Advanced Vulnerability Research

A hands-on course in software vulnerability research, taught from real findings and honest negatives, not toy bugs. The slides and every runnable lab live here so you can follow along and reproduce each result on your own machine.

This repository holds the first two published modules. It is defensive and educational: every technique referenced is already publicly disclosed, and the goal is to build people who find, prove, and fix bugs before anyone can weaponize them.

Watch on YouTube

• ▶ Video 1 — Intro: Fuzzing, Memory Safety & Exploits: A Real Vuln-Research Course — https://youtu.be/kGlPSuw0G1E
• ▶ Video 2 — Tier 00 (Orientation): Your First Memory Bug, Under AddressSanitizer — https://youtu.be/EQbCWoOCncQ

Modules

#	Module	Watch	What it is
—	intro/	▶ Video 1	The course intro: where these bugs live, why the whole stack sits on memory-unsafe C/C++, and the five steps attackers use every time.
00	00-orientation/	▶ Video 2	Set up the bench and read a crash. Five runnable labs: the compiler trap, a heap overflow under AddressSanitizer, observation vs inference, what a seed rescues you from, and a reproducible lab notebook.

Each module folder has the slide deck as a PDF plus its lab files and a README.md.

Start here

1. Watch the intro, then open 00-orientation/.
2. Install a clang with libFuzzer + AddressSanitizer:
   • macOS: brew install llvm (use /opt/homebrew/opt/llvm/bin/clang; Apple's /usr/bin/clang ships no libFuzzer runtime)
   • Linux: sudo apt-get install -y clang llvm
   • Windows: run the labs inside a WSL2 (Ubuntu) shell
3. Run every tier-00 lab with one command:

   cd 00-orientation
   bash run.sh

Reproducible by design

The labs are not screenshots. On every push, GitHub Actions compiles and runs the taught code on clean Ubuntu and macOS runners and asserts the taught crash actually fires:

• check.c overflows an 8-byte heap buffer and AddressSanitizer catches it at check.c:5.
• gate_hash.c sits behind a checksum gate; the seed FUZZgate crashes it in about a second, while blind fuzzing runs tens of millions of inputs and never gets through.

Every finding in the notebook is pinned by sha256 (source and input) and carries a Replay block a stranger can run top to bottom. A crash nobody else can reproduce is not yet a finding.

Who this is for

Aspiring vulnerability researchers, bug-bounty hunters, CTF players, security engineers, and curious developers who want to understand the layer underneath everything. If you can run a command and read the output, you can start. No degree, no prior security experience, no paid tools.

Author

Obi Ebuka David (David Obi) — vulnerability researcher. Contact: eobi@autogon.ai · Defensive products: https://autogon.ai

Disclaimer

For educational and defensive purposes only. Every vulnerability referenced is already publicly disclosed. Only ever test systems you own or are explicitly authorized to test. Coordinated disclosure and authorization, always.

License

MIT © Obi Ebuka David.