OSEE study plan
OSEE · Give each week a clear focus.
8 weeks · About 8 hours per week
Exploit Development
Map the full exploit-development workflow (recon of a binary, triage, primitive identification, weaponization, reliability) and write it out as a one-page checklist you will reuse every week.
Set up an isolated lab: a Linux VM with gdb plus pwndbg or gef, pwntools, ROPgadget/ropper, Ghidra, and a Windows VM with WinDbg Preview and a snapshot you can revert.
Disassemble and annotate three small ELF binaries by hand, labeling each function's calling convention, stack frame layout, and where user input reaches a dangerous operation.
Practice reading x86-64 assembly fluently by reconstructing C pseudocode for ten short functions without decompiler output.
Configure a repeatable debugging session (breakpoints, watchpoints, memory maps, core dumps) and document the exact commands in your notes.
Your checkpoint
A committed lab-setup script plus a written binary-triage checklist, demonstrated by a 10-minute recorded walkthrough of annotating one ELF binary end to end.
Exploit Development
Identify and exploit classic stack-based buffer overflows on both Linux x86-64 and 32-bit x86 targets, controlling EIP/RIP and redirecting execution.
Compute offsets precisely using cyclic patterns and verify them in a debugger rather than guessing.
Demonstrate the effect of NX, stack canaries, and ASLR one at a time by toggling each protection and observing how the exploit must change.
Write a pwntools exploit script that is parameterized (offset, target address, payload builder) so it can be re-pointed at a new binary quickly.
Document the exact crash-to-control methodology as a reusable template.
Your checkpoint
Two working local exploits (one 32-bit, one 64-bit) with scripts and a written protection-matrix table showing which mitigation each exploit defeats and which it does not.
Exploit Development
Build ROP chains from scratch on x86-64 to call a function with controlled arguments, using only gadgets you find and verify yourself.
Use ret2libc and ret2syscall techniques to bypass NX without relying on shellcode on the stack.
Handle stack alignment and calling-convention pitfalls (mov rdi gadgets, leave/ret, stack pivots) and explain why each matters.
Automate gadget discovery and chain assembly with ROPgadget/ropper and pwntools ROP, then hand-verify the final chain in a debugger.
Practice a stack-pivot scenario where the overflow is smaller than the chain you need.
Your checkpoint
A working ret2libc exploit plus a stack-pivot exploit, each with a chain diagram showing every gadget, its address, and its role.
Exploit Development
Exploit heap vulnerabilities: use-after-free and double-free on glibc, achieving controlled allocation and a write primitive.
Analyze tcache and fastbin behavior in a debugger and explain how metadata corruption yields arbitrary allocation or write.
Defeat a stack canary by leaking it through a format-string or partial-read primitive, then reuse it in a follow-on overflow.
Exploit a format-string vulnerability to achieve arbitrary read and then arbitrary write.
Write up each primitive (read, write, control-flow) in a personal primitive catalog with preconditions and costs.
Your checkpoint
Three working exploits (UAF, format-string arbitrary write, canary-leak-then-overflow) and a primitive catalog with at least eight entries.
Exploit Development
Analyze Windows x64 binaries in a debugger, mapping PE structure, calling convention differences, and exception-handler behavior versus Linux.
Identify and exploit a Windows stack overflow, controlling RIP and dealing with stack cookies and DEP/ASLR.
Explain and demonstrate the mechanics behind common Windows exploitation building blocks (ROP on Windows, VirtualProtect-based chains, SEH overwrite on 32-bit) at a conceptual and practical level.
Compare Linux and Windows mitigations side by side and note where your Linux techniques transfer and where they fail.
Practice triaging an unfamiliar Windows binary from crash to root cause within a time box.
Your checkpoint
One working Windows exploit with a written Linux-to-Windows technique-transfer comparison table covering at least six mitigations.
Exploit Development
Bypass ASLR using information leaks: derive a base address from a leaked pointer and rebase an entire exploit chain at runtime.
Bypass ASLR without an obvious leak by abusing partial overwrites or brute-forcing where the entropy permits, and quantify the reliability cost.
Exploit a real-world-style target that combines multiple mitigations (full RELRO, canary, NX, PIE, ASLR) end to end.
Measure exploit reliability over many runs and improve it (retry loops, heap grooming, NOP sleds, fork-server considerations).
Document a mitigation-bypass decision tree you can apply to any new target.
Your checkpoint
A full-mitigation exploit that succeeds reliably across a 100-run test, with a reliability report and the mitigation-bypass decision tree.
Exploit Development
Perform root-cause analysis on unfamiliar crashes, distinguishing exploitable conditions from mere denial of service.
Turn a crash into a controlled primitive by reasoning about register and memory state at the fault, not by pattern-matching.
Practice time-boxed exploitation of two unseen binaries (one Linux, one Windows) using only your own checklists and catalog.
Write a professional vulnerability report: root cause, affected input, primitive, exploitation steps, mitigations, and remediation advice.
Review your earlier exploits for correctness and tighten any that relied on lucky addresses.
Your checkpoint
Two time-boxed unseen-binary exploits plus one complete professional vulnerability report written to a publishable standard.
Exploit Development
Consolidate a personal reference: triage checklist, primitive catalog, mitigation decision tree, and exploit templates in one indexed place.
Re-solve three previously completed challenges from memory to confirm retention and identify weak spots.
Close knowledge gaps found in weeks 1-7 by redoing the weakest lab with a written explanation of what you missed.
Run a full timed mock practical under exam-like constraints and score yourself against explicit criteria.
Build a spaced-review schedule for the two weeks after the plan ends.
Your checkpoint
A consolidated reference document plus a scored mock-practical self-assessment with a prioritized gap list and a post-plan review schedule.
Milestones
Week 2: You can take an arbitrary stack overflow and reach controlled instruction-pointer execution in under 30 minutes, and can correctly predict how NX, canary, and ASLR each change your approach before testing.
Week 4: You have at least five working exploits spanning stack, heap, and format-string classes, and your primitive catalog lets you name the read/write/control primitive a new bug gives you within 15 minutes.
Week 6: You can exploit a binary with canary, NX, PIE, full RELRO, and ASLR combined, and you can explain each bypass step aloud without notes.
Week 8: You complete a timed unseen-binary exploitation and a written report within the time box, scoring at least 80 percent on your own rubric, with remaining gaps listed and scheduled.