020)

7. Code Signing & Notarization
- All apps must be signed with valid Apple De ID
- Notarization: Apple scans apps for malware before distribution (macOS 10.15+)
- Ad-hoc signing ID signing
- Self-signing techniques for local exploitation

8. macOS Persistence Techniques
- LaunchAgents/LaunchDaemons (plist files in /Library/LaunchAgents, ~/Library/LaunchAgents)
- Login items (LSSharedFileList API)
- Cron jobs, periodic scripts
- Dylib hijacking, dylib proxying
- Kernel extensions (kexts) - deprecated on Apple Silicon
- System extensions (macOS 10.15+)
- Tools: KnockKnock, BlockBlock for persistence detection

9. Notable macOS Exploits & Campaigns
- FORCEDENTRY (2021): Zero-click iMessage exploit targeting macOS/iOS (NSO Group Pegasus)
- XCSSET (2020-2021): macOS malware exploiting Xcode projects, Safari 0-days
- Sil (2021): macOS M1 malware discovered on 30,000+ Macs
- C (2025): XNU kernel use-after-free, actively exploited in the wild
- C (2024): Kernel pri escalation exploited in the wild
- C (2024): Gatekeeper bypass allowing unsigned code execution

10. Apple Silicon (M1/M2/M3/M4) Security
- ARM64 architecture with Apple-designed SoCs
- Pointer Authentication (PAC): Hardware-based code integrity
- Secure Encla processor for cryptographic operations
- Kernel extensions (kexts) no longer supported, replaced by System Extensions
- Boot security: Secure Boot, Signed System (SSV)
- Research challenges: Limited kernel debugging on Apple Silicon

11. macOS Malware Analysis
- Common malware families: Shlayer, OSX.Dok, MacKeeper, Genieo, Flashback
- 2024-2025 trends: Infostealer malware targeting crypto wallets, password managers
- Detection e: TCC bypasses, Gatekeeper bypasses, process injection
- Tools: Objecti suite (KnockKnock, BlockBlock, LuLu, O), , ANY.RUN

12. Legal & Ethical Considerations
- macOS security research is legal when conducted on your own devices
- Apple Security Bounty offers rewards up to $1 million for critical macOS exploits
- Unauthorized access to others' macOS systems is illegal under CFAA (US)
- Responsible disclosure through Apple Product Security or coordinated disclosure platforms
- Never use exploits for unauthorized access, stalkerware, or malicious purposes

13. 2024-2025 macOS Exploitation Trends
- Increased focus on TCC bypass techniques (privacy controls e)
- Apple Silicon (M-series) exploitation research growing
- Zero-click exploits targeting iMessage, FaceTime, AirDrop
- Gatekeeper bypass research continues (notarization e)
- SIP bypass research for persistence and defense e
- macOS Sequoia (macOS 15) hardening: enhanced TCC, improved XPC
- C and C: Actively exploited kernel
- Growing macOS malware ecosystem targeting enterprise en
- M4 chip security research (released 2024)

Satellite Hacking

Books & Whitepapers

The Spacecraft Hacker's Handbook

Satellite hacking: A guide for the perplexed

Satellite Network Threats Hacking & Security Analysis

Ad Penetration Testing: Hacking Satellite Communication

Cybersecurity for Space

Cybersecurity for Space: Protecting the Final Frontier

Satellite Network Hacking & Security Analysis (Journal)

Satellite Cyberattack Whitepaper (HDI Global)

Satellite Hacking: Cybersecurity Threats in Space IoT Systems

The Dark Art and Science of GPS Spoofing

Safeguarding Satellite Communications

Hack-A-Sat 4 Finalist Technical Papers

Hack-A-Sat 2 Finalist Technical Papers

Satellite Security Technical Paper

Courses

Space Hacking Certification (SHC)

Certified Space Security Specialist Professional (CSSSP)

Certified Space Penetration Professional (CSPP)

Certified Space and Satellite Security Analyst (CSSSA)

Aerospace Cybersecurity: Satellite Hacking (PentestMag)

