The Blog of Ethical Hacker

New on the site

Walktrhough: DropFile

October 31, 2026

Objective Conduct an internal penetration test of a Linux server, identify vulnerabilities, obtain initial access, and escalate privileges to root. Assessment Summary The target exposed SSH (TCP/22) and an HTTP file-sharing application (TCP/80). Virtual-host enumeration identified a development site containing the application’s source code. Source review revealed an insecure SHA-256 secret-prefix signature construction and a […]

Protected: Walktrhough: Insecure FFmpeg configuration (LFD)

March 12, 2026

There is no excerpt because this is a protected post.

FFmpeg

Protected: Stack Canary Bypass Using Out-of-Bounds Read and Format String Exploit

September 2, 2025

There is no excerpt because this is a protected post.

binary exploitation, buffer overflow, exploit development, gdb, htb, reverse engineering, stack overflow

Stack Overflows for Beginners — Level 5

July 25, 2025

Welcome again to the Stack Overflows for Beginners series! In this post, we continue with the Level 5 binary and work on exploiting it to get the next flag — this time, with a twist: we’re going for a root shell! We’ll build on the skills developed in previous levels — identifying overflow points, calculating the EIP offset, controlling […]

binary exploitation, buffer overflow, exploit development, gdb, gets, msfvenom, PrependSetuid, privilege escalation, reverse engineering, setresuid, setreuid, setuid, stack overflow, VulnHub

Stack Overflows for Beginners — Level 4

July 24, 2025

Welcome again to the Stack Overflows for Beginners series! In this post, we continue with the Level 4 binary and work on exploiting it to get the next flag. We’ll continue exploiting buffer overflows, but this time, we’ll move toward achieving reliable reverse shell access by chaining key exploitation techniques. If you haven’t read the first part yet, I recommend […]

binary exploitation, buffer overflow, call esp, exploit development, gdb, reverse engineering, reverse shell, stack overflow, strcpy, VulnHub

Linux Usermode Exploitation 101

July 24, 2025

Introduction The aim of this course is to train students in the fundamentals of Linux usermode exploitation. You will learn how stack memory works, how buffer overflows happen, and how attackers can take control of a vulnerable program. By the end of the series, you’ll be able to analyze simple C programs, identify memory corruption […]

Stack Overflows for Beginners — Level 3

July 24, 2025

Welcome again to the Stack Overflows for Beginners series! In this post, we continue with the Level 3 binary and work on exploiting it to get the next flag. This time, we’re dealing with a binary that uses the unsafe strcpy function, making it vulnerable to buffer overflows. We’ll exploit this vulnerability, carefully navigating through memory to gain control over execution […]

binary exploitation, buffer overflow, exploit development, gdb, reverse engineering, stack overflow, strcpy, VulnHub

Stack Overflows for Beginners — Level 2

July 24, 2025

Welcome again to the Stack Overflows for Beginners series! In this post, we continue with the Level 2 binary and work on exploiting it to get the next flag. The Level 2 challenge introduces a classic technique called Return-to-Function (ret2func) — where instead of injecting shellcode, we redirect the program’s control flow to an already existing function in the binary to […]

binary exploitation, buffer overflow, exploit development, gdb, ret2func, reverse engineering, stack overflow, strcpy, VulnHub

Stack Overflows for Beginners — Level 1

July 24, 2025

In this post, we’ll explore the fundamentals of exploiting stack-based buffer overflows using the “Stack Overflows for Beginners: 1.0.1” challenges from VulnHub. We’ll walk through analyzing the source code, understanding how memory works, and using tools like gdb to manipulate program execution — all without needing advanced knowledge. These challenges are great for learning stack-based buffer overflows, especially […]

binary exploitation, buffer overflow, exploit development, gdb, reverse engineering, stack overflow, strcpy, VulnHub

Walkthrough: Analyzing BXAQ Spyware

June 24, 2024

Summary The BXAQ (MobileHunter) application, used by Chinese authorities for surveillance purposes, poses significant privacy and security risks to users. This mobile penetration test aimed to identify and evaluate these risks by analyzing the application’s behavior and potential vulnerabilities. The assessment revealed that the application collects a wide array of personal data, including calendar entries, […]

bxaq, bxnq, malware analysis, mobilehunter, penetration testing, spyware