장점 1. 프로그램 작동방식을 직관적으로 배울 수 있음. 대학교에서 스택,힙,데이터,코드영역을 알려주긴 함. 근데 스택 영역이 자료구조 스택처럼 함수 호출 될 때 공간을 더 쓰고 리턴할 때 공간을 해제한다고만 배움. 드림핵에서 어셈블리, 취약점들을 배우면서 프로그램 작동방식을 직관적으로 알게 됨. 2. 컴구,운체 할 때 도움될거 같음. (글자수 부족으로 운체는 후기 X) 컴퓨터 구조를 혼자 독학해본 적이 있었음. 컴퓨터 구조 및 설계(RISC-V)이었는데 그때 배울 때는 책의 40~50퍼 정도만 이해한거 같은데 공부하고 다시 보니 파이프라이닝, 전방전달 같은 전에 추상적으로만 이해 했던게 이해 가서 재밌었음. (사실 회로 설계 공부도 해서 그렇긴 함) 단점 1. 오타 있음. 2. 설명이 가끔 생략됨.
Why It's Worth Your Time
System security can feel overwhelming at first, but with a step-by-step approach, it becomes a highly rewarding field to explore. This Path is designed to help learners interested in system hacking build their skills gradually, starting from fundamental vulnerabilities like stack buffer overflows. By practicing, thinking critically, and solving problems along the way, you'll naturally develop a strong understanding of core concepts and principles of system security. This Path will equip you with both solid foundations and practical skills in system hacking. This Path is explained based on the x86-64 architecture of the Ubuntu 22.04/18.04 Linux operating system.
Topics Covered
- Setting up and using real Linux environments with virtual machines and WSL
- Deep understanding of computer architecture and memory structures: x86 assembly, memory layout, and calling conventions
- Vulnerability analysis and exploitation using gdb and pwntools
- Hands-on exercises with key memory vulnerabilities: Stack Buffer Overflow, Format String Bug, Use-After-Free, Double Free
- Analysis and bypassing of security mitigations: NX, ASLR, PIE, RELRO
- Logical vulnerability analysis such as command injection, path traversal, and type errors
Recommended For
- Those who want a clear understanding of system hacking and security principles
- Aspiring CTF participants who want to build real-world exploitation skills
- Future white-hat hackers, security engineers, or vulnerability analysts
Prerequisite Knowledge
- Basic computer skills
- Basic understanding of computer components and how computers work
- Programming experience with C or C++
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9Stack Buffer OverflowMemory Corruption: Stack Buffer OverflowLab: Stack Buffer Overflow - Auth OverwriteLab: Stack Buffer Overflow - Memory LeakLab: Stack Buffer Overflow - Change Control Flow[Exercise] Stack Buffer OverflowExploit Tech: Return Address OverwriteReturn Address Overwrite[Exercise] Stack Buffer Overflow - 2Exercise: basic_exploitation_001Exercise: basic_exploitation_000basic_exploitation_000basic_exploitation_001
- 10
- 11200 Coin200 CoinUnderstand how NX and ASLR work as mitigation techniques, and explore ROP (Return-Oriented Programming) as a method to bypass them.NX & ASLRMitigation: NX & ASLRStatic Link vs. Dynamic LinkBackground: Library - Static Link vs. Dynamic LinkQuiz: Static Link vs. Dynamic Link[Exercise] Return to LibraryExploit Tech: Return to LibraryReturn to Library[Exercise] Return Oriented ProgrammingExploit Tech: Return Oriented Programmingrop[Exercise] Return Oriented Programming - 2Exploit Tech: ROP x86Exploit Tech: ROP x64basic_rop_x64basic_rop_x86
- 12150 Coin150 CoinLearn how PIE and RELRO function as mitigation mechanisms, and explore bypass techniques using hook overwriting and One Gadget exploitation.PIEBackground: PIEQuiz: PIERELROBackground: RELROQuiz: RELRO[Exercise] Hook OverwriteExploit Tech: Hook Overwritefho[Exercise] Hook Overwrite - 2Exercise: hookExercise: oneshotoneshothook
- 13
- 14
- 15
- 16
- 17
- 18Double Free BugMemory Corruption: Double Free BugLab: Double Free Bug - TcacheQuiz: Double Free Bug[Exercise] Double Free BugExploit Tech: Tcache PoisoningTcache Poisoning[Exercise] Double Free Bug - 2Exercise: tcache_dupExercise: tcache_dup2tcache_dup2tcache_dup
- 19Format String BugMemory Corruption: Format String BugLab: Format String Bug - Memory ReadLab: Format String Bug - Memory WriteQuiz: Format String Bug[Exercise] Format String BugExploit Tech: Format String BugFormat String Bug[Exercise] Format String Bug - 2Exercise: basic_exploitation_002Exercise: basic_exploitation_003basic_exploitation_002basic_exploitation_003
기초를 다지는데 도움이 됐당께
처음엔 용어부터 낯설어서 많이 막막했지만 강의를 보고 하나씩 따라 치고 직접 익스플로잇에 성공하니깐 재밌었다. 이런 강의가 많이 없는데 드림핵에서 배울수 있어 정말 좋았다. 시스템해킹의 기본적인 공격 기법들을 배울수 있어서 정말 좋았다.
모든 기법은 아니더라도, 시스템 해킹을 하기 위한 메이저한 취약점들을 대부분 다뤄서 처음 포너블 입문하기엔 매우 좋은 Path인것 같습니다
당연히 이 강의 만으로는 충분하진 않지만, 보안에 입문하고 포너블을 처음 시작할 때는 큰 도움이 되는 것 같습니다. 중간에 오타나, 설명이 부족한 부분이 있지만 알찬 강의였습니다.


