t3_41mr2q

From Crash To Exploit: CVE-2015-6086 – Out of Bound Read/ASLR Bypass

t3_42k7vf

[a little old, but a very interesting writeup] Android privilege escalation to mediaserver from zero permissions (CVE-2014-7920 + CVE-2014-7921)

t3_47g35g

KLEE LLVM Execution Engine

t3_4q5z5w

Project Triforce: Run AFL on Everything by NCCGroup

t3_5h7n2c

Exploiting the DRAM Rowhammer bug to gain kernel privileges - Matthew Dempsky and Thomas Dullien - March 9, 2015

t3_45eq3o

Exploiting the parsing of Internet Key Exchange payloads in Cisco's ASA software

t3_3wu1py

Six Ways to Automatically Find Software Bugs by Fan Gang [PDF]

t3_3vgb0n

Modern Binary Attacks and Defences in the Windows Environment – Fighting Against Microsoft EMET in Seven Rounds by Zoltan L. Nemeth

t3_3dibtp

Building a exploit for CVE-2015-5090 - SYSTEM-level code execution in Adobe Reader

t3_2u7wxo

Blind Return Oriented Programming (BROP) Attack

The Devil is in the Constants: Bypassing Defenses in Browser JIT Engines by Michalis Athanasakis, Elias Athanasopoulos, Michalis Polychronakis, Georgios Portokalidis, and Sotiris Ioannidis [PDF]

Preventing Use-after-free with Dangling Pointers Nullification by Byoungyoung Lee, Chengyu Song, Yeongjin Jang, and Tielei Wang [PDF]

How I Evolved your Fuzzer: Techniques for Black-Box Evolutionary Fuzzing by Fabien Duchene [PDF]

Using SystemTap to determine the exploitability of unbound memory overflows

Smashing The Browser: From Vulnerability Discovery To Exploit

Advanced Exploitation of VirtualBox 3D Acceleration VM Escape Vulnerability / Exploit (CVE-2014-0983), VUPEN (July 2014)

KLEE used to find NULL pointer dereference in OpenSSL

Out Of Control: Overcoming Control-Flow Integrity by Enes Göktaş, Elias Athanasopoulos, Herbert Bos, and Georgios Portokalidis [PDF]

ROPs are for the 99% - Yang Yu (March 2014)

Hacking Blind by Andrea Bittau, Adam Belay, Ali Mashtizadeh, David Mazieres, and Dan Boneh [PDF]

Swarm Testing by Alex Groce, Chaoqiang Zhang, Eric Eide, Yang Chen, and John Regehr [PDF]

Taming ROP on Sandy Bridge - Georg Wicherski (May 2013)

Bochspwn: Exploiting Kernel Race Conditions Found via Memory Access Patterns - Mateusz "j00ru" Jurczyk and Gynvael Coldwind (May 2013)

Sigreturn Oriented Programming (Erik Bosman's OHM2013 work)

KASLR Bypass Mitigations in Windows 8.1 - Alex Ionescu (November 2013)

Finding Use-After-Free Bugs with Static Analysis by Sean Heelan

Statically Detecting Use After Free on Binary Code by Josselin Feist, Laurent Mounier, and Marie-Laure Potet [PDF]

Scheduling Black-box Mutational Fuzzing by Maverick Woo, Sang Kil Cha, Samantha Gottlieb, and David Brumley [PDF]

Attacking x86 Windows Binaries by Jump Oriented Programming by Erdodi, L.

Finding Dispatcher Gadgets for Jump Oriented Programming Code Reuse Attacks by Erdodi, L.

# Vulnerability Research and Development

A subreddit for [*high quality*](http://en.wikipedia.org/wiki/Signal-to-noise_ratio) resources on [*technical*](https://www.google.com/search?q=define:technical) topics related to **bugs**, **vulnerabilities**, and **exploits** in computer systems.

# Posting Guidelines

* Post resources with the original title.
* Attribute the original author(s) in the title.
* Include the original publish date in the title.

# Community

* IRC:  [#vrd on Freenode](http://webchat.freenode.net/?randomnick=0&channels=#vrd)

# Related Subreddits

* /r/netsec
* /r/ReverseEngineering
* /r/rootkit
* /r/securityCTF
* /r/lowlevel

# Getting Started

* [Hack Night](http://isislab.github.io/Hack-Night/)
* [Getting Started in Information Security](http://www.reddit.com/r/netsec/wiki/start)

<div class="md"><h1>Vulnerability Research and Development</h1>

<p>A subreddit for <a href="http://en.wikipedia.org/wiki/Signal-to-noise_ratio"><em>high quality</em></a> resources on <a href="https://www.google.com/search?q=define:technical"><em>technical</em></a> topics related to <strong>bugs</strong>, <strong>vulnerabilities</strong>, and <strong>exploits</strong> in computer systems.</p>

<h1>Posting Guidelines</h1>

<ul>
<li>Post resources with the original title.</li>
<li>Attribute the original author(s) in the title.</li>
<li>Include the original publish date in the title.</li>
</ul>

<h1>Community</h1>

<ul>
<li>IRC:  <a href="http://webchat.freenode.net/?randomnick=0&amp;channels=#vrd">#vrd on Freenode</a></li>
</ul>

<h1>Related Subreddits</h1>

<ul>
<li><a href="/r/netsec">/r/netsec</a></li>
<li><a href="/r/ReverseEngineering">/r/ReverseEngineering</a></li>
<li><a href="/r/rootkit">/r/rootkit</a></li>
<li><a href="/r/securityCTF">/r/securityCTF</a></li>
<li><a href="/r/lowlevel">/r/lowlevel</a></li>
</ul>

<h1>Getting Started</h1>

<ul>
<li><a href="http://isislab.github.io/Hack-Night/">Hack Night</a></li>
<li><a href="http://www.reddit.com/r/netsec/wiki/start">Getting Started in Information Security</a></li>
</ul>
</div>

<div class="md"><p>Vulnerability Research and Development</p>

<p>A subreddit for <a href="http://en.wikipedia.org/wiki/Signal-to-noise_ratio"><em>high quality</em></a> resources on <a href="https://www.google.com/search?q=define:technical"><em>technical</em></a> topics related to bugs, vulnerabilities, and exploits in computer systems.</p>
</div>

Vulnerability Research and Development

Vulnerability Research and Development

Posting Guidelines

Community

Related Subreddits

Getting Started

8,856 Subscribers