> For the complete documentation index, see [llms.txt](https://www.ctfrecipes.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.ctfrecipes.com/pwn.md). # Pwn - [General knowledge](https://www.ctfrecipes.com/pwn/general-knowledge.md): Pwn refers to the exploitation of a vulnerability in a binary to gain access to sensitive data or gain unauthorized control over the service. - [STACK](https://www.ctfrecipes.com/pwn/general-knowledge/operation-of-the-stack.md): The stack is a data structure that operates as a last-in-first-out (LIFO) structure - [Variables storage](https://www.ctfrecipes.com/pwn/general-knowledge/operation-of-the-stack/variables-storage.md) - [Stack frame](https://www.ctfrecipes.com/pwn/general-knowledge/operation-of-the-stack/stack-frame.md) - [PLT and GOT](https://www.ctfrecipes.com/pwn/general-knowledge/plt-and-got.md): Dynamic Linking - [HEAP](https://www.ctfrecipes.com/pwn/general-knowledge/operation-of-the-heap.md) - [HEAP operations](https://www.ctfrecipes.com/pwn/general-knowledge/operation-of-the-heap/heap-operations.md) - [Chunk](https://www.ctfrecipes.com/pwn/general-knowledge/operation-of-the-heap/chunk.md) - [Bins](https://www.ctfrecipes.com/pwn/general-knowledge/operation-of-the-heap/bins.md): Free chunks collections - [Chunk allocation and reallocation](https://www.ctfrecipes.com/pwn/general-knowledge/operation-of-the-heap/chunk-allocation-and-reallocation.md) - [Syscall](https://www.ctfrecipes.com/pwn/general-knowledge/syscall.md): System Call - [Architectures](https://www.ctfrecipes.com/pwn/architectures.md) - [aarch32](https://www.ctfrecipes.com/pwn/architectures/aarch32.md) - [Registers](https://www.ctfrecipes.com/pwn/architectures/aarch32/registers.md) - [Instruction set](https://www.ctfrecipes.com/pwn/architectures/aarch32/instruction-set.md) - [Calling convention](https://www.ctfrecipes.com/pwn/architectures/aarch32/calling-convention.md) - [aarch64](https://www.ctfrecipes.com/pwn/architectures/aarch64.md) - [Registers](https://www.ctfrecipes.com/pwn/architectures/aarch64/registers.md) - [Instruction set](https://www.ctfrecipes.com/pwn/architectures/aarch64/instruction-set.md) - [Calling convention](https://www.ctfrecipes.com/pwn/architectures/aarch64/calling-convention.md) - [mips32](https://www.ctfrecipes.com/pwn/architectures/mips32.md) - [Registers](https://www.ctfrecipes.com/pwn/architectures/mips32/registers.md) - [Instruction set](https://www.ctfrecipes.com/pwn/architectures/mips32/instruction-set.md) - [Calling convention](https://www.ctfrecipes.com/pwn/architectures/mips32/calling-convention.md) - [mips64](https://www.ctfrecipes.com/pwn/architectures/mips64.md) - [Registers](https://www.ctfrecipes.com/pwn/architectures/mips64/registers.md) - [Instruction set](https://www.ctfrecipes.com/pwn/architectures/mips64/instruction-set.md) - [Calling convention](https://www.ctfrecipes.com/pwn/architectures/mips64/calling-convention.md) - [x86 / x64](https://www.ctfrecipes.com/pwn/architectures/x86-x64.md) - [Registers](https://www.ctfrecipes.com/pwn/architectures/x86-x64/registers.md): Main x86 and x64 registers - [Instruction set](https://www.ctfrecipes.com/pwn/architectures/x86-x64/instruction-set.md) - [Calling convention](https://www.ctfrecipes.com/pwn/architectures/x86-x64/calling-convention.md) - [Stack exploitation](https://www.ctfrecipes.com/pwn/stack-exploitation.md) - [Stack Buffer Overflow](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow.md) - [Dangerous functions](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/dangerous-functions.md) - [gets](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/dangerous-functions/gets.md) - [memcpy](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/dangerous-functions/memcpy.md) - [sprintf](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/dangerous-functions/sprintf.md) - [strcat](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/dangerous-functions/strcat.md) - [strcpy](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/dangerous-functions/strcpy.md) - [Basics](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/basics.md): Data overwrite - [Challenge example](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/basics/challenge-example.md) - [Instruction pointer Overwrite](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/instruction-pointer-overwrite.md): Arbitrary Instruction redirection - [Challenge example](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/instruction-pointer-overwrite/challenge-example.md) - [De Bruijn