Satellite Cybersecurity (Udemy)

Cybersecurity and Satellite Systems Training (Tonex)

Labs

Hacking Satellites: Analysis and Defense Lab (Medium Archive)

How to Hack a Satellite (PwnSat Project)

Satellite Hacking Workshop (GitHub)

Hack-A-Sat Finals 2023 Resources

Hack-A-Sat Finals 2022 Resources

Hack-A-Sat Finals 2021 Resources

DoD Hack-A-Sat Library

Blogs & Series

Satellite Hacking (Black Hills Infosec)

Satellite Hacking: An Introduction (Hackers-Arise)

Satellite Hacking: Hacking the Iridium System (Hackers-Arise)

Satellite Hacking Part 1: Getting Started (Hackers-Arise)

Hacking a Satellite: More Common Than You Think (Medium)

Presentations & Conferences

Hacking Satellites with Software Defined Radio (Video)

Hacking Satellites: Hardware & Software (Video)

The Risk to Space & Satellite Communications (SANS)

A Wake-up Call for SATCOM Security

Hacking Satellites with Software Defined Radio (DEF CON 28)

Hacking Satellites: Practical Attacks

Introduction to Satellite Hacking

Satellite Communications Security

Deep Dive into Satellite

Gaining Access to Satellites

Space Systems Cyber Security

Analyzing Satellite Signals

Satellite Hacking Techniques

Securing the Final Frontier

Attacking Satellite Ground Systems

GPS Spoofing and Satellite Attacks

Satellite Network Security Analysis

Cyber Threats to Space Assets

Exploiting Satellite Terminals

Notes

Hack-A-Sat 2022 Writeups

DEF CON Forum: Satellite Hacking Discussion 1

DEF CON Forum: Satellite Hacking Discussion 2

Misc (GitHub Repos, , Reports)

SPARTA: Space Attack Research and Tactic Analysis

ESA Space Shield (European Space Agency)

Robots Hacking

Books & Whitepapers

- Robot Hacking Manual (RHM) - 0.5
- How to Kill a Robot: Hacker's Guide
- Safety, Security, and Reliability of Robotic Systems
- Robot Operating System (ROS) for Absolute Beginners
- Cybersecurity For Robotics and Autonomous Systems (Book)
- Robot Hazards: From Safety to Security
- De in Robotics
- Introducing the Robot Security Framework (RSF)
- Towards an Open Standard for Assessing Robot Security (RVSS)
- Robotics CTF (RCTF)
- Hacking Robots Before Skynet (Technical Appendix)
- Current Research Issues on Cybersecurity in Robotics
- Industrial Robot Ransomware: Akerbeltz
- Introducing the Robot Database (RVD)
- Ad Cybersecurity in Smart Factories Through Autonomous Robotic Defenses
- Industrial Robotics and Cybersecurity (TÜ)
- An Introduction to Robot System Cybersecurity
- Rogue Robots: Testing the Limits of an Industrial Robot's Security
- ROSploit: Cybersecurity Tool for ROS
- Real-Time Security for Robotics
- Time-Sensiti for Robotics
- Robotics cyber security: , attacks, countermeasures (2021)
- Penetration Testing ROS (Springer 2019)
- Security for the Robot Operating System
- Addressing cybersecurity challenges in robotics: A comprehensi (2024)
- A Systematic Review of Sensor in Industrial Robotic Systems (2025)
- Securing cyber-physical robotic systems (2025)

Courses

- Robot Hacking Manual (Training Material)
- Cybersecurity for Robotics and Autonomous Systems (CodeRed)
- Cybersecurity for Robotics and Autonomous Systems (EC-Council)
- Robotics De Masterclass (The Construct)
- Certified Ethical Hacker (CEH) - Robotics Focus (EC-Council)
- Using Robotics to Teach About Cybersecurity (RobotLab)
- OpenSesame: Ethical Hacking for Robotics
- Robotics Training & Automation Certifications 2025 (UTI)

