r/ExploitDev

Hi, I just started doing reverse engineering challenges in CTFs. One thing I'm always stuck on is long and complicated encoding routines. For people who have been doing this for some time how do you guys deal with long encoding routines?

Guys I’m still in high school, I want a skill to learn and stick with it I found reverse engineering and exploit dev very interesting, but also I want something for the future specially in cyber security so idk what I need to choose.
Everyone said to me this two speciality only for seniors, and you need to have another skill with it but I don’t know, can anyone guide me to a good choice and career path?
It’s confusing me specially with Ai.

Hey yall,

was wondering what would be the best thing to do if someone has build a builder that generates payloads, which bypass crowdstrike falcon (on extra aggressive settings) and get you a reverse shell.. CS is gonna give me like 200$ probably.. not really into that tbh

Hello! I am a second-year computer engineering student with two years left until graduation, and I feel quite lost and frustrated about my situation.

​I started out in penetration testing and web security and spent some time doing bug bounty hunting (which I wasn't very good at). Along the way, I fell in love with binary exploitation, reverse engineering, and low-level programming. I've completed about 80% of the Yellow Belt on pwn.college.

​However, whenever I work on pwn.college or study low-level concepts, I am reminded that the local market in my country has virtually no pure Vulnerability Research (VR) jobs—mostly just pentesting and a few red teaming roles. This makes me frustrated, as I feel like I might be wasting time on a domain that won't give me a quick return.

​I'm considering pivoting back to pentesting to focus on Active Directory (AD) and web application security, but I really don't want to abandon a field I genuinely enjoy.

​If you have experienced a similar dilemma, I would appreciate your advice on how to balance these interests over my remaining two years of university. Also, if there is a hybrid field that connects these two areas, please let me know!

This has been a hard decision for me. I'm not sure if I should learn both. Is it mostly not worthwhile of time if I learn both of them? Do they both help each other directly or indirectly? I know there is only so much one person can know but I really don't know what that limit is. I know someone more experienced with bug bounty and stuff like this will probably be able to answer my question. I don't want to push the limit of how much one person can know because it will probably become a waste of time. Should I just learn everything exploit related, should I stick to a field? I'm not sure if anyone has experienced this before but I keep on jumping around topic to topic. I guess I am learning from those jumps, but the question when do i stop jumping around. When do I start to specialize. Or in the first place, should I just not jump around?

Hi guys i just have one question is it worth it to dive in this career even if my country or where i live there is no available jobs for it like almost none

​

Hey,

Looking for some advice from people who work in exploit dev / low-level vuln research.

I already work in security and have been doing vulnerability research alongside more general security work for a while. I’ve had opportunities to do reversing, native-code research, memory corruption, and some exploit development, including taking bugs beyond just finding a crash and actually working out useful primitives / PoCs.

The problem is that this kind of work still isn't my main job, and I really want it to be.

I've been looking at dedicated exploit dev / vulnerability research positions and I feel like I'm stuck in a weird middle ground. I'm not trying to enter security from scratch, and I do have relevant experience, but I also don't have years and years of dedicated browser/kernel/mobile exploit development behind me.

A lot of the jobs I find seem to be looking for people who are already extremely specialised, rather than people who have a decent foundation and want to grow deeper into exploit development.

There's also the location issue. I'm outside most of the major exploit-dev hiring hubs, and quite a few roles I come across are limited by citizenship, clearance, residency, or simply don't hire internationally.

Another problem is that most of the interesting professional research I've done isn't something I can publish, so it's difficult to show potential employers exactly what I've worked on.

For those of you doing this professionally:

*What actually got you your first dedicated exploit dev / low-level VR job?

* What would you want to see from someone who already has some relevant experience but hasn't spent their entire career doing exploit development?

* What kind of public research/projects are actually worth doing to prove ability?

*Is native userland exploitation still a reasonable area to focus on, or would I be better off going hard into something like browsers, kernels, or mobile?

* Do companies that are willing to develop people into this kind of role actually exist, or is the expectation generally that you're already very good before they'll hire you?

* For people outside the main US/EU hiring markets, how did you find opportunities?

* I'm mainly trying to figure out whether I'm approaching this transition the wrong way.

I enjoy this stuff way more than the broader security work I do, and I'm willing to put the work in. I just don't want to spend a year grinding in a direction that isn't actually going to help me make the jump.

Would appreciate any advice.

ByteRay researchers have published a blog on a set of vulnerabilities they are calling TrustFall, and the findings land hard for any company that treats the Trusted Execution Environment as the part of a device you do not have to worry about.

OP-TEE is the walled-off Secure World that phones, TVs, cars, and industrial gear lean on to guard keys, DRM, and identity, and the whole point of paying for that hardware isolation is the promise that even a compromised operating system cannot reach inside.

TrustFall shows that promise was not as solid as buyers assumed. The researchers found several flaws that let the untrusted side reach into or knock over the Secure World, which is exactly the outcome the design exists to prevent. The bugs have since been fixed upstream, so patched builds are available, but the uncomfortable takeaway for vendors is that the vault they were told to trust had a way in, and "it runs in the TEE" is no longer an answer on its own.

Hey!

I've searched up this topic and don't see anything that isn't multiple years old. Given how popular and accepted Rust is now and with it having a fully ported winapi library now, are there any reasons to stick to learning C++ for RE and Maldev or are we no longer in the era of "only C++ is viable"? Is there anyone here who uses rust as opposed to C++ or has switched from C++ to rust that could give an insight?