Microarchitecture Exploitation


Pwndamentals.


Challenges

Architecturally the bounds check holds, but speculatively it doesn't. Train the branch predictor with in-bounds indices, then ask for one past the public prefix and into the flag.

The transient load touches one page from the file-backed probe array at /challenge/probe.

Connect with SSH

Link your SSH key, then connect with: ssh [email protected]

30-Day Scoreboard:

This scoreboard reflects solves for challenges in this module after the module launched in this dojo.

7-Day | 30-Day | All-Time

Rank Hacker Badges Score