Using nmap's smtp-open-relay NSE script to scan country-based IP ranges for open SMTP relays, including how to narrow the scan and interpret the results.

Pwnable.kr Unlink writeup: exploiting a heap overflow in a doubly linked list through the classic unlink() write-anything-anywhere primitive.

Pwnable.kr Simple login writeup: exploiting a saved-EBP overwrite in a base64 login routine to pivot the stack and take control of execution.

Pwnable.kr Echo1 writeup: a stack buffer overflow that overwrites the saved return address to redirect execution and get a shell.

Pwnable.kr UAF writeup: exploiting a C++ use-after-free to take over a vtable pointer and redirect a virtual call to the function that prints the flag.

Pwnable.kr Fsb writeup: using a format string bug to read and write arbitrary memory with %n and friends, with a short primer on format string exploitation.

A Radare2 walkthrough of crackme0x09 from the IOLI suite: static analysis of main, reversing the serial check and recovering a valid password.

Pwnable.kr Ascii_easy writeup: a ret2libc exploit built entirely out of ASCII-printable addresses, working around ASLR and an ASCII-armored address space.

Pwnable.kr Memcpy writeup: benchmarking aligned versus unaligned memcpy implementations and surviving the SSE instructions that fault on misaligned heap chunks.

Pwnable.kr Cmd2 writeup: escaping a restricted system() call with a wiped environment and a filtered argument by building a shell command out of the characters left.