Walking .init_array on a Toy Packed ELF
Lab stub that mprotects RWX, XOR-decodes a 32-byte .text blob, restores r-x, then returns into real code. readelf of .init_array and PT_GNU_STACK, gdb break on mprotect, dump of the r-x region.
Apache HTTP Path Confusion Notes (CVE-2021-41773 Class)
Lab Apache Alias map: raw vs normalized paths as text, Require/Alias mismatch, 403/404 artifacts — no working traversal into /etc.
NTLM Relay Defense Notes: Signing, EPA, and SMB/LDAP Controls
Lab registry/GPO signing dumps, Wireshark NTLM field names, failed-auth 4625 — no relay tool command line that fires.
Dirty Pipe Class Analysis for Defenders
Toy splice/pipe lab on a temp file we own, uname -r vs CVE-2022-0847, SIGSEGV on a PROT_READ map — not a setuid hijack.
Lessons from the JNDI / Log4Shell Class of Bugs
Lab Java snippet that logs a lookup string, how to disable JNDI/message lookups, sanitized crash on a bad URL — no LDAP exploit server.
sAMAccountName Impersonation Class (CVE-2021-42278 / CVE-2021-42287)
Lab event 4742/4768 samples redacted, computer-account naming checks, patch verification — no noPac exploit.
Reversing objc_msgSend on a Self-Signed arm64 Mach-O
otool load commands, class-dump selectors, lldb break on objc_msgSend, recover IMP for -[LabSession startWithToken:], redacted argument log. FairPlay-encrypted App Store bins are out of scope.
Binary Auditing Checklist, Filled on a Toy ELF
First-pass checklist actually filled: checksec + readelf + objdump on a 60-line toy with gets/sprintf/printf(user). One-pager of mitigations, sinks, and the ASan crash.