By completing this course, learners will be able to:

• Understand Windows user-mode exploit development fundamentals.
• Analyze vulnerable applications using debuggers and reverse-engineering tools.
• Exploit stack-based buffer overflows.
• Exploit Structured Exception Handler (SEH) overflows.
• Use IDA and WinDbg for binary analysis and debugging.
• Develop egghunters when available shellcode space is restricted.
• Write custom Windows shellcode.
• Reverse engineer binaries to identify exploitable vulnerabilities.
• Develop exploits that bypass DEP and ASLR.
• Analyze and exploit format-string vulnerabilities.
• Build custom ROP chains and ROP payload decoders.
• Develop practical exploit-development skills for real-world vulnerability research.
• Prepare for the practical OffSec Exploit Developer (OSED) certification.

Module 1: Operating System and Programming Theory

• Windows operating system fundamentals
• x86 architecture and registers
• Memory organization
• Assembly fundamentals
• Windows process and memory concepts
• Programming concepts relevant to exploit development

Module 2: WinDbg Tutorial

• Introduction to WinDbg
• Debugger navigation
• Breakpoints
• Registers and memory
• Stack analysis
• Instruction-level debugging
• Crash analysis
• Debugging vulnerable applications

Module 3: Stack Buffer Overflows

• Understanding stack-based buffer overflows
• Identifying vulnerable input
• Controlling program execution
• Controlling the instruction pointer
• Identifying offsets
• Managing bad characters
• Building basic exploits
• Developing Python-based exploit code

Module 4: Exploiting SEH Overflows

• Structured Exception Handling
• Windows exception handling
• SEH chain structure
• Identifying SEH overwrite conditions
• Controlling execution through SEH
• Developing SEH-based exploits
• Working around common restrictions

Module 5: Introduction to IDA Pro

• Introduction to IDA
• Static binary analysis
• Disassembly
• Functions and code flow
• Identifying important program structures
• Combining static and dynamic analysis
• Using IDA with a debugger

Module 6: Overcoming Space Restrictions: Egghunters

• Shellcode space limitations
• Understanding egghunter techniques
• Searching memory for larger payloads
• Developing egghunters
• Integrating egghunters into exploits
• Working with restricted payload space

Module 7: Shellcode from Scratch

• Shellcode fundamentals
• Windows system calls and APIs
• Assembly-based shellcode development
• Custom shellcode construction
• Avoiding bad characters
• Encoding shellcode
• Testing and integrating custom shellcode

Module 8: Reverse Engineering Bugs

• Reverse-engineering methodology
• Identifying vulnerable program functionality
• Analyzing application behavior
• Locating memory corruption vulnerabilities
• Tracing vulnerable code paths
• Turning discovered vulnerabilities into working exploits

Module 9: Stack Overflows and DEP/ASLR Bypass

• Understanding Data Execution Prevention (DEP)
• Understanding Address Space Layout Randomization (ASLR)
• Impact of modern exploit mitigations
• Return-Oriented Programming fundamentals
• Developing ROP-based exploitation techniques
• Bypassing DEP
• Working around ASLR protections

Module 10: Format String Specifier Attacks – Part I

• Format-string vulnerability fundamentals
• Understanding format specifiers
• Stack analysis
• Reading memory through format strings
• Identifying useful memory addresses
• Developing read primitives

Module 11: Format String Specifier Attacks – Part II

• Writing memory through format strings
• Arbitrary memory modification
• Developing write primitives
• Combining read and write primitives
• Turning format-string vulnerabilities into code execution

Module 12: Custom ROP Chains and ROP Payload Decoders

• Advanced ROP concepts
• Gadget identification
• Building custom ROP chains
• ROP-based execution
• Payload decoding
• Developing custom ROP payload decoders
• Combining ROP with custom shellcode

Module 13: Trying Harder – Challenge Labs

• Advanced exploit-development scenarios
• Reverse engineering
• Vulnerability discovery
• Custom exploit construction
• Security mitigation bypass
• Combining multiple exploit-development techniques
• OSED examination preparation

5 Days

EXP-301 is heavily practical, with hands-on labs accompanying many of the course modules.

Learners work on:

• Windows debugging exercises using WinDbg.
• Stack buffer overflow exploitation.
• SEH overflow exploitation.
• Binary analysis with IDA.
• Vulnerability discovery through reverse engineering.
• Egghunter development.
• Custom shellcode creation.
• Bad-character identification and payload preparation.
• Reverse engineering of vulnerable applications.
• DEP bypass techniques.
• ASLR bypass techniques.
• ROP chain development.
• Format-string read and write primitives.
• Custom ROP payload decoders.
• Complete exploit-development scenarios.
• Three Challenge Labs designed to test the learner's ability to combine the concepts covered throughout the course.

Certification: OffSec Exploit Developer (OSED)

Practical, hands-on and proctored examination.

47 hours and 45 minutes to complete the examination.

An additional 24 hours is provided for documentation submission.

The exam contains three independent exploit-development tasks.

Tasks involve reverse engineering to locate vulnerabilities, developing exploits that bypass security mitigations, and creating custom shellcode.

Successful exploitation requires obtaining the required proof from the target environment.

A detailed technical report documenting the vulnerability discovery and exploitation process is required.

• Penetration Testers
• Exploit Developers
• Security Researchers
• Reverse Engineers
• Vulnerability Researchers
• Advanced Red Team Professionals
• Malware Analysts
• Offensive Security Professionals
• Security Engineers working with vulnerability research
• Developers involved in application or product security

• Familiarity with debuggers such as Immunity Debugger or OllyDbg.
• Basic understanding of 32-bit exploitation concepts.
• Experience writing Python 3 code.
• Basic ability to read and understand C code.
• Basic ability to read and understand 32-bit Assembly code.
• A solid foundation in penetration testing and programming.