[推荐]CTF『Pwn』版块精选帖分类索引-Pwn-看雪安全社区

成立版块至今沉淀下来不少好东西，为方便学习对精华帖做了整理，非常感谢各位师傅的无私付出。

last update：2021.01.03

## 基础知识

* [ubuntu安装各种pwn工具](https://bbs.pediy.com/thread-258437.htm)
* [Docker搭建pwn环境](https://bbs.pediy.com/thread-264508.htm)
* [CTF Pwn环境搭建](https://bbs.pediy.com/thread-257558.htm)
* [一步一步学pwntools](https://bbs.pediy.com/thread-247217.htm)
* [第一个mips pwn搭建环境，逆向，调试，最终exp的过程](https://bbs.pediy.com/thread-259646.htm)
* [深入窥探动态链接](https://bbs.pediy.com/thread-258597.htm)
* [PLT&GOT 表以及延迟绑定机制](https://bbs.pediy.com/thread-257545.htm)
* [栈迁移原理（图示）](https://bbs.pediy.com/thread-258030.htm)
* [rop链攻击原理与思路(x86/x64)](https://bbs.pediy.com/thread-257238.htm)

## 漏洞保护机制

* [Linux 二进制程序保护机制详解](https://bbs.pediy.com/thread-262639.htm)
* [printf函数leak与canary绕过原理及利用方式](https://bbs.pediy.com/thread-229447.htm)
* [Safe-Linking机制分析及绕过](https://bbs.pediy.com/thread-261985.htm)

## 整数溢出

* [数组越界之入门向](https://bbs.pediy.com/thread-228652.htm)
* [由寄存器位数差异引发的漏洞利用](https://bbs.pediy.com/thread-257360.htm)
* [经典整数溢出漏洞示例 XCTF int_overflow](https://bbs.pediy.com/thread-254269.htm)

## 格式化字符串

* [printf格式化漏洞魔术公式](https://bbs.pediy.com/thread-224564.htm)
* [Pwn-WereWolf](https://bbs.pediy.com/thread-224106.htm)
* [通过堆上的格式化字符串利用剖析函数栈帧的建立与还原](https://bbs.pediy.com/thread-247451.htm)
* [Pragyan CTF 最高分Unbreakable encryption--AES加密的WriteUp](https://bbs.pediy.com/thread-224992.htm)
* [pwn-格式化字符串学习笔记](https://bbs.pediy.com/thread-258704.htm)
* [格式化字符串漏洞简介](https://bbs.pediy.com/thread-253638.htm)
* [格式化字符串漏洞解析](https://bbs.pediy.com/thread-261940.htm)
* [格式化字符串漏洞](https://bbs.pediy.com/thread-255483.htm)

## 栈溢出

* [栈溢出学习笔记](https://bbs.pediy.com/thread-223455.htm)
* [TAMUCTF 2018 pwn writeup](https://bbs.pediy.com/thread-225487.htm)
* [小白学pwn——ret2libc](https://bbs.pediy.com/thread-257448.htm)
* [ret2csu学习](https://bbs.pediy.com/thread-257546.htm)
* [通过一道pwn题详细分析retdlresolve技术](https://bbs.pediy.com/thread-255736.htm)
* [记一道简单难度ret2shellcode中遇到的坑](https://bbs.pediy.com/thread-262576.htm)
* [SROP分析及例题](https://bbs.pediy.com/thread-258047.htm)

