You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
-The House Of Lore: Reloaded (http://phrack.org/issues/67/8.html)
147
-
-Malloc Des-Maleficarum (http://phrack.org/issues/66/10.html) - some malloc exploitation techniques
148
-
- Yet another free() exploitation technique (http://phrack.org/issues/66/6.html)
149
-
- Understanding the heap by breaking it (https://www.blackhat.com/presentations/bh-usa-07/Ferguson/Whitepaper/bh-usa-07-ferguson-WP.pdf) - explains heap implementation and a couple exploits
150
-
-The use of set_head to defeat the wilderness (http://phrack.org/issues/64/9.html)
151
-
- The Malloc Maleficarum (http://seclists.org/bugtraq/2005/Oct/118)
152
-
-OS X heap exploitation techniques (http://phrack.org/issues/63/5.html)
153
-
-Exploiting The Wilderness (http://seclists.org/vuln-dev/2004/Feb/25)
-Painless intro to the Linux userland heap (https://sensepost.com/blog/2017/painless-intro-to-the-linux-userland-heap/)
158
-
-Heap exploitation techniques that work on glibc-2.31 (https://github.com/StarCross-Tech/heap_exploit_2.31)
159
-
-Overview of GLIBC heap exploitation techniques (https://0x434b.dev/overview-of-glibc-heap-exploitation-techniques/)
135
+
Some good heap exploitation resources, roughly in reverse order of their publication, are:
136
+
137
+
## Useful heapexploitation tutorials
138
+
-Overview of GLIBC heap exploitation techniques (https://0x434b.dev/overview-of-glibc-heap-exploitation-techniques/) <!-- 2022 -->
139
+
-glibc in-depth tutorial (https://heap-exploitation.dhavalkapil.com/) - book and exploit samples <!-- 2022 -->
140
+
-Heap exploitation techniques that work on glibc-2.31 (https://github.com/StarCross-Tech/heap_exploit_2.31) <!-- 2020 -->
141
+
-Painless intro to the Linux userland heap (https://sensepost.com/blog/2017/painless-intro-to-the-linux-userland-heap/) <!-- 2017 -->
142
+
-ptmalloc fanzine, a set of resources and examples related to meta-data attacks on ptmalloc (http://tukan.farm/2016/07/26/ptmalloc-fanzine/) <!-- 2016 -->
-Yet another free() exploitation technique (http://phrack.org/issues/66/6.html) <!-- 2009 -->
150
+
-The use of set_head to defeat the wilderness (http://phrack.org/issues/64/9.html)<!-- 2007 -->
151
+
-Understanding the heap by breaking it (https://www.blackhat.com/presentations/bh-usa-07/Ferguson/Whitepaper/bh-usa-07-ferguson-WP.pdf) - explains heap implementation and a couple exploits <!-- 2007 -->
152
+
-OS X heap exploitation techniques (http://phrack.org/issues/63/5.html) <!-- 2005 -->
There are a couple of "hardening" measures embedded in glibc, like `export MALLOC_CHECK_=1` (enables some checks), `export MALLOC_PERTURB_=1` (data is overwritten), `export MALLOC_MMAP_THRESHOLD_=1` (always use mmap()), ...
0 commit comments