Labs

- ROSPenTo: Penetration Testing Tool for ROS (GitHub)
- HAROS: Static Analysis Framework for ROS
- Robot Cybersecurity Resources Portal
- Penetration Testing ROS (Research Paper)
- Scanning the Internet for ROS Research

Blogs & Series

- Red Teaming the ROS in Industry
- Building an ethical hacking robot with ROS2 & WiFi scanner
- Industrial Robots at Risk: 7 Considerations for 2024
- Robotics : Risks & Realities (2025)
- Cybersecurity and Safety in Industrial Robotics (2025)
- The Importance of Cybersecurity in Industrial Robotics
- Cybersecurity in Robotics: Managing the New Risks
- Critical in AI-Enabled Robots (2024)

Presentations & Conferences

- Reverse engineering and hacking Ecovacs robots (HITCON 2024 Slides)
- Reverse engineering and hacking Ecovacs robots (Web Presentation)
- Hijacking Ecovacs Home Robots (DEF CON 32, 2024)
- Hacking Robotics (Slides)
- Hacking Robots Before Skynet (DEF CON 26)
- Breaking the Laws of Robotics (Black Hat USA 2017)
- ROS 2 Security (ROSCon 2017)
- ROS 2 Security Update (ROSCon 2018)
- Hands-on with ROS 2 Security (ROSCon 2018)
- SROS2: Usable Security for ROS 2 (ROSCon 2018)
- ROS 2 Security (ROSCon 2019)
- DDS Security (ROSCon 2019)
- ROS 2 Security (ROSCon 2016)
- Determinism in ROS (ROSCon 2017)
- Robot Security (Ubuntu Summit)
- ROS 2 Security Class (The Construct)
- Talks and related about robots (Playlist)

Tools & Frameworks

ROS Security & Penetration Testing:
- ROSPenTo: Penetration Testing Tool for ROS
- Roschaos: ROS Sabotage Tool
- ROSploit: Security Exploitation Framework for Robots
- SROS2: Secure ROS 2

Static Analysis & Scanning:
- HAROS: Static Analysis Framework for ROS-based Code
- Flawfinder: C/C++ Static Analysis
- RATS: Rough Auditing Tool for Security
- Cppcheck: Static Analysis for C/C++
- SonarQube: Code Quality & Security

Robot Exploitation & Security Research:
- Robot Database (RVD)
- Robot Security Framework (RSF)
- Aztarna: Robot Footprinting Tool

Industrial Robot Security:
- IEC 62443 Compliance Tools
- OT Security Platforms (Nozomi Networks, Claroty, Dragos)

Notes

2024-2025 Market & Threat Statistics:
- Global cybersecurity in robotics market size: $4.1-$15.2 billion (2024), projected to reach $9.2-$45.3 billion by 2031-2035
- Market CAGR: 12.20%-18% (2024-2035)
- 70% of organizations reported experiencing cyber attacks in 2024
- Over 60% of robotic deployments are now connected to networks
- 80% of manufacturing firms experienced security incidents or breaches in 2024
- Cyberattacks on ICS and OT systems surged by 50% from 2021-2023
- North America leads the market with 38-40% global share
- Asia-Pacific is the fastest-growing regional market

Critical (2024-2025):
- Sensor Exploits: Temperature fluctuations, electromagnetic/acoustic interference, ambient light can be weaponized
- AI/ML Jailbreaking: 100% success rate in jailbreaking AI-powered robots demonstrated in research (2024)
- Authentication Issues: Unpatched operating systems, default manufacturer passwords, unsecured internet protocols
- Physical Access: Exposed USB ports, RJ-45 ports, debug interfaces
- Bluetooth : Ecovacs robots hijacked Bluetooth signals (DEF CON 32, 2024)
- Network Attacks: Cross-site scripting, Telnet pi, man-in-the-middle attacks

Impact & Financial Losses:
- Downtime costs: $10,000-$100,000 per hour
- A loss per cyberattack: Up to $2 million for manufacturers
- 2022 incident: Compromised robotic arm caused real-world equipment damage

