Stop Wasting Hours Hunting Security Papers! Use awesome-list Instead

Stop Wasting Hours Hunting Security Papers! Use awesome-list Instead

Let me ask you something brutal: How many hours did you lose last month scrolling through scattered Twitter threads, forgotten RSS feeds, and chaotic Google searches just to find that one kernel exploitation write-up? If you're a security researcher, malware analyst, or aspiring red teamer, the answer probably stings. The cybersecurity research landscape is a fragmented mess—brilliant papers buried in conference archives, groundbreaking exploit techniques lost in personal blogs, and critical CVE analyses scattered across Medium, GitHub Gists, and obscure academic repositories.

Here's the dirty secret nobody talks about: the best security research isn't hidden behind paywalls—it's hidden by disorganization. While you're wrestling with search engines, elite researchers have already bookmarked their secret weapon. That weapon? A meticulously curated, ruthlessly organized collection that transforms chaos into clarity.

Enter 0xor0ne/awesome-list—a cybersecurity-oriented awesome list that's become the underground bible for serious practitioners. This isn't another generic "awesome-security" dump with 5,000 stale links. This is a living, breathing chronicle of modern offensive security research, organized by year, battle-tested by real-world application, and updated with the kind of discernment that only comes from deep domain expertise. Whether you're preparing for Pwn2Own, hunting your first kernel bug, or building next-generation EDR evasion techniques, this repository eliminates the friction between you and the knowledge you need.

What Is 0xor0ne/awesome-list?

0xor0ne/awesome-list is a personally curated collection of exceptional blog posts, technical write-ups, and research papers focused exclusively on cybersecurity. Created and maintained by security researcher 0xor0ne, this repository represents thousands of hours of curation across the most impactful offensive and defensive security research from 2011 to 2026.

The repository's genius lies in its ruthless selectivity and temporal organization. Unlike massive aggregator lists that prioritize quantity over quality, 0xor0ne's collection emphasizes technical depth, practical applicability, and historical significance. Each entry represents research that genuinely advanced the field—exploit techniques that changed how we think about memory corruption, reverse engineering methodologies that became standard practice, and vulnerability analyses that reshaped vendor security postures.

What makes this repository trending now? Several converging factors:

• The explosion of kernel exploitation research following major vulnerabilities like CVE-2024-30088 and the ongoing io_uring saga
• AI-assisted vulnerability discovery creating demand for foundational techniques that remain relevant
• Hardware security research maturation, with entries covering everything from ESP32 fault injection to Apple Silicon PAC bypasses
• The professionalization of CTF and bug bounty communities seeking structured learning paths

The repository also maintains a dedicated Cybersecurity Tools sub-list, ensuring practitioners can move seamlessly from theoretical knowledge to practical implementation.

Key Features That Make This Indispensable

Chronological Archaeology of Exploitation

The year-based organization isn't merely aesthetic—it's strategic temporal mapping. Want to understand how Linux kernel exploitation evolved from basic stack overflows to modern data-oriented programming? Trace 2016's foundational work through 2022's Dirty Pipe revolution to 2025's DIRTYFREE technique. This structure reveals technology waves that linear reading obscures.

Multi-Part Series Preservation

Complex research rarely fits single posts. The list meticulously tracks multi-part series—like the legendary "64 bytes and a ROP chain" nftables exploitation (Parts 1-2, 2024) or the comprehensive "Windows Inter Process Communication" deep-dive (Parts 1-5, 2025)—ensuring readers access complete narratives, not fragmented teasers.

CVE-Centric Traceability

Critical vulnerabilities serve as anchor points throughout. Entries like CVE-2025-38001 ("Pwning All Google kernelCTF Instances With A 0-Day For $82k") or CVE-2024-5274 ("A Minor Flaw in V8 Parser Leading to Catastrophes") enable researchers to study exploitation evolution for specific bug classes.

Platform and Architecture Diversity

The collection spans:

• Linux kernel exploitation (io_uring, nftables, ksmbd subsystems)
• Windows internals (PatchGuard, ALPC, kernel heap mechanics)
• Mobile security (iOS kernel panic analysis, Android Scudo allocator, MTE bypasses)
• Embedded/IoT (router firmware, industrial controllers, automotive systems)
• Hardware/firmware (UEFI Secure Boot bypasses, TPM sniffing, fault injection)
• Browser exploitation (Chrome V8, WebAssembly, JIT compilers)

Emerging Technology Coverage

2025-2026 entries prominently feature AI/ML security research—from LLM-assisted vulnerability discovery ("How I used o3 to find CVE-2025-37899") to adversarial machine learning attacks and MCP (Model Context Protocol) exploitation frameworks.