## 堆利用

* [dlmalloc、ptmalloc与glibc堆漏洞利用](https://bbs.pediy.com/thread-258791.htm)
* [ptmalloc代码研究](https://bbs.pediy.com/thread-258747.htm)
* [heap related data structure && ptmalloc2](https://bbs.pediy.com/thread-257984.htm)
* [how2heap调试学习（一）](https://bbs.pediy.com/thread-264008.htm)、[（二）](https://bbs.pediy.com/thread-264014.htm)、[（三）](https://bbs.pediy.com/thread-264016.htm)
* [堆入门攻略-how2heap学习总结](https://bbs.pediy.com/thread-259269.htm)
* [堆的六种利用手法](https://bbs.pediy.com/thread-246786.htm)
* [Asis CTF 2016 b00ks](https://bbs.pediy.com/thread-225611.htm)
* [2015 plaidctf datastore(off by one)](https://bbs.pediy.com/thread-246966.htm)
* [PWN入门（Off-By-One）](https://bbs.pediy.com/thread-260074.htm)
* [glibc2.29下的off-by-null](https://bbs.pediy.com/thread-257901.htm)
* [LCTF 2018 easy_heap](https://bbs.pediy.com/thread-247862.htm)
* [Chunk Extend and Overlapping笔记](https://bbs.pediy.com/thread-260316.htm)
* [unlink 系列](https://bbs.pediy.com/thread-247007.htm)
* [ctf ptmalloc pwn unlink](https://bbs.pediy.com/thread-247015.htm)
* [堆利用之unlink小结](https://bbs.pediy.com/thread-253502.htm)
* [PWN：unsafe unlink](https://bbs.pediy.com/thread-261314.htm)
* [协程切换的临界区块控制不当而引发的UAF血案](https://bbs.pediy.com/thread-224686.htm)
* [2014 hack.lu oreo](https://bbs.pediy.com/thread-247214.htm)
* [0ctf2017 - babyheap](https://bbs.pediy.com/thread-223461.htm)
* [关于fastbin合并问题的研究](https://bbs.pediy.com/thread-257742.htm)
* [PWN：fastbin attack学习](https://bbs.pediy.com/thread-261570.htm)
* [ctf pwn中的unsorted bin利用及chunk shrink——0ctf2018 heapstorm2 writeup](https://bbs.pediy.com/thread-225973.htm)
* [Large bin attack--LCTF2017-2ez4u--writeup](https://bbs.pediy.com/thread-223283.htm)
* [ctf中的large bins attack及lctf2017 2ez4u writeup](https://bbs.pediy.com/thread-225453.htm)
* [西湖论剑storm_note Large bin Attack](https://bbs.pediy.com/thread-254849.htm)
* [largebin attack原理学习](https://bbs.pediy.com/thread-261825.htm)
* [Tcache利用总结](https://bbs.pediy.com/thread-249713.htm)
* [Tcache Attack原理学习](https://bbs.pediy.com/thread-261899.htm)
* [从BookWriter看house of orange原理](https://bbs.pediy.com/thread-223334.htm)
* [借助gdb调试glibc代码学习House of Orange](https://bbs.pediy.com/thread-251195.htm)
* [一道house of storm的heap题目](https://bbs.pediy.com/thread-257648.htm)
* [[CTF堆利用]House Of Force](https://bbs.pediy.com/thread-222924.htm)
* [House Of Force实例](https://bbs.pediy.com/thread-225833.htm)
* [堆利用-House Of Force](https://bbs.pediy.com/thread-262114.htm)
* [Tinypad Seccon CTF 2016(House Of Einherjar)](https://bbs.pediy.com/thread-226119.htm)
* [House Of Einherjar学习](https://bbs.pediy.com/thread-262048.htm)

## IO_FILE 相关

* [IO-FILE中的stdin介绍](https://bbs.pediy.com/thread-261914.htm)
* [hctf2018 the end（IO FILE attack和exit hook attack）](https://bbs.pediy.com/thread-262459.htm)

## 浏览器相关

* [强网杯2020线下GooExec](https://bbs.pediy.com/thread-262205.htm)

## 虚拟化相关

* [SECCON 2018 kindvm writeup](https://bbs.pediy.com/thread-247524.htm)
* [2019强网杯线下赛qemu虚拟机逃逸](https://bbs.pediy.com/thread-252385.htm)

## Linux 内核

* [KERNEL PWN状态切换原理及KPTI绕过](https://bbs.pediy.com/thread-258975.htm)
* [linux kernel pwn 分析(一) 强网杯core + ciscn babydriver](https://bbs.pediy.com/thread-247054.htm)
* [kernel pwn入门 强网杯 core](https://bbs.pediy.com/thread-259386.htm)
* [Linux kernel pwn （一）：ROP&&ret2usr](https://bbs.pediy.com/thread-262678.htm)
* [kernel pwn -- UAF](https://bbs.pediy.com/thread-252826.htm)
* [InCTF-Internationals-2019-pwnbox分析](https://bbs.pediy.com/thread-255695.htm)
* [Linux Kernel Pwn 学习笔记(栈溢出)](https://bbs.pediy.com/thread-261586.htm)
* [Linux Kernel Pwn 学习笔记 (UAF）](https://bbs.pediy.com/thread-261728.htm)

## Windows 相关

* [windows10下的堆结构及unlink分析](https://bbs.pediy.com/thread-246570.htm)