Attack :
- IoT connectivity
- ROS/ROS2 exposed to internet (Shodan-disco systems)
- Corrupted sensor logic and training data
- Rewriting control logic and disabling safety mechanisms
- XMLRPC exploitation in ROS Master and Nodes
- DDS (Data Distribution Service) security weaknesses

Security Standards & Best Practices:
- Implement IEC 62443 series for industrial control systems
- Network segmentation and encrypted communications
- Continuous system updates and patch management
- Regular penetration testing using ROSPenTo, HAROS, and other tools
- Secure authentication mechanisms and access controls
- Monitor for exposed ROS systems on public internet
- Deploy OT security platforms (Nozomi Networks, Claroty, Dragos)

Regional Compliance Requirements:
- GDPR compliance in Europe (31.8% market share)
- HIPAA compliance for healthcare robotics in North America
- ISO 27001/27002 for information security management

Legal Warning:
- Robot hacking without authorization is illegal and may Computer Fraud and Abuse Act (CFAA), ICS security regulations, and local laws
- Always obtain written permission before testing robot systems
- Only perform security research in authorized en (labs, CTFs, bug bounty programs)
- Unauthorized access to industrial robots can cause physical harm, equipment damage, and production shutdowns

Research Focus Areas:
- Cyber-physical systems (CPS) security
- Real-time security for time-sensiti applications
- De integration in robotics de lifecycle
- Robot Operating System 2 (ROS2) security architecture impro
- AI/ML model security and ad robustness

Misc (GitHub Repos, , Reports)

- Robot Hacking Manual (GitHub Repo)
- Robot Database (RVD)
- MORPH: Modular Open Robotics Platform for Hackers (Project)
- MORPH (GitHub Repo)
- Robo-op (GitHub Repo)
- Tinyna Repo)

Machine Hacking

Books & Whitepapers

The Complete Machine Fundamentals: 1 & 2

Hacking Point of Sale: Payment Application Secrets, Threats, and Solutions

DEF CON 21: Please Insert Inject More Coins (Whitepaper)

Attack Scenarios and Security Analysis of MQTT

Man-in-the-Middle Attacks on MQTT based IoT networks

Multi-Drop Bus / Internal Communication Protocol (MDB/ICP) Specification

Courses & Labs (Practical Guides)

Lab: Hacking MQTT (ITExamAnswers)

MQTT Pentesting Guide with Hands-on Real World Attacks

MQTT from Zero to Hero

Pentesting IoT Protocol: MQTT

IoT Pentesting 101: How to Hack MQTT

Blogs & Series (Case Studies)

How I hacked the machine in my hostel

The Machine Hack: How I Outsmarted a Snack Dispenser

How I Hacked Modern Machines

How I Hacked Machine (Krevetk0)

The machine that hacked a small business

Machine Hacking (Security Affairs)

How to Secure Machines from Cyber Threats

How Hackers Can Easily Penetrate Your MQTT Solution

MQTT Port 1883: How to Exploit

Message Queuing Telemetry Transport (MQTT) Hacking

Presentations & Conferences

Plundering Smart Payment Terminals (DEF CON 24)

Hacking Cashless Machines (YouTube)

Machine Hacking Demo (YouTube)

Hacking MQTT (YouTube)

Project 2501: Hacking Machines (Hackaday Superconference)

Notes

HackTricks: 1883 - Pentesting MQTT

Misc (GitHub Repos, Tools)

MDB-Sniffer (Hardware Tool)

