errors.x7.al › Recent issues

Nightmare: a free, open-source course for learning binary exploitation

A long-running, free course called Nightmare is making the rounds again as a structured starting point for binary exploitation and reverse engineering. It is not a bug, a patch or an outage — it is a study resource built around CTF challenges, and it is worth knowing about if you want to learn how exploits are actually developed.

What's happening

According to its own project site, Nightmare describes itself as an "intro to binary exploitation / reverse engineering course based around ctf challenges". The author explains the name is a nod to the idea that it is "a lot of people's nightmare to get hit by weaponized 0 days" — the skills the course teaches.

The project says it differs from the many other resources out there in a few ways: it contains a large amount of content (currently over 90 challenges) laid out in a linear fashion; each challenge comes with a documented write-up showing how to go from being handed a binary to doing the exploit development; most modules include several challenges so you can learn a technique on one and apply it to others; and all the tools used are free and open source, with no commercial disassembler required.

The material starts with an introduction to the project, assembly and tooling — including gdb-gef, pwntools and ghidra — then moves into beginner reverse engineering before tackling stack topics such as buffer overflows of variables, buffer overflows that call a function, buffer overflows that call shellcode, and ROP chains. A static version of the site is published via GitHub Pages, and the author notes the whole thing can be built locally with the mdbook tool.

There is also a community channel. The project site notes that if you get stuck on something for hours and search engines cannot help, you can ask in the project's Discord. Because the material is large, the author acknowledges there are likely to be at least some typos or mistakes and invites readers to report them.

Who's affected

Nobody is "affected" in the sense of a broken system; this is a learning resource. It is relevant to:

• Beginners in security who want a guided path into binary exploitation and reverse engineering rather than scattered tutorials.
• CTF players who want practice challenges with worked solutions in a single place.
• Developers and defenders who want to understand how memory-corruption bugs are turned into working exploits, which helps with writing and reviewing safer code.

What to do

• Start at the beginning. The project recommends going through the modules in order and starting with the first challenge in each module.
• Set up the tooling first. The early modules cover gdb-gef, pwntools and ghidra — all free and open source.
• Use the write-ups when stuck, then try to solve the next similar challenge from scratch, since the design is to teach a technique and then make you apply it.
• Ask in the project's Discord if you are genuinely blocked; the site also links a GitHub repository with the challenges.

Sources

• Nightmare (project site) — describes the course, its challenge count, its linear structure and its all-open-source tooling.
• Nightmare (GitHub) — hosts the challenges and content for the course.