## 实用技巧

* [关于不同版本glibc强行加载的方法](https://bbs.pediy.com/thread-225849.htm)
* [关于不同版本 glibc 更换的一些问题](https://bbs.pediy.com/thread-254868.htm)
* [pwn中one gadget的使用技巧](https://bbs.pediy.com/thread-261112.htm)
* [如何在pwn题中更有效地使用GDB](https://bbs.pediy.com/thread-223337.htm)
* [Linux内核驱动调试遇到的一些坑以及解决方法](https://bbs.pediy.com/thread-254932.htm)
* [Libc-Database 本地搭建实战](https://bbs.pediy.com/thread-263302.htm)

## 专题系列

* Linux PWN从入门到熟练： [part1](https://bbs.pediy.com/thread-248682.htm)、[part2](https://bbs.pediy.com/thread-248681.htm)、[part3](https://bbs.pediy.com/thread-255277.htm)
* 从0开始CTF-PWN： [part1](https://bbs.pediy.com/thread-259199.htm)、[part2](https://bbs.pediy.com/thread-259272.htm)、[part3](https://bbs.pediy.com/thread-259723.htm)、[part4](https://bbs.pediy.com/thread-263734.htm)
* pwnable.tw新手向write up： [part1](https://bbs.pediy.com/thread-259290.htm)、[part2](https://bbs.pediy.com/thread-259298.htm)、[part3](https://bbs.pediy.com/thread-259341.htm)、[part4](https://bbs.pediy.com/thread-259371.htm)、[part5](https://bbs.pediy.com/thread-259408.htm)、[part6](https://bbs.pediy.com/thread-259476.htm)、[part7](https://bbs.pediy.com/thread-259622.htm)
* Pwn从入门到放弃： [part1](https://bbs.pediy.com/thread-256946.htm)、[part2](https://bbs.pediy.com/thread-256957.htm)、[part3](https://bbs.pediy.com/thread-256978.htm)、[part4](https://bbs.pediy.com/thread-257033.htm)、[part5](https://bbs.pediy.com/thread-257306.htm)
* Pwn堆利用学习： [part1](https://bbs.pediy.com/thread-263633.htm)、[part2](https://bbs.pediy.com/thread-263680.htm)、[part3](https://bbs.pediy.com/thread-263733.htm)、[part4](https://bbs.pediy.com/thread-263887.htm)、[part5](https://bbs.pediy.com/thread-263888.htm)

## 经验分享

* [写下你的 CTF Pwn 个人经验谈](https://bbs.pediy.com/thread-222913.htm)

## 赛制相关

* [强网杯出题思路-solid_core-HijackPrctl](https://bbs.pediy.com/thread-225488.htm)
* [强网杯线下赛堆分配检查机制(lowbits leak check)](https://bbs.pediy.com/thread-226127.htm)
* [Pwn 的比赛环境配置](https://bbs.pediy.com/thread-228385.htm)
* [如何安全快速地部署多道ctf pwn比赛题目](https://bbs.pediy.com/thread-247198.htm)

## 题解集锦

* [readme-revenge details](https://bbs.pediy.com/thread-223664.htm)
* [readme_revenge - 34C3 2017 CTF](https://bbs.pediy.com/thread-223659.htm)
* [pwnable.tw 之 unexploitable 解题思路分享](https://bbs.pediy.com/thread-223530.htm)
* [pwnable.kr 之 ascii 解题思路分享](https://bbs.pediy.com/thread-223472.htm)
* [读取popen输出结果时未截断字符串导致的命令行注入](https://bbs.pediy.com/thread-224692.htm)
* [HITCTF 2018 pwn writeup](https://bbs.pediy.com/thread-225486.htm)
* [Teaser Dragon CTF 2018 pwn](https://bbs.pediy.com/thread-247259.htm)
* [X-NUCA revenge骚思路getshell](https://bbs.pediy.com/thread-248032.htm)
* [2018-XNUCA steak 涨姿势](https://bbs.pediy.com/thread-250635.htm)
* [WarGame-narnia 解题思路](https://bbs.pediy.com/thread-252752.htm)
* [WarGame-behemoth 解题思路](https://bbs.pediy.com/thread-253640.htm)
* [ROPEmporium全解](https://bbs.pediy.com/thread-256914.htm)
* [ByteCTF Pwn部分题解](https://bbs.pediy.com/thread-254367.htm)
* [Layer7 CTF Pwn题部分Writeup](https://bbs.pediy.com/thread-254907.htm)
* [hctf 2018 部分pwn writeup](https://bbs.pediy.com/thread-248495.htm)
* [2018科来杯PWN复现](https://bbs.pediy.com/thread-263143.htm)
* [2018redhat_gameserver 记一次较为详细的解题过程](https://bbs.pediy.com/thread-255802.htm)
* [seccomp沙箱机制 & 2019ByteCTF VIP](https://bbs.pediy.com/thread-258146.htm)
* [由一道ctf题目 对一个另类upx壳的一次探究](https://bbs.pediy.com/thread-258222.htm)
* [2020-HackTM 题目学习](https://bbs.pediy.com/thread-261285.htm)
* [Hackergame 2020 pwn writeup](https://bbs.pediy.com/thread-263296.htm)
* [字节跳动ByteCTF2020 两道堆题（glibc2.31）](https://bbs.pediy.com/thread-263640.htm)

