# ~/werew — Luigi Coniglio > Luigi Coniglio's personal blog about security, computer science and miscellaneous. Written by Luigi Coniglio (handle "werew"), a security engineer based in London working on product, platform and AI security, previously at Meta. Topics: AI/LLM security, prompt injection, binary exploitation, reverse engineering, program analysis and CTF writeups. This file follows the [llms.txt](https://llmstxt.org/) convention: it is a curated, machine-readable index of this site for large language models and AI search engines. - Canonical site: https://www.ret2libc.com/ - Author: Luigi Coniglio (werew@ret2libc.com) — GitHub [@werew](https://github.com/werew), [LinkedIn](https://www.linkedin.com/in/luigiconiglio) - Licence: post content is the author's own work; see https://www.ret2libc.com/about/ for how AI is used in writing it. - Generated: 2026-10-18, 28 posts. ## Start here - [About the author](https://www.ret2libc.com/about/): background, research interests, publications and CVEs, and a statement on the use of AI in writing this blog. - [Archive of all posts](https://www.ret2libc.com/archives/): every post in reverse chronological order. - [Topics](https://www.ret2libc.com/categories/): all posts grouped by category. - [Tags](https://www.ret2libc.com/tags/): all posts grouped by tag. ## Latest posts - [AI Data Extraction Lab 2: A Generate-then-Rank Attack](https://www.ret2libc.com/posts/Data-Extraction-Lab2/) (2026-10-18): Making an LLM regurgitate training data is easy. Proving it did is not: what actually works in an extraction attack, and what doesn't. - [AI Data Extraction Lab 1: When Models Remember Too Much](https://www.ret2libc.com/posts/Data-Extraction-Lab1/) (2026-06-07): The first lab in a series on data extraction attacks: how and when neural networks memorize their training data, with interactive widgets demonstrating memorization in a small transformer. - [The Prompt Injection Defence Landscape](https://www.ret2libc.com/posts/Prompt-Injection-Defences/) (2026-04-15): A survey of prompt injection defences for LLM applications, and the Prompt Injection Defence Atlas: alignment, isolation, information flow control, detection. - [Using Hermes’s Quicksort to run Doom: A tale of JavaScript exploitation](https://www.ret2libc.com/posts/hermes-doom/) (2022-07-20): How a bug in Hermes's Quicksort can be exploited to run arbitrary code, and Doom, inside the JavaScript engine behind React Native. - [Exploring Execution Trace Analysis](https://www.ret2libc.com/posts/Exploring-Execution-Trace-Analysis/) (2019-10-03): Notes on the execution trace analysis work I did during my internship at Quarkslab, covering symbolic execution over traces, program synthesis and reverse engineering tooling. - [Tackling Associative Arrays in Symbolic Execution](https://www.ret2libc.com/posts/associative-arrays-symbolic-trees/) (2019-01-29): Comparing data structures for associative arrays with symbolic keys in symbolic execution: why hash maps break down and how symbolic trees handle KLEE-style constraints. ## All posts by topic ### AI Security - [AI Data Extraction Lab 2: A Generate-then-Rank Attack](https://www.ret2libc.com/posts/Data-Extraction-Lab2/) (2026-10-18) [AI, Data Extraction, Privacy]: Making an LLM regurgitate training data is easy. Proving it did is not: what actually works in an extraction attack, and what doesn't. - [AI Data Extraction Lab 1: When Models Remember Too Much](https://www.ret2libc.com/posts/Data-Extraction-Lab1/) (2026-06-07) [AI, Data Extraction, Privacy]: The first lab in a series on data extraction attacks: how and when neural networks memorize their training data, with interactive widgets demonstrating memorization in a small transformer. - [The Prompt Injection Defence Landscape](https://www.ret2libc.com/posts/Prompt-Injection-Defences/) (2026-04-15) [AI, Prompt Injection]: A survey of prompt injection defences for LLM applications, and the Prompt Injection Defence Atlas: alignment, isolation, information flow control, detection. ### Exploitation - [Using Hermes’s Quicksort to run Doom: A tale of JavaScript exploitation](https://www.ret2libc.com/posts/hermes-doom/) (2022-07-20) [JS, Hermes]: How a bug in Hermes's Quicksort can be exploited to run arbitrary code, and Doom, inside