Break software to understand it

Reverse Engineering for Beginners (beginners.re) · Dennis Yurichev

Also known as Understanding Assembly Language: what compilers turn C into, construct by construct, shown for several architectures side by side, then how to read it back. It’s over a thousand pages; don’t read it straight through. Read the chapters on the basics, then switch to Stage 2 and come back when a binary shows you something new.

Alternative, for ARM: Maria Markstedter’s Azeria Labs tutorials (363 points across 12 submissions of the ARM pages): ARM assembly basics in seven parts, then ARM shellcode, stack overflows and an introduction to glibc heap exploitation. “As always, Azeria produces quality and informative articles! Goto place for learning about ARM techniques” (z3phyr, 2019 · comment)

Exploit Education: Phoenix (exploit.education) · Andrew Griffiths

Graded exploitation levels in a virtual machine: Phoenix’s stack levels 0–6, format-string levels 0–4, heap levels 0–3, then network and “final” levels. It ships as qcow2 images with boot scripts, and the target binaries are built for amd64, i486 and arm64, so you can repeat a level on another architecture. Protostar, the older set with a similar structure, is still on the site, along with Nebula (Linux privilege escalation) and Fusion (with mitigations on). These used to live at exploit-exercises.com (comment).

Nightmare (guyinatuxedo.github.io) · guyinatuxedo

An intro to binary exploitation built from real CTF challenges, sorted by technique: reversing with Ghidra, debugging with GDB and scripting with pwntools first, then stack overflows, with ASLR and PIE, NX, stack canaries and RELRO introduced as each challenge needs them, then format strings, array indexing, bad seeds, symbolic execution with angr, return-oriented programming and the heap. Every challenge comes with the binary and a write-up; try it before reading the write-up.

ROP Emporium (ropemporium.com)

Eight challenges that teach return-oriented programming alone, starting from ret2win (“return here to win”): chaining calls with arguments, building a write primitive from gadgets, dealing with bad characters, stack pivoting, and the 32- versus 64-bit calling conventions. Each binary is small, so the only problem is the chain.

Read alongside: Ben Lynn’s 64-bit Linux Return-Oriented Programming (218 points, submitted 4×) walks one exploit from shellcode on an executable stack to a ROP chain once the stack isn’t executable. HN’s caveat is its conclusion: “Seems to be a fairly reasonable introduction to binary exploitation, but at the end it concludes with the dubious “NX is counterproductive”.” (saagarjha, 2021 · comment)

Alternative, on embedded: Microcorruption (104 points, submitted 12×), a CTF in the browser against a simulated MSP430 lock, written by Matasano with Square. “I wrote the kernel of Microcorruption (the emulator and the basic web interface) as a “hack night” challenge for our team at Matasano.” (tptacek, 2016 · comment). HN’s caveat: “it ramps up way too quickly with no introduction.” (chc4, 2016 · comment). Do it after step 3, not before.

pwn.college (pwn.college) · Arizona State University

The platform behind much of ASU’s security curriculum, open to anyone: dojos of modules, each a set of challenges you solve in a workspace in the browser. Start with the Getting Started dojos (Linux Luminarium, Computing 101), then earn the belts in order: Intro to Cybersecurity, Program Security, System Security and Software Exploitation. It repeats much of Stage 2 with more depth and adds the kernel, sandboxing and the heap. As of November 2026 the core belts hold more than 500 challenges.

Web Security Academy (portswigger.net) · PortSwigger

The free training from the makers of Burp Suite: a topic page and live labs for each class of web vulnerability, from SQL injection, cross-site scripting, CSRF and access control through request smuggling, OAuth, web cache deception, NoSQL injection and attacks on LLM features, with learning paths through them. Every lab is a deliberately vulnerable site PortSwigger hosts for you to attack. HN’s main thread was about one Academy page, on OAuth.

HN’s caveat came for the page’s title: “OAuth is an Authorization framework (Open Authorization) and is explicitly NOT for authentication.” (vwpolo3, 2021 · comment). The page is about what goes wrong when sites use it for login anyway.

Alternative, on your own machine: OWASP Juice Shop (202 points, submitted 3×), a deliberately insecure web shop in Node.js, Express and Angular with challenges across the OWASP Top Ten and beyond, and a score board that tracks what you’ve found. “There’s one thing reading about them in a book, it’s a whole other level getting students to find them.” (davidg109, 2023 · comment)

Also: HackerOne’s Hacker101 (192 points, submitted 2×), a free web security class of video lessons with its own CTF. HN’s caveat is from 2018, about its repository: “The repository seems to only include the website markdown content and not the vulnerable code examples.” (teebow, 2018 · comment). Use the site, as its creator recommended in the same thread.

The Fuzzing Book (fuzzingbook.org) · Andreas Zeller, Rahul Gopinath, Marcel Böhme, Gordon Fraser, Christian Holler

Build fuzzers yourself, chapter by chapter, in Python: random inputs first, then code coverage, mutation-based and greybox fuzzing, grammars that generate valid inputs, symbolic and concolic fuzzing, and reducing a failing input to the smallest one that still fails. Every chapter runs in the browser or as a notebook.

Then run a real one: Michał Zalewski’s american fuzzy lop (292 points, submitted 18×), the coverage-guided fuzzer that made the approach mainstream; its technical whitepaper explains the design. “AFL is neat because it’s conceptually simple, but practically revolutionized fuzzing, especially for non-specialists.” (XMPPwocky, 2020 · comment). HN’s caveat: “AFL itself hasn’t seen updates in years.” (alltakendamned, 2020 · comment). Run AFL++, its maintained fork, against the programs you broke in Stage 2.