Concrete Use Cases Where This List Dominates

Scenario 1: Pre-Competition CTF Preparation

You're competing in a kernel exploitation CTF next month. Instead of random practice, you navigate to the 2024-2025 Linux kernel sections, studying:

• "A Quick Dive Into The Linux Kernel Page Allocator" for allocator internals
• "Dirty Pageflags: Revisiting PTE Exploitation in Linux" for modern page table techniques
• "Control Flow Hijacking via Data Pointers" for data-oriented programming fundamentals
• "Cross Cache Attack CheatSheet" for contemporary heap manipulation

Result: Structured, progressive skill building rather than chaotic random practice.

Scenario 2: Enterprise Red Team Tool Development

Your team needs to evade modern EDR solutions. The list provides:

• "Bypassing EDRs With EDR-Preloading" (2024) for preload-based evasion
• "Spoofing Call Stacks To Confuse EDRs" (2022) for call stack manipulation
• "Callback hell: abusing callbacks, tail-calls, and proxy frames" (2025) for advanced obfuscation
• "Meterpreter vs Modern EDR(s)" (2023) for comparative analysis

Result: Technique synthesis from multiple research eras into novel tradecraft.

Scenario 3: Vulnerability Research Career Transition

You're moving from web application security to binary exploitation. The list creates a curriculum:

• Start with 2021's "Linux Kernel Exploitation For Beginners" and "The toddler's introduction to Heap exploitation" series
• Progress through 2022's "Introduction to x64 Linux Binary Exploitation" (5 parts)
• Advance to 2023's "ARM64 Reversing And Exploitation" (10 parts)
• Specialize with 2024-2025's kernel-specific research

Result: A self-directed, expert-validated learning path without expensive training courses.

Scenario 4: Incident Response and Threat Intelligence

You're analyzing a novel Linux backdoor. The list offers:

• "BPFDoor - An Evasive Linux Backdoor Technical Analysis" (2022)
• "OrBit: advanced analysis of a Linux dedicated malware" (2023)
• "Singularity: Deep Dive into a Modern Stealth Linux Kernel Rootkit" (2025)
• "LunoBotnet: A Self-Healing Linux Botnet" (2025)

Result: Historical context for emerging threats, revealing evolution patterns and detection opportunities.

Step-by-Step Installation & Setup Guide

The awesome-list requires no traditional "installation"—it's a curated reference collection. However, maximizing its utility requires intentional workflow integration.

Step 1: Repository Acquisition

# Clone the repository locally for offline access and custom annotation
git clone https://github.com/0xor0ne/awesome-list.git

# Navigate to the project
cd awesome-list

# Optional: Create a personal branch for your own notes and additions
git checkout -b personal-notes

Step 2: Local Browsing Optimization

The README renders beautifully in any Markdown^{↗ Smart Converter} viewer. For enhanced navigation:

# Install grip for GitHub-flavored Markdown preview (optional)
pip install grip

# Serve locally with live reload
grip 8080

# Or use your preferred Markdown editor↗ Smart Converter (VS Code, Obsidian, etc.)
# Recommended: Obsidian for graph-based link visualization between related papers

Step 3: Bookmark System Integration

Create a systematic reading workflow:

# Example: Extract all 2025 kernel exploitation papers for focused study
grep -A2 "2025" README.md | grep -i "kernel\|CVE\|exploit" | head -20

# Create a personal tracking file
cat > my-reading-list.md << 'EOF'
# Personal Security Research Tracker

## Priority Queue (Next 30 Days)
- [ ] "CVE-2025-38001: Pwning The Linux Kernel With A 0x0000" 
- [ ] "DIRTYFREE: Simplified Data-Oriented Programming in the Linux Kernel"
- [ ] "Control Flow Hijacking via Data Pointers"

## Completed with Notes
- [x] "A Quick Dive Into The Linux Kernel Page Allocator" → Notes: ./notes/page-allocator.md

## Technique Practice Log
| Date | Technique | Source | Practice Status |
|------|-----------|--------|-----------------|
EOF

Step 4: Cross-Reference with Tools List

# Explore the dedicated tools and repositories section
cat topics/tools_and_repos.md

# Cross-reference: when reading about Ghidra scripting, check for relevant tools
grep -i "ghidra" topics/tools_and_repos.md

Step 5: Community Integration

# Watch the repository for updates (GitHub web interface)
# Enable notifications for new commits to stay current with additions

# Optional: Contribute back through issues or PRs if you discover broken links
# or have genuinely exceptional research to suggest

REAL Code Examples and Research Patterns

While awesome-list is primarily a reference collection, the research it catalogs contains extensive code. Here are representative patterns extracted from documented techniques, with implementation guidance.