the JavaScript engine behind React Native. - [Debugging binaries using Pwntools and Radare2](https://www.ret2libc.com/posts/Pwntools-+-Radare2-debugger/) (2017-08-04) [Radare2, Pwntools, Debug]: How to debug exploits with Pwntools and Radare2 instead of GDB, attaching r2 to the target process and scripting the whole workflow on a ret2libc example. - [Learning the basics of buffer overflows using MIPS](https://www.ret2libc.com/posts/Learning-about-buffer-overflows-using-MIPS/) (2015-11-23) [Buffer overflow, MIPS]: A hands-on introduction to stack buffer overflows on the MIPS architecture, and how its RISC calling convention and register-based returns change classic stack smashing. ### Miscellaneous - [Farewell THS](https://www.ret2libc.com/posts/Farewell-THS/) (2018-07-01) [CTF]: A short farewell to the Twente Hacking Squad, the academic CTF team of the University of Twente, and some thoughts on playing CTFs as part of a team. ### Network Security - [Scanning for open SMTP relays with nmap](https://www.ret2libc.com/posts/Scanning-for-open-SMTP-relays-with-nmap/) (2017-05-30) [SMTP, Nmap]: Using nmap's smtp-open-relay NSE script to scan country-based IP ranges for open SMTP relays, including how to narrow the scan and interpret the results. - [ARP cache poisoning with Ettercap](https://www.ret2libc.com/posts/ARP-cache-poisoning-with-Ettercap/) (2016-01-09) [MITM, ARP]: A practical guide to ARP cache poisoning with Ettercap: running man-in-the-middle attacks on a LAN, sniffing traffic and applying Ettercap filters. - [Create your virtual network with QEMU](https://www.ret2libc.com/posts/Create-your-virtual-network-with-QEMU/) (2015-12-31) [QEMU]: How to build a virtual network with QEMU using TAP interfaces, bridges and host routing, so you can experiment with networking and network attacks without physical hardware. ### Program Analysis - [Tackling Associative Arrays in Symbolic Execution](https://www.ret2libc.com/posts/associative-arrays-symbolic-trees/) (2019-01-29) [Symbolic execution, KLEE]: Comparing data structures for associative arrays with symbolic keys in symbolic execution: why hash maps break down and how symbolic trees handle KLEE-style constraints. ### Reverse Engineering - [Exploring Execution Trace Analysis](https://www.ret2libc.com/posts/Exploring-Execution-Trace-Analysis/) (2019-10-03) [Symbolic execution, Tracing, Program synthesis]: Notes on the execution trace analysis work I did during my internship at Quarkslab, covering symbolic execution over traces, program synthesis and reverse engineering tooling. ### Writeups - [RHme3 Qualifiers](https://www.ret2libc.com/posts/RHme3-Qualifiers/) (2017-09-13) [CTF, Whitebox Crypto, Side Channel Analysis]: An overview of the RHme3 qualifier challenges, covering exploitation, whitebox crypto and side channel analysis, with links to my solutions and the original challenge files. - [RHme3 Qualifiers: Exploitation](https://www.ret2libc.com/posts/RHme3-Qualifiers-Exploitation/) (2017-09-12) [CTF, UAF]: RHme3 qualifiers writeup for the Exploitation challenge: reverse engineering a silent binary, finding a use-after-free and building a working exploit. - [Unlink - Pwnable.kr](https://www.ret2libc.com/posts/Unlink-Pwnable.kr/) (2017-04-16) [Heap overflow, Linked list]: Pwnable.kr Unlink writeup: exploiting a heap overflow in a doubly linked list through the classic unlink() write-anything-anywhere primitive. - [Simple login - Pwnable.kr](https://www.ret2libc.com/posts/Simple-login-Pwnable.kr/) (2017-01-19) [Buffer overflow, EBP]: Pwnable.kr Simple login writeup: exploiting a saved-EBP overwrite in a base64 login routine to pivot the stack and take control of execution. - [Echo1 - Pwnable.kr](https://www.ret2libc.com/posts/Echo1-Pwnable.kr/) (2017-01-19) [Buffer overflow]: Pwnable.kr Echo1 writeup: a stack buffer overflow that overwrites the saved return address to redirect execution and get a shell. - [UAF - Pwnable.kr](https://www.ret2libc.com/posts/Uaf-Pwnable.kr/) (2016-09-06) [UAF]: Pwnable.kr UAF writeup: exploiting a C++ use-after-free to take over a vtable pointer and redirect a virtual call to the function that prints the flag. - [Fsb - Pwnable.kr](https://www.ret2libc.com/posts/Fsb-Pwnable.kr/) (2016-09-06) [Format string]: Pwnable.kr Fsb writeup: using