Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?


Failed to load latest commit information.
Latest commit message
Commit time
November 14, 2019 04:02
June 11, 2015 05:13
March 19, 2021 06:26
March 19, 2021 06:28
June 19, 2020 22:16
June 19, 2020 22:16
July 10, 2020 02:09
October 9, 2018 15:07

Pwntools Tutorials

This repository contains some basic tutorials for getting started with pwntools (and pwntools).

These tutorials do not make any effort to explain reverse engineering or exploitation primitives, but assume this knowledge.


Pwntools is a grab-bag of tools to make exploitation during CTFs as painless as possible, and to make exploits as easy to read as possible.

There are bits of code everyone has written a million times, and everyone has their own way of doing it. Pwntools aims to provide all of these in a semi-standard way, so that you can stop copy-pasting the same struct.unpack('>I', x) code around and instead use more slightly more legible wrappers like pack or p32 or even p64(..., endian='big', sign=True).

Aside from convenience wrappers around mundane functionality, it also provides a very rich set of tubes which wrap all of the IO that you'll ever perform in a single, unifying interface. Switching from a local exploit to a remote exploit, or local exploit over SSH becomes a one-line change.

Last but not least, it also includes a wide array of exploitation assistance tools for intermediate-to-advanced use cases. These include remote symbol resolution given a memory disclosure primitive (MemLeak and DynELF), ELF parsing and patching (ELF), and ROP gadget discovery and call-chain building (ROP).

Table of Contents

  • Installing Pwntools
  • Tubes
    • Basic Tubes
    • Interactive Shells
    • Processes
    • Networking
    • Secure Shell
    • Serial Ports
  • Utility
    • Encoding and Hashing
    • Packing / unpacking integers
    • Pattern generation
    • Safe evaluation
  • Bytes vs. Strings
    • Python2
    • Python3
      • Gotchas
  • Context
    • Architecture
    • Endianness
    • Log verbosity
    • Timeout
  • ELFs
    • Reading and writing
    • Patching
    • Symbols
  • Assembly
    • Assembling shellcode
    • Disassembling bytes
    • Shellcraft library
    • Constants
  • Debugging
    • Debugging local processes
    • Breaking at the entry point
    • Debugging shellcode
  • ROP
    • Dumping gadgets
    • Searching for gadgets
    • ROP stack generation
    • Helper functions
  • Logging
    • Basic logging
    • Log verbosity
    • Progress spinners
  • Leaking Remote Memory
    • Declaring a leak function
    • Leaking arbitrary memory
    • Remote symbol resolution


Tutorials for getting started with Pwntools







No releases published


No packages published