I have spent the past several months refreshing my knowledge of x86 and updating to understand x64, and going through binary exploit development courses. Now that I am equipped with the necessary development knowledge, I would like to turn toward reverse to find vulnerabilities in binaries, and practice that methodology. I have searched Google and it seems to come up with CTF find a password type of challenges.

Are there resources that focus on challenges similar to CTF, but specific to finding vulnerabilities is binaries, such as BO, RELRO, NX bypass, ROP, etc...?

  • I see nothing wrong with the question. Perhaps the (expert??) person who gave the negative vote would like to come forward and point out the mistake with the question.
    – viv
    Mar 26 '14 at 10:50
  • 1
    To be honest this question does not show any research effort (valid reason for down voting). Any 10 minute Google attempt would give you some results from which one could work. Then one could come back and ask for more specific help and demonstrate ones 'failed' attempt(s) (research effort). It will also generate a primarily opinion based answer, although that should not be a reason to down vote but to close.
    – ixje
    Mar 26 '14 at 20:12

Pretty much every version of WU-FTPD is chock full of security vulnerabilities. Here's an archive of old versions: http://ftp.gwdg.de/pub/misc/wu-ftpd/ftp.wu-ftpd.org/wu-ftpd-attic/


You can try playing a few wargames. IO on the SmashTheStack network gives a pretty solid introduction to binary reversing and exploitation and their other wargames are pretty good too.

There is also OverTheWire , a successor to the much famed old PullThePlug wargame network, with their bag of different wargames. I'd recommend Vortex.


WeChall.net is a conglomeration of a lot of "hacking challenge" websites. And most importantly it has a point/ranking system. Because points always matter. It includes IO and SmashTheStack and OverTheWire. It also has a rating system for people who have completed the "challenge" which includes fun factor/educational/difficulty which I found useful when trying to find problems to do. The one caveat is you run into a lot of contrived examples (aka DEFCON bs, like shellcode goes through a bubble sort) though practice is practice.

MicroCorruption is a embedded CTF type website with a nice interface including interactive debugger that was put together by Matasano and Square. It focuses on embedded type systems and goes through the gamut of bugs but in an embedded environment (not x86, praise jesus)

Another option is to go through disclosed vulnerabilities from exploit-db. This obviously requires you to find proper versions of software but generally I've seen ways to obtain the software.

Not the answer you're looking for? Browse other questions tagged or ask your own question.