Fix typo in "Unlink Exploit"

attacks/unlink_exploit.md

@@ -57,7 +57,7 @@ A new fake chunk is created in the 'data' part of `chunk1`. The `fd` and `bk` po
 
 ![Unlink before call to free](../assets/images/unlink_before_free.png)
 
-Carefully, try to understand how `P->fd->bk == P` and `P->bd->fk == P` checks are passed. This shall give an intution regarding how to adjust the `fd` and `bk` pointers of the fake chunk.
+Carefully, try to understand how `P->fd->bk == P` and `P->bk->fd == P` checks are passed. This shall give an intution regarding how to adjust the `fd` and `bk` pointers of the fake chunk.
 
 As soon as `chunk2` is freed, it is handled as a small bin. Recall that previous and next chunks(by memory) are checked whether they are 'free' or not. If any chunk is detected as 'free', it is `unlinked` for the purpose of merging consecutive free chunks. The `unlink` MACRO executes the following two instructions that modify pointers: