Project 47: Exploit Development Concepts

Module: Module 5: Password Attacks, Network Defense & Vulnerability Management  |  Level: Intermediate  | 
Primary tool: GDB + pwndbg (free)  |  Estimated time: 75–120 minutes

Objective: Trace program execution and register state to understand how a crash becomes a controlled exploit conceptually.

Free lab environment

exploit.education (Phoenix/Nebula, free downloadable VM) — https://exploit.education/

exploit.education provides free, purpose-built virtual machines specifically designed to teach memory-corruption and exploit-mitigation concepts step by step, from the people behind the well-known ‘Nebula’ and ‘Phoenix’ exercise sets. Run entirely offline in a local VM.

Lab workflow

1. Set up exploit.education’s ‘Phoenix’ free VM (built for exactly this) — a purpose-built, offline exploit-education VM — and confirm it boots and is reachable only from your host.
2. Using GDB + pwndbg (free), work through the exercise with the specific goal of learning to trace program execution and register state to understand how a crash becomes a controlled exploit conceptually.
3. At every step, write down what you expected to happen before running the command, then what actually happened — the gap between the two is where the real learning is.
4. Once you reach the milestone (a crash, an offset, a confirmed mitigation), capture the exact evidence before moving on.
5. Explain, in your own words and without copying documentation, why the underlying mechanism works the way it does.
6. Note explicitly which mitigations were enabled or disabled for this exercise, and how that changed the difficulty.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

• your GDB session showing the crash and register state at the point of failure
• your written explanation (in your own words) of why that specific input caused that specific crash

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.