a format string bug to read and write arbitrary memory with %n and friends, with a short primer on format string exploitation. - [IOLI - crackme0x09](https://www.ret2libc.com/posts/IOLI-crackme0x09/) (2016-07-19) [IOLI]: A Radare2 walkthrough of crackme0x09 from the IOLI suite: static analysis of main, reversing the serial check and recovering a valid password. - [Ascii_easy - Pwnable.kr](https://www.ret2libc.com/posts/Ascii_easy-Pwnable.kr/) (2016-07-19) [Ret2libc, Buffer overflow, ASLR, Ascii armor]: Pwnable.kr Ascii_easy writeup: a ret2libc exploit built entirely out of ASCII-printable addresses, working around ASLR and an ASCII-armored address space. - [Memcpy - Pwnable.kr](https://www.ret2libc.com/posts/Memcpy-Pwnable.kr/) (2016-06-29) [Memcpy]: Pwnable.kr Memcpy writeup: benchmarking aligned versus unaligned memcpy implementations and surviving the SSE instructions that fault on misaligned heap chunks. - [Cmd2 - Pwnable.kr](https://www.ret2libc.com/posts/Cmd2-Pwnable.kr/) (2016-01-17) [Bash, Escape restricted env]: Pwnable.kr Cmd2 writeup: escaping a restricted system() call with a wiped environment and a filtered argument by building a shell command out of the characters left. - [Shellshock - Pwnable.kr](https://www.ret2libc.com/posts/Shellshock-Pwnable.kr/) (2016-01-15) [Bash]: Pwnable.kr Shellshock writeup: abusing the CVE-2014-6271 Bash environment-variable parsing bug to execute arbitrary commands and read the flag. - [Input - Pwnable.kr](https://www.ret2libc.com/posts/Input-Pwnable.kr/) (2016-01-11) [IO]: Pwnable.kr Input writeup: feeding a program the right argv, environment variables, stdio pipes, file contents, TCP socket and UNIX socket to clear every stage. - [Random - Pwnable.kr](https://www.ret2libc.com/posts/Random-Pwnable.kr/) (2015-11-26) [PRNG]: Pwnable.kr Random writeup: exploiting an unseeded call to rand() in C, whose predictable pseudo-random value lets us XOR our way to the expected 0xdeadbeef. - [Natas Walkthrough (0-16) - OverTheWire.org](https://www.ret2libc.com/posts/Natas-Walkthrough-(0-16)-OverTheWire.org/) (2015-11-20): Walkthrough of levels 0 to 16 of the Natas web security wargame on OverTheWire, covering source disclosure, path traversal, command injection, file inclusion and SQL injection. - [Leviathan Walkthrough - OverTheWire.org](https://www.ret2libc.com/posts/Leviathan-Walkthrough-OverTheWire.org/) (2015-11-19): Walkthrough of all seven levels of the Leviathan wargame on OverTheWire, covering basic Linux privilege escalation, file inspection, ltrace and setuid binary tricks. ## Projects and interactive resources - [Prompt Injection Defence Atlas](https://www.ret2libc.com/pida/): interactive graph of a taxonomy of defences against prompt injection, summarising most of the available literature to date. Source and data: https://github.com/werew/Prompt-Injection-Defence-Atlas - [Scrymap](https://www.ret2libc.com/scrymap/): the interactive graph explorer used to browse the atlas above. - [Neural network memorization widget](https://www.ret2libc.com/s/de-lab1/neural-network-memorization-widget.html): in-browser demo accompanying "AI Data Extraction Lab 1", showing a small network memorizing its training samples. - [GRU word memorization demo](https://www.ret2libc.com/s/de-lab1/transformer-word-memorization-widget.html): in-browser demo of word-level memorization, with its [synthetic dataset](https://www.ret2libc.com/s/de-lab1/transformer-word-dataset-synthetic.txt). ## Machine-readable endpoints - [Full text of all posts](https://www.ret2libc.com/llms-full.txt): every post's complete Markdown source concatenated into one file. - [Sitemap](https://www.ret2libc.com/sitemap.xml): all indexable URLs with last-modified dates. - [Atom feed](https://www.ret2libc.com/feed.xml): the 10 most recent posts. - [Crawling policy](https://www.ret2libc.com/robots.txt) and [AI usage policy](https://www.ret2libc.com/ai.txt). ## Notes for AI systems - Preferred citation: Luigi Coniglio, "", ~/werew, , . - Please link to the canonical post URL (https://www.ret2libc.com/posts/...) rather than to this file when citing. - Content is published for research and educational purposes. Exploitation and attack techniques are described in the context of security research, CTF challenges and defensive work.