OSINT

Books & Whitepapers

* Open Source Intelligence Techniques (11th Edition) by Michael Bazzell
* The OSINT Handbook (2024) by Dale Meredith
* The OSINT Bible (2024) by Tre
* Open Source Intelligence Methods and Tools by Nihad A. Hassan & Rami Hijazi
* Hunting Cyber Criminals by Vinny Troia
* We Are Bellingcat by Eliot Higgins
* The Operator Handbook by Joshua Picolet
* Hiding from the Internet by Michael Bazzell
* Social Engineering: The Science of Human Hacking by Christopher Hadnagy
* In Cryptocurrencies by Nick Furneaux
* Deep Di the Real-world Value of OSINT by Rae Baker
* Kali Linux OSINT 2025 by Diego Rodrigues
* Open Source Intelligence (OSINT) – A Practical Introduction by Khera, Prasad & Kwanoran (2024)
* A Practical Approach to Open Source Intelligence (OSINT) - 1 (ResearchGate)
* IC OSINT Strategy 2024-2026 (U.S. Intelligence Community)
* Open Sources Intelligence (OSINT) Miniguide 2025 by Marcus P. Zillman
* [[1611.06737] OSSINT - Open Source Social Network Intelligence]()
* [[2501.08723] Multilingual Email Phishing Attacks Detection using OSINT]()
* [[2307.15225] A Secure OSINT Framework For Cyberbullying In]()
* [[2405.14487] A Comprehensi of LLMs for Cyber Defences]()
* [[2509.17087] Go Automated Strategic Intelligence (AUTOINT)]()
* The Digital Blueprint: Mapping Your Attack Surface with OSINT

-----

Courses

* SANS SEC497: Practical Open-Source Intelligence (OSINT)
* SANS SEC587: Ad OSINT Gathering and Analysis
* GIAC Open Source Intelligence (GOSI) Certification
* McAfee Institute C|OSINT - Certified in Open Source Intelligence
* McAfee Institute AOSINT - Ad Open Source Intelligence
* TCM Security: OSINT Fundamentals
* TCM Security: Practical OSINT Research Professional (PORP) Certification
* MOIS - Certified OSINT Expert (MCSI)
* OSINT Industries: Open-Source Intelligence Training
* Tonex: Open-Source Intelligence (OSINT) Certification Program
* IntelTechniques Online Video Training
* Basel Institute on Go: OSINT eLearning (Free)
* Udemy: OSINT Open Source Intelligence
* My OSINT Training

-----

Labs

* TryHackMe (OSINT Path)
* Hack The Box (Sherlock Category)
* CyberDefenders (Blue Team Labs)
* Sofia Santos (Gralhix) Exercises
* Gralhix - List of OSINT Exercises
* Trace Labs (Search Party)
* GeoGuessr
* Sourcing.Games
* OSINT Dojo
* DI CTF
* IRIS CTF 2024 - OSINT Challenges
* Intigriti 1337Up CTF - OSINT Challenges
* OSINT Week CTF
* HackYourMom - OSINT CTF Challenges

-----

Blogs & Series

* Oh Shint\! Blog
* WebBreacher Blog
* OSINT Updates Newsletter
* The Ultimate Guide to Launching a Career in OSINT
* List of OSINT Resources (Medium)
* Bellingcat - In Journalism & OSINT Case Studies
* OSINT Curious - Expert Interviews & Resources
* Michael Bazzell - Privacy, Security, and OSINT Show
* Hetherington Group - In Tips & Resources
* OSINT Techniques - Complete List for In
* OSINT Tools and Techniques - Neotas
* How to Use the OSINT Framework - BitSight
* Maltego - What is OSINT and How to Conduct In
* The Beginner's Guide to OSINT - TechMindXperts
* OSINT Techniques Homepage
* A Guide To Open Source Intelligence - ITsec Group
* OSINT Guide: Tools and Techniques - Authentic8
* 7 OSINT Blogs Every Analyst Should Read - LifeRaft
* OSINT Roadmap for 2025 - Key Skills & Trends
* What Is OSINT in 2025 - Molfar Intelligence Institute

-----

Presentations & Conferences

* OSINT Conference (Global Event)
* Trace Labs Community
* OSINT Summit (Annual Global Conference)
* DEF CON OSINT
* OSINT For All Conference
* European OSINT Forum
* InfraGard National Members Alliance - OSINT Resources
* OSINT World Conference

-----

Tools & Frameworks

All-in-One OSINT Platforms

* OSINT Framework - Comprehensi of OSINT tools organized by category
* SpiderFoot - Automated OSINT reconnaissance tool
* Maltego - Interactive data mining and link analysis platform
* Recon-ng - Full-featured reconnaissance framework
* theHar - E-mail, subdomain, and name har
* OSINT-SPY - All-in-one OSINT toolkit

