Pwn, short for binary exploitation, is the CTF category where you exploit memory-safety bugs in compiled programs to take control of their execution. The goal is usually to make the program run code you chose and read a flag from the machine it runs on. The word comes from gamer slang for defeating someone.
Example
A service on a remote port reads a name into a 64-byte buffer with no length check. You send 72 characters, overwrite the saved return address and point it at a function called win() that prints the flag. This beginner pattern is called ret2win. Harder challenges add protections such as a stack canary, ASLR or non-executable stacks, and need return-oriented programming (ROP) or a heap bug.
What you use
checksec, to see which protections a binary has.- gdb with an extension such as pwndbg, to watch memory.
- pwntools, a Python library for talking to the service and building payloads.
- Ghidra or another disassembler to read the code.
Learn reverse engineering first, since you must read a binary before you can break it.
On CTF7
A pwn challenge usually has a downloadable binary plus a remote service. On CTF7 the service can run as an isolated lab instance for your team, so one team's crashes do not affect another. Organizers can add tiered hints that unlock for a cost or after a delay. Solo players can practice on Ouroboros CTF or in a War Zone operation.
Learn more
Read the binary exploitation guide for worked examples and tools, or browse all CTF guides.
Related terms
Browse the full CTF and cybersecurity glossary for more terms.