Example 1: Linux Kernel Page Table Manipulation Pattern

From "Dirty Pageflags: Revisiting PTE Exploitation in Linux" (2024) and related research:

// Core pattern: Manipulating Page Table Entries (PTEs) for arbitrary memory access
// This demonstrates the fundamental technique behind multiple 2024-2025 exploits

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/mman.h>
#include <fcntl.h>

// Modern kernel exploitation often targets page table structures directly
// rather than traditional heap metadata corruption

int setup_target_pages(void) {
    // Allocate pages with specific flags to position in physical memory
    void *target = mmap(NULL, 4096 * 256, PROT_READ | PROT_WRITE,
                        MAP_PRIVATE | MAP_ANONYMOUS | MAP_POPULATE, -1, 0);
    
    if (target == MAP_FAILED) {
        perror("mmap failed");
        return -1;
    }
    
    // Pattern: Spray pages to influence page allocator behavior
    // This is critical for cross-cache attacks documented in 2024 research
    for (int i = 0; i < 256; i++) {
        ((char *)target)[i * 4096] = 'A' + (i % 26);
    }
    
    return 0;
}

// The "Dirty Pageflags" technique involves corrupting page flags
// to achieve privilege escalation without traditional code execution
void demonstrate_pte_corruption_concept(void) {
    // Conceptual: In real exploitation, this targets kernel page tables
    // via vulnerabilities in page cache, userfaultfd, or similar mechanisms
    
    // Key insight from 2024 research: PTE corruption enables:
    // 1. Arbitrary physical memory read/write
    // 2. Bypass of KASLR and other mitigations
    // 3. Reliable exploitation without ROP chains
    
    printf("PTE manipulation: core of modern Linux kernel exploitation\n");
}

Research Context: This pattern underlies multiple entries including CVE-2024-53141 exploitation and the "Turning The (Page) Tables" technique series.

Example 2: io_uring Exploitation Primitive

From "A Series of io_uring pbuf Vulnerabilities" (2024) and related kernelCTF research:

// io_uring has become a premier kernel attack surface
// This shows the setup pattern for vulnerability research

#define _GNU_SOURCE
#include <liburing.h>
#include <stdio.h>
#include <stdlib.h>

// io_uring's complexity creates rich bug classes:
// - Race conditions in buffer management (pbuf vulnerabilities)
// - Use-after-free in request lifecycle
// - Type confusion in opcode handling

struct io_uring ring;

int setup_uring_for_research(void) {
    // Initialize ring with parameters that maximize attack surface
    struct io_uring_params params = {};
    
    // IORING_SETUP_SQPOLL creates kernel thread - expands race windows
    // IORING_SETUP_IOPOLL for polled IO - different code paths
    params.flags = IORING_SETUP_SQPOLL | IORING_SETUP_SUBMIT_ALL;
    
    int ret = io_uring_queue_init_params(32, &ring, &params);
    if (ret < 0) {
        fprintf(stderr, "queue_init: %s\n", strerror(-ret));
        return ret;
    }
    
    // Research pattern: Map SQ/CQ rings for direct manipulation
    // Vulnerabilities often arise from inconsistent state between
    // kernel-managed and user-visible ring states
    
    printf("SQ ring entries: %u\n", *ring.sq.kring_entries);
    printf("CQ ring entries: %u\n", *ring.cq.kring_entries);
    
    return 0;
}

// The 2024-2025 pbuf vulnerabilities specifically targeted
// the protected buffer (pbuf) mechanism for async buffer operations
void trigger_pbuf_operations(void) {
    struct io_uring_sqe *sqe;
    
    // Pattern: Submit operations that exercise pbuf allocation paths
    sqe = io_uring_get_sqe(&ring);
    if (!sqe) return;
    
    // IORING_OP_READ with IOSQE_BUFFER_SELECT triggers pbuf
    io_uring_prep_read(sqe, -1, NULL, 4096, 0);
    sqe->flags |= IOSQE_BUFFER_SELECT;
    sqe->buf_group = 0; // Target specific buffer group
    
    io_uring_submit(&ring);
}

Research Context: io_uring represents one of the most actively researched kernel subsystems, with entries spanning 2022-2025 showing technique evolution from basic UAF to sophisticated race conditions.