Username & Social Media OSINT

* Sherlock - Hunt down social media accounts by username
* Maigret - Collect info about people by username across 3000+ sites
* Blackbird - Search usernames across 500+ websites
* WhatsMyName - Username enumeration tool
* social-analyzer - API, CLI, and web app for social media analysis

Search & Discovery Tools

* Photon - Fast web crawler for OSINT
* Shodan - Search engine for Internet-connected devices
* Censys - Internet-wide scanner and search engine
* Wayback Machine - Internet archive for historical website snapshots
* URLScan.io - URL and website scanner

Email & Phone OSINT

* Holehe - Check if an email is attached to accounts
* h8mail - Email OSINT and breach hunting
* Phoneinfoga - Phone number intelligence gathering
* Epieos - Email and phone lookup tool

Geolocation & Image OSINT

* GeoSpy - AI-powered geolocation from images
* PimEyes - Reverse image search for faces
* TinEye - Reverse image search
* Google Earth - Satellite and street-le
* SunCalc - Calculate sun position for geolocation

Domain & Network OSINT

* SecurityTrails - DNS and domain intelligence
* DNSDumpster - DNS recon and research
* BuiltWith - Website technology profiler
* Wappalyzer - Technology detection browser extension
* Amass - OWASP network mapping tool

Ad & Specialized Tools

* sn0int - Semi-automatic OSINT framework and package manager
* Coeus - Chinese-focused OSINT framework
* FBI-tools - Collection of OSINT browser tools
* OSINT-Search - Custom search queries for in
* IntelOwl - Intelligence orchestration platform
* OSINT Combine - Commercial OSINT platform and tools

-----

Notes

* Nixintel's OSINT Resource List (Start.me)
* 16osint.io Dashboard (Start.me)
* OSINT International (Start.me)
* Mappy - Geolocation Tools (Start.me)

-----

Misc (GitHub Repos, , Reports)

GitHub Repos & Awesome Lists

* Awesome OSINT (The Standard List)
* Awesome AI OSINT
* Awesome OSINT For E
* Awesome Lists (OSINT Topic)
* OSINT-Collection - 2025 Updated List
* Social Media OSINT Tools Collection
* Awesome Social Media Analysis
* Awesome OSINT by Sindresorhus
* OSINT-Framework GitHub
* OSINT Resources for Ukraine Conflict

Browser Extensions & Add-ons

* Forensic OSINT Browser Extension (Ubikron)
* Hunchly - Web Capture Tool for In
* OSINT Combine Browser Extension
* IG Stories for Instagram OSINT

Commercial & Professional Platforms

* Recorded Future - Threat Intelligence
* Palantir - Data Integration Platform
* Pipl - People Search Engine
* Social Links - Social Media Intelligence
* Skopenow - Digital In Platform

Standards & Frameworks

* MITRE ATT&CK Framework
* NIST Cybersecurity Framework
* Intelligence Community Directive 203 - Analytic Standards

& Documentaries

* YouTube: OSINT Tools & Techniques (Da)
* YouTube: Ubikron Extension Demo
* YouTube: Michael Bazzell - Complete OSINT Course
* YouTube: SANS OSINT Summit Sessions
* YouTube: Bellingcat OSINT Case Studies
* YouTube: IntelTechniques Video Series
* YouTube: Trace Labs Search Party Walkthrough

Created By

Thank u all and have a good hacking time to make internet more secure. :) Happy Hacking

项目信息

开发语言：未知

Star 数：1173

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A Huge Learning Resources with Labs For Offensive Security Players展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。

登录后才能参与讨论

下载链接

会员才能下载

登录后开通会员

同分类推荐

暂无同类资源

资源标题	Offensive-Resources - A Huge Learning Resources with Labs For Offensive
所属分类	红蓝攻防
发布作者	admin
发布时间	2026-10-06 00:36:01
下载权限	免费下载
附件数量	2 个下载链接
浏览次数	144
讨论数量	0
主题状态	正常讨论中