## 学习资源

* **资料搜索**：LibGen、Sci-Hub、Google Scholar
* **Wargames**：<a href="elink@633K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0N6r3k6@1K9h3#2W2i4K6u0W2L8%4u0Y4i4K6u0r3">CTFtime</a>、<a href="elink@24bK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6$3K9i4c8S2L8s2W2K6K9h3#2Q4x3V1k6m8N6$3g2K6L8$3#2W2i4K6u0V1d9r3q4U0K9$3W2F1k6#2)9J5k6q4u0W2M7$3!0#2M7X3y4W2M7#2)9J5x3%4y4Z5j5i4u0H3k6h3&6A6L8X3N6Q4x3X3c8&6L8%4g2J5i4K6u0V1M7$3E0A6L8r3I4K6">Awesome-Hacking-Resources</a>、<a href="elink@483K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6S2M7s2y4V1k6h3S2S2L8q4)9J5c8X3q4%4k6i4y4G2L8h3g2Q4x3X3c8U0N6r3k6Q4x3U0y4%4j5i4u0Y4j5h3#2W2M7H3`.`.">awesome-ctf</a>
* **在线文档**：<a href="elink@a06K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0N6r3k6Q4x3X3c8%4K9h3E0A6i4K6u0W2k6$3W2@1K9s2g2T1i4K6u0W2K9h3!0Q4x3V1k6U0N6r3k6Q4x3X3c8%4K9h3E0A6i4K6u0r3M7s2N6F1i4K6u0r3M7X3g2S2k6r3#2W2i4K6u0V1P5X3S2Q4x3V1j5`.">CTF Wiki</a>、<a href="elink@2ccK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6X3K9i4u0E0K9h3q4F1j5i4W2Q4x3X3g2Y4K9i4c8T1L8$3!0C8i4K6u0W2K9h3!0Q4x3V1k6U0N6r3k6Q4x3X3c8S2L8r3I4Q4x3X3c8A6L8W2)9J5k6r3!0F1k6g2)9J5c8U0y4Q4y4h3k6@1L8%4m8A6j5%4y4Q4x3V1k6H3N6$3^5`.">CTF-All-In-One</a>
* **书籍**：<a href="elink@643K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6T1L8$3!0C8i4K6u0W2k6r3!0#2j5X3q4F1i4K6u0W2j5$3!0E0i4K6u0r3M7%4g2T1K9X3g2U0N6q4)9J5c8U0x3#2x3e0t1H3y4o6f1$3i4K6u0r3">《CTF特训营》</a>、<a href="elink@fe9K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6T1L8$3!0C8i4K6u0W2k6r3!0#2j5X3q4F1i4K6u0W2j5$3!0E0i4K6u0r3M7%4g2T1K9X3g2U0N6q4)9J5c8U0x3#2x3U0l9H3y4e0f1^5i4K6u0r3">《从0到1：CTFer成长之路》</a>、<a href="elink@3c0K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6T1L8$3!0C8i4K6u0W2k6r3!0#2j5X3q4F1i4K6u0W2j5$3!0E0i4K6u0r3M7%4g2T1K9X3g2U0N6q4)9J5c8U0x3#2x3U0M7%4y4K6b7H3i4K6u0r3">《CTF竞赛权威指南（Pwn篇）》</a>