Example 3: Ghidra Scripting for Vulnerability Discovery

From "Mindshare: Using Binary Ninja API to Detect Potential Use-after-free Vulnerabilities" (2024) and Ghidra scripting entries:

# Translated pattern applicable across reverse engineering frameworks
# For detecting UAF patterns in decompiled code

from ghidra.program.model.symbol import SymbolType
from ghidra.util.task import ConsoleTaskMonitor

def find_potential_uaf_candidates():
    """
    Pattern from modern research: Static analysis for vulnerability discovery
    This approach scales manual analysis and finds subtle bug classes
    """
    program = getCurrentProgram()
    function_manager = program.getFunctionManager()
    
    # Target: Functions with alloc/free patterns but missing nullification
    suspicious_functions = []
    
    for function in function_manager.getFunctions(True):
        # Pattern 1: malloc/free pairs without intervening reallocation
        # Pattern 2: Pointer passed to free, then used in error paths
        # Pattern 3: Conditional free with complex control flow
        
        # Simplified: Look for functions containing both alloc and free
        body = function.getBody()
        
        # Real implementation would use decompiler interface
        # and dataflow analysis (documented in 2023-2024 Ghidra entries)
        
        if contains_allocation_pattern(function) and \
           contains_free_without_nullification(function):
            suspicious_functions.append(function.getName())
    
    return suspicious_functions

def contains_allocation_pattern(function):
    """Check for heap allocation calls"""
    # Would inspect call instructions to malloc, kmalloc, kzalloc, etc.
    # Research shows kernel allocators have distinct vulnerability profiles
    return True  # Placeholder

def contains_free_without_nullification(function):
    """Detect free operations missing subsequent null pointer assignment"""
    # Critical pattern: free(ptr); ...; if (ptr) { use(ptr); } // UAF!
    # Modern research automates detection of this anti-pattern
    return True  # Placeholder

# Execution
print("Potential UAF candidates:")
for func in find_potential_uaf_candidates():
    print(f"  - {func}")

Research Context: The list documents multiple static analysis approaches—Ghidra scripting, Binary Ninja MLIL analysis, CodeQL queries, and custom LLVM passes—showing the maturation of automated vulnerability discovery.

Example 4: Firmware Extraction and Analysis Workflow

From "Drone Hacking Part 1: Dumping Firmware and Bruteforcing ECC" (2026) and IoT research series:

#!/bin/bash
# Representative workflow combining multiple techniques from the list

# Step 1: Identify flash chip and extract (documented in 2022-2024 hardware entries)
# Tools: flashrom, Bus Pirate, FT2232H interfaces

# Step 2: Handle ECC (Error Correction Code) - critical for modern NAND
# Pattern from 2026 research: bruteforce ECC parameters when unknown

extract_with_ecc_bruteforce() {
    local raw_dump=$1
    local output_dir=$2
    
    # Common ECC configurations to attempt
    local ecc_configs=(
        "hamming_1bit_per_256bytes"
        "bch_4bit_per_512bytes" 
        "bch_8bit_per_512bytes"
        "rs_4symbol_per_512bytes"
    )
    
    for ecc in "${ecc_configs[@]}"; do
        echo "[*] Attempting ECC configuration: $ecc"
        
        # nanddump/nandwrite tools with ECC correction
        # Real implementation would use specific tool parameters
        
        # Validation: check for valid entropy/magic numbers in output
        if validate_extracted_firmware "${output_dir}/extracted_${ecc}.bin"; then
            echo "[+] Valid extraction with $ecc"
            return 0
        fi
    done
    
    echo "[-] ECC bruteforce failed - may require custom parameters"
    return 1
}

validate_extracted_firmware() {
    local candidate=$1
    
    # Check for common firmware signatures
    # - U-Boot: "\x27\x05\x19\x56" (ARM) or similar
    # - Linux kernel: "\x1f\x8b\x08" (gzip) or "\xfd\x37\x7a\x58\x5a" (xz)
    # - Filesystem magic: squashfs, jffs2, ubifs
    
    # Simplified: check entropy (compressed/encrypted vs. structured)
    python3 -c "
import sys
with open('$candidate', 'rb') as f:
    data = f.read(4096)
    # Real validation would use binwalk or custom signatures
    print('Validation placeholder')
"
}

# Step 3: Emulation for dynamic analysis (documented in 2023-2024 entries)
# qemu-system-arm, unicorn-engine, or Qiling framework

emulate_extracted_firmware() {
    local firmware=$1
    
    # Pattern from "Emulating IoT Firmware Made Easy" (2023)
    # and "Challenges and Pitfalls while Emulating...Routers" (2025)
    
    qemu-system-arm \
        -M versatilepb \
        -cpu cortex-a9 \
        -m 256M \
        -kernel "$firmware" \
        -append "console=ttyAMA0" \
        -nographic \
        -net nic -net user \
        2>&1 | tee emulation.log
}

Research Context: Hardware and firmware security represents one of the fastest-growing sections, with 2025-2026 entries showing sophisticated techniques for previously "secure" devices like drones, industrial controllers, and automotive systems.

