OSED study plan
OSED · Give each week a clear focus.
8 weeks · About 7 hours per week
Reverse engineering binary applications to locate vulnerabilities & Stack buffer overflow exploitation
Set up an isolated Windows 10/11 x64 VM with a debugger, a disassembler, and a Python scripting plugin, and verify you can attach to and step through a 32-bit and a 64-bit process
Disassemble a small C program you compile yourself and annotate the stack frame layout: saved return address, saved frame pointer, local buffer offsets, and calling convention register usage
Identify the exact byte offset from a buffer start to the saved return address in three deliberately vulnerable functions using pattern-creation and cyclic-offset techniques
Map the x86 and x64 function prologue/epilogue idioms well enough to recognize stack frame setup in disassembly without symbols
Your checkpoint
A written offset table for three self-compiled vulnerable programs listing buffer start, saved EBP/RBP, and saved return address offsets, plus annotated disassembly screenshots of each prologue
Stack buffer overflow exploitation & Reverse engineering binary applications to locate vulnerabilities
Overwrite a saved return address on the stack and redirect execution to a chosen instruction, confirming control of the instruction pointer in a debugger
Trace the crash and reconstruct the exact stack state at the moment of the overwrite, including which bytes land where
Locate a usable jump-to-register or call-register gadget in a non-ASLR module and explain why it is a reliable pivot
Document how stack layout differs between 32-bit and 64-bit builds for the same source, including shadow space and argument registers
Your checkpoint
A working proof-of-concept input file that hijacks the instruction pointer on a 32-bit target, plus a debugger transcript showing the controlled EIP value
Stack buffer overflow exploitation
Build a full stack overflow exploit that executes a payload via a return-oriented jump to a register holding a pointer into your buffer
Handle bad characters by generating a byte map and excluding them from the payload, then verify the final buffer survives intact
Place a payload in a location that survives the function epilogue, accounting for stack pivot and available buffer space
Write a short exploit script that builds the payload programmatically instead of hardcoding bytes
Your checkpoint
A Python exploit script that achieves code execution on the 32-bit target and prints a success marker, with a bad-character table included as a comment
Custom shellcode development & Stack buffer overflow exploitation
Write position-independent shellcode by hand that resolves a Windows API address at runtime without hardcoded absolute addresses
Implement shellcode that locates the kernel32 base via the process environment block and walks the export table to find a needed function
Eliminate null bytes and other bad characters from your shellcode and verify it in a debugger after injection
Test your shellcode as a standalone blob and then inside your week 3 exploit
Your checkpoint
A null-free, position-independent shellcode blob that executes a benign proof action (for example spawning a calculator or writing a marker file), demonstrated both standalone and inside the overflow exploit
Custom shellcode development & Bypassing modern mitigations (DEP and ASLR)
Explain how DEP/NX blocks execution from the stack and demonstrate the failure mode by running your week 3 exploit against a DEP-enabled build
Chain return-oriented programming gadgets to call a function with controlled arguments, using a gadget finder and validating each gadget's side effects
Identify ASLR behavior on your target and locate a non-ASLR module or a partial-overwrite strategy to defeat it
Rebuild your exploit to bypass DEP and ASLR together on the same target
Your checkpoint
A DEP+ASLR bypassing exploit chain with a written gadget list showing address, instruction, and purpose for each gadget used
Bypassing modern mitigations (DEP and ASLR) & Format string vulnerability exploitation and read primitive development
Use a format string specifier to leak stack contents and identify which argument position maps to your controlled buffer
Leak a module base address through a format string and compute the offset to a target function
Demonstrate arbitrary read by supplying an address and reading memory through a pointer specifier
Automate leak parsing in a script so addresses are extracted and used without manual copying
Your checkpoint
A read-primitive script that takes a target address and returns the bytes at that address, plus a module base leak that matches the debugger's loaded base
Format string vulnerability exploitation and read primitive development & Bypassing modern mitigations (DEP and ASLR)
Turn the arbitrary read into an arbitrary write using pointer specifiers and a controlled destination
Overwrite a function pointer or return address through the format string write to redirect execution
Combine the format string write with your shellcode or ROP chain to achieve code execution under DEP and ASLR
Handle alignment, argument indexing, and length constraints when writing multi-byte values
Your checkpoint
A format string exploit that overwrites a target pointer and achieves code execution on a DEP+ASLR target, with a log showing each leak and write
Reverse engineering binary applications to locate vulnerabilities & Stack buffer overflow exploitation & Custom shellcode development & Bypassing modern mitigations (DEP and ASLR) & Format string vulnerability exploitation and read primitive development
Complete two timed end-to-end challenges on fresh binaries you have not analyzed, from triage to code execution
Write a repeatable methodology checklist covering triage, crash analysis, offset discovery, mitigation identification, and exploit construction
Review every failed attempt from weeks 1 through 7 and document the root cause and the corrected technique for each
Practice explaining each exploit stage aloud in under two minutes per stage to build reporting discipline
Your checkpoint
Two solved timed challenges with full write-ups plus a one-page methodology checklist covering all five domains
Milestones
Week 2: You can reliably compute the return-address offset from a crash and demonstrate controlled instruction pointer values in a debugger on a self-compiled target
Week 4: You have a working null-free position-independent shellcode blob that runs both standalone and inside a stack overflow exploit
Week 5: You can explain and demonstrate why a stack-execution exploit fails under DEP, then succeed with a ROP chain on an ASLR-enabled target
Week 7: You can leak a module base and perform an arbitrary write through a format string, then chain it to code execution under DEP and ASLR
Week 8: You solved two unseen timed challenges end to end and produced write-ups plus a reusable methodology checklist