江湖永远年轻，未来属于萌新:P

**Contributors**：0x2l、1Oin0、1TreeForest、alphc、Alexxx、angelToms、Auxy、b0ldfrev、baolongshou、bugchong、ChenSem、Chernobyl、diycode、dxbaicai、elecs、evilpan、Ezrak1e、gd菜鸡、giantbranch、guyioo、heyiuo、holing、iddm、iosmosis、joshuahxl、kabeor、matrixIOOI、Mr.Bean、nicaicaiwo、notwolf、nYale、obfuscation、oguri、okchenshuo、Ox9A82、OxLucifer、plkk、pureGavin、pwnda、raycp、sakura零、simSimple、Snowleo、Sou1gh0st、t1an5g、T1e9u、Ta1pax0s、TacXingXing、V1NKe、Vinadiak、wx_yz、yichen115、笔墨、钞sir、此恨不关风月、大帅锅、二当家a、富强民主和谐、极目楚天舒、凌雨、令则、名字就随便啦、时间的伤、勇士小蓝、有毒、直木

冰与火的战歌：Windows内核攻防实战高级班！从零到实战，融合AI与Windows内核攻防全技术栈，打造具备自动化能力的内核开发高手。

最后于 2021-1-3 22:56 被BDomne编辑，原因：

最新回复 (9)
pureGavin 雪币： 18277 活跃值： (21509) 能力值： ( LV12，RANK：310 ) 在线值：发帖 104 回帖 1466 粉丝 324 关注私信	pureGavin 3 2 楼 mark，版主辛苦了我的wargame系列不赔上榜么 o(╥﹏╥)o 2020-10-21 15:49 0
BDomne 雪币： 4230 活跃值： (1430) 能力值： (RANK：270 ) 在线值：发帖 53 回帖 157 粉丝 93 关注私信	BDomne 5 3 楼 @pureGavin 师傅方便弄个这样的 https://bbs.pediy.com/thread-225323.htm 汇总帖吗？加些说明的，一直想给你来个精华的另外，本帖还在更新中，有些帖目前不太好归类，还有些师傅的帖子图片挂掉了，欢迎跟帖评论，希望能跟大家一起来不断的完善 2020-10-21 16:45 0
pureGavin 雪币： 18277 活跃值： (21509) 能力值： ( LV12，RANK：310 ) 在线值：发帖 104 回帖 1466 粉丝 324 关注私信	pureGavin 3 4 楼 BDomne @pureGavin 师傅方便弄个这样的 https://bbs.pediy.com/thread-225323.htm 汇总帖吗？加些说明的，一直想给你来个精华的另外，本帖还在更新中，有些帖 ... 好的，我把自己的文章分下类（你是不是自己懒得分类，想直接用现成的！！快说！！ :p） 2020-10-21 17:13 0
BDomne 雪币： 4230 活跃值： (1430) 能力值： (RANK：270 ) 在线值：发帖 53 回帖 157 粉丝 93 关注私信	BDomne 5 5 楼 @pureGavin 更新了 2020-10-22 11:52 0
pureGavin 雪币： 18277 活跃值： (21509) 能力值： ( LV12，RANK：310 ) 在线值：发帖 104 回帖 1466 粉丝 324 关注私信	pureGavin 3 6 楼 BDomne @pureGavin 更新了[em_28] 版主，我把我的文章的索引做好了，以后我更新的CTF的writeup都会收集到我自己的索引里，省的你老是改了 2020-10-22 16:23 0
BDomne 雪币： 4230 活跃值： (1430) 能力值： (RANK：270 ) 在线值：发帖 53 回帖 157 粉丝 93 关注私信	BDomne 5 7 楼如果师傅们多多的分享好文章，很乐意更新 2020-10-22 20:18 0
TUGOhost 雪币： 182 活跃值： (4005) 能力值： ( LV3，RANK：30 ) 在线值：发帖 9 回帖 149 粉丝 17 关注私信	TUGOhost 8 楼感谢整理 2020-10-23 11:53 0
此恨不关风月雪币： 118 活跃值： (118) 能力值： ( LV5，RANK：70 ) 在线值：发帖 2 回帖 15 粉丝 0 关注私信	此恨不关风月 1 9 楼没想到开的小号上名了 233 2020-10-26 01:10 0
yoyoer 雪币： 952 活跃值： (15) 能力值： (RANK：0 ) 在线值：发帖 0 回帖 11 粉丝 6 关注私信	yoyoer 10 楼 2023-7-26 18:09 4
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复