Advanced Usage & Best Practices

Temporal Technique Mapping

Don't read randomly—trace evolution. When studying heap exploitation, follow the progression from 2021's "House of Rust" through 2022's "DirtyCred Remastered" to 2024's "SLUBStick" and 2025's "DIRTYFREE". This reveals how mitigations drive technique innovation.

Cross-Reference CVE Analysis

For any CVE you're researching, check multiple years. CVE-2022-0847 (Dirty Pipe) appears in 2022's foundational analysis AND 2024-2025's technique refinement entries. This longitudinal view shows how exploits mature from proof-of-concept to reliable tradecraft.

Platform-Specific Deep Dives

Use the list's implicit specialization tracks:

• iOS/macOS: Follow "Blasting Past iOS 18" (2024) → "Exploiting CVE-2025-21479 on a Samsung S23" (2025) for mobile evolution
• Windows: Trace "PatchGuard Internals" (2024) → "Windows ARM64 Internals" (2025) for architecture expansion
• Embedded: Progress from 2022's "Intro to Embedded RE" through 2024's automotive research to 2025's robot exploitation

Active Research Integration

Set calendar reminders to review new entries quarterly. The 2025-2026 sections already contain cutting-edge techniques that won't appear in formal training for 12-18 months.

Comparison with Alternatives

Why this wins: The personal curation creates coherence that institutional or community lists cannot match. 0xor0ne's selections reflect actual research utility, not popularity metrics or SEO^{↗ Bright Coding Blog} optimization.

Frequently Asked Questions

Q: How does this differ from other "awesome" security lists?

A: Most awesome lists prioritize comprehensiveness—thousands of links with minimal filtering. 0xor0ne's list prioritizes impact density: each entry represents research that genuinely advanced practitioner capabilities. The chronological organization also enables historical technique tracing impossible in categorical lists.

Q: Is this suitable for beginners in cybersecurity?

A: Selectively yes. The 2021-2022 sections contain foundational material like "Linux Kernel Exploitation For Beginners" and "The toddler's introduction to Heap exploitation." However, most 2024-2026 entries assume substantial prior knowledge. Beginners should use early sections as curriculum and progress temporally.

Q: How frequently is the list updated?

A: The repository shows active maintenance with 2026 entries already populated. Based on commit patterns, expect weekly to monthly additions of significant new research, with major updates following conference seasons (Black Hat, DEF CON, CCC).

Q: Can I contribute or suggest additions?

A: The repository accepts contributions through GitHub issues and pull requests. However, curation standards are high—suggested research must demonstrate genuine technical novelty and practical utility, not merely novelty of vulnerability target.

Q: Are the linked papers freely accessible?

A: Mostly yes. The list strongly favors openly available research—personal blogs, conference proceedings, and preprints. Some entries reference academic papers that may require library access, but the majority are immediately accessible.

Q: How do I track which papers I've read?

A: Recommended approach: fork the repository and maintain a personal branch with reading notes. Alternatively, use reference management tools (Zotero, Obsidian) with the list as a structured import source.

Q: Is there a search or filtering capability?

A: The raw Markdown enables powerful text search. For advanced use, clone locally and use grep, rg (ripgrep), or import into searchable knowledge bases. The chronological structure also enables year-based filtering for era-specific research.

Conclusion

The cybersecurity research landscape rewards prepared minds with organized knowledge. While others waste hours in fragmented search, you now have access to a curated intelligence asset that transforms how you discover, consume, and apply cutting-edge security research.

0xor0ne/awesome-list isn't merely a bookmark collection—it's a strategic advantage. Whether you're hunting your first CVE, preparing for elite competitions, or building next-generation defensive capabilities, this repository eliminates the friction between you and the knowledge that matters.

Your move: Star the repository. Clone it locally. Spend 30 minutes exploring your specialty area. I guarantee you'll find research you missed that changes how you approach your next project. The best security practitioners aren't necessarily the smartest—they're the most strategically informed. This list closes that gap.

Don't let another groundbreaking technique pass you by while you're still searching. The research you need is already curated. Go get it.