Sequences](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/de-bruijn-sequences.md): "Calculating" offset - [Stack reading](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/stack-reading.md): Bruteforce as stack reader - [Challenge example](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/stack-reading/challenge-example.md) - [Format string](https://www.ctfrecipes.com/pwn/stack-exploitation/format-string.md) - [Dangerous functions](https://www.ctfrecipes.com/pwn/stack-exploitation/format-string/dangerous-functions.md) - [printf](https://www.ctfrecipes.com/pwn/stack-exploitation/format-string/dangerous-functions/printf.md) - [fprintf](https://www.ctfrecipes.com/pwn/stack-exploitation/format-string/dangerous-functions/fprintf.md) - [Placeholder](https://www.ctfrecipes.com/pwn/stack-exploitation/format-string/specifier.md) - [Data Leak](https://www.ctfrecipes.com/pwn/stack-exploitation/format-string/data-leak.md) - [Challenge example](https://www.ctfrecipes.com/pwn/stack-exploitation/format-string/data-leak/challenge-example.md) - [Data modification](https://www.ctfrecipes.com/pwn/stack-exploitation/format-string/data-modification.md) - [Challenge example](https://www.ctfrecipes.com/pwn/stack-exploitation/format-string/data-modification/data-modification.md) - [Arbitrary code execution](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution.md) - [Shellcode](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/arbitrary-code-execution.md) - [ret2reg](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/ret2reg.md): Using register - [Code reuse attack](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack.md) - [Ret2plt](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/ret2plt.md): ASLR bypass - [Ret2dlresolve](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/ret2dlresolve.md): Resolving an arbitrary libc functions - [GOT Overwrite](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/got-overwrite.md) - [Ret2LibC](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/ret2libc.md) - [Leaking LibC](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/leaking-libc.md): ASLR bypass - [Ret2csu](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/ret2csu.md): Controlling registers - [Return Oriented Programming - ROP](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/return-oriented-programming-rop.md) - [Sigreturn Oriented Programming - SROP](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/sigreturn-oriented-programming-srop.md): A syscall to rule them all - [Blind Return Oriented Programming - BROP](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/blind-return-oriented-programming-brop.md) - [Challenge example](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/blind-return-oriented-programming-brop/challenge-example.md) - [Call Oriented Programming - COP](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/call-oriented-programming-cop.md) - [Jump Oriented Programming - JOP](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/jump-oriented-programming-jop.md) - [One gadget](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/one-gadget.md): Quick win - [Stack pivoting](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/stack-pivoting.md): ROP with a small buffer - [Heap exploitation](https://www.ctfrecipes.com/pwn/heap-exploitation.md) - [Heap overflow](https://www.ctfrecipes.com/pwn/heap-exploitation/heap-overflow.md) - [Challenge example](https://www.ctfrecipes.com/pwn/heap-exploitation/heap-overflow/challenge-example.md) - [Use after free](https://www.ctfrecipes.com/pwn/heap-exploitation/use-after-free.md) - [Challenge example](https://www.ctfrecipes.com/pwn/heap-exploitation/use-after-free/challenge-example.md) - [Double free](https://www.ctfrecipes.com/pwn/heap-exploitation/double-free.md): Arbitrary write - [Unlink exploit](https://www.ctfrecipes.com/pwn/heap-exploitation/unlink-exploit.md) - [Protections](https://www.ctfrecipes.com/pwn/protections.md) - [Stack Canaries](https://www.ctfrecipes.com/pwn/protections/stack-canaries.md): Buffer Overflow prevention - [No eXecute](https://www.ctfrecipes.com/pwn/protections/no-execute.md): The shellcode prevention - [PIE](https://www.ctfrecipes.com/pwn/protections/pie.md): Position Independent Executable - [ASLR](https://www.ctfrecipes.com/pwn/protections/aslr.md): Address Space Layout Randomisation - [RELRO](https://www.ctfrecipes.com/pwn/protections/relro.md): Relocation Read-Only - [Integer overflow](https://www.ctfrecipes.com/pwn/integer-overflow.md)