Reading RELRO, GOT, and PLT on a PIE Lab Binary
Partial vs Full RELRO measured on one toy: readelf FLAGS/GNU_RELRO, objdump of puts@plt, gdb GOT slot before and after bind, /proc maps of .got.plt. Companion to the lazy-binding lab.
ELF GOT/PLT Lazy Binding, Read From a PIE Lab Binary
Lab walkthrough of lazy PLT binding on a PIE: readelf, objdump, GOT slot before/after the first call, Partial vs Full RELRO.
Kerberos Constrained Delegation Map for Analysts
Lab klist and setspn dumps redacted, constrained-delegation allow-list map — no ticket forging, no S4U abuse.
SQL Injection Probing Methodology for Analysts
Lab Flask+SQLite app: concatenated vs parameterized queries, SQL logs, WAF noise, ASAN-irrelevant crash on the concat path — no production DB dump.
Walking Mach-O Load Commands on a Self-Signed arm64 Lab Binary
Full otool -l walk of a self-signed LabSession: mach_header_64, LC_SEGMENT_64 __TEXT/__DATA, LC_LOAD_DYLIB, LC_CODE_SIGNATURE, LC_ENCRYPTION_INFO_64 cryptid=0. size -x, nm, class-dump, lldb. cryptid=1 stops the lab.
JNI_OnLoad vs Java_* Name Mangling on a Lab APK
Self-built APK where javah-style Java_com_lab_onload_Bridge_* exports sit next to a RegisterNatives table. readelf -s, ARM64 JNIEnv GetObjectClass, crash on an unbounded UTF copy.
ASLR, PIE Bias, and a Lab Pointer Leak
/proc/self/maps across runs, gdb measurement of PIE load bias, a toy %p leak of a text pointer. Entropy is what remains after the leak — no exploit chain.
Linux LKM and Syscall Hooking Concepts for Defenders
Lab LKM that logs openat on a VM, insmod/rmmod, dmesg artifacts — module does not hide files or hook the table for concealment.