|
所在平台: Udemy |
课程主页: https://www.udemy.com/course/software-security-exploitation/
课程评论：没有评论
**课程名称：软件安全漏洞利用：栈、堆和ROP攻击** **课程概述：** 本课程深入探讨现实世界软件漏洞利用的工作原理，以及攻击者如何利用它们入侵系统、绕过保护和控制目标。通过亲身实践，您将超越理论，掌握理解、分析和编写内存损坏漏洞利用的技能。课程将详细讲解栈溢出、返回导向编程（ROP）和堆喷射等技术，并结合真实C代码、现代Linux目标和指导性实验，将每个概念与实践联系起来。 课程采用直观的解释、视觉化示例和现实世界类比，将复杂的概念分解，使高级漏洞利用技术易于理解且具有可操作性。无论您是安全研究员、防御者、逆向工程师，还是希望提升漏洞利用技能的开发人员，亦或是希望探究关键CVE背后的“how”或迈入安全领域第一步的任何人，本课程都将为您提供分析漏洞和理解现代防护措施如何被绕过的深度理解和攻击者思维。 **您将学到：** * 攻击向量和攻击链的展开过程，以及它们如何映射到现实世界漏洞利用。 * 如何从“gadget”构建ROP链以绕过NX位（不可执行位）。 * 如何操纵堆布局和损坏函数指针。 * 现代防护措施（如ASLR、NX、Canaries和CFI）的目的和局限性。 * 栈溢出如何工作以及如何用于劫持执行流程。 * 如何像攻击者一样思考，并像防御者一样进行防御。 **动手实验包括：** * 编写并利用经典的栈溢出漏洞。 * 使用GDB和Python编写实际的payload。 * 使用ROPgadget查找ROP gadget并分析其用途。 * 在自定义二进制文件中执行堆喷射并覆盖函数指针。
Learn how real-world software exploits work - and how attackers use them to break into systems, bypass protections, and take control.In this hands-on course, you'll go beyond theory and gain the skills to understand, analyze, and craft memory corruption exploits. You'll explore techniques like stack overflows, Return-Oriented Programming (ROP), and heap spraying - all using real C code, modern Linux targets, and guided labs that connect every concept to practice.We break down complex topics using intuitive explanations, visual examples, and real-world analogies to make advanced exploitation techniques both accessible and actionable.Whether you're a security researcher, defender, reverse engineer, or developer looking to level up your exploitation skills, investigate the "how" behind critical CVEs, or take your first steps into the security world - this course will equip you with the deep understanding and attacker mindset needed to analyze vulnerabilities and understand how modern mitigations are bypassed.What You'll Learn:How attack vectors and chains unfold - and how they map to real-world exploitsHow ROP chains are constructed from gadgets to bypass NX-bitHow to manipulate heap layout and corrupt function pointersThe purpose and limitations of modern mitigations like ASLR, NX, canaries, and CFIHow stack overflows work and how they're used to hijack executionHow to think like an attacker - and defend like one tooHands-On Labs Include:Writing and exploiting a classic stack overflowUsing GDB and Python to craft real payloadsFinding ROP gadgets with ROPgadget and analyzing their purposePerforming heap spraying and overriding function pointers in a custom binary
