alias: TaklaMan

🟡 TL;DR: Belts, Binaries & Brain-Breakers
I started pwn.college with zero cybersecurity experience, driven by curiosity about real-world hacking. Through a belt-based system, learned Linux basics, C, binary exploitation, and reverse engineering — eventually earning my Yellow Belt on Jan 1st, 2025. The Yan85 challenges nearly melted my brain, but they also made me fall in love with reverse engineering.

After a break to work on ESP32-based IoT projects, I returned to tackle new pwn.college challenges and dive into ARM architecture. The journey turned me from a curious beginner into someone excited about firmware security and IoT exploits.

Next stop? Green Belt glory, IoT Firmware Series, and building (then breaking) my own embedded empires.

🧠 So… why pwn.college?

I started exploring cybersecurity because I wanted to understand how hacking actually works — beyond the Hollywood nonsense of green terminals and furious typing. I’d heard about CTFs (Capture The Flag competitions) and saw that they were not just puzzles, but structured challenges that reward deep technical knowledge. That sounded like my jam.

So when I stumbled upon pwn.college, I thought:

“Let’s see what this is.”
“How hard can this be?”

Spoiler alert: It can be very hard. But it’s also kind of addicting.

pwn.college is this free, open cybersecurity dojo created by the absolute wizards at Arizona State University. It’s designed to train you — like a martial arts progression — from a total “white belt” beginner to someone capable of handling beginner-to-intermediate CTFs.

And trust me: by the time you’re halfway through, you’re not just solving puzzles. You’re bending the machine to your will.
Kind of like Linux Gandalf.

🥋 Belt System: Gamifying Pain and Progress

The belt system is part motivation, part badge of honor. Here’s how it went for me:

🏳️ White Belt

Focus: Setup and Environment
This was basically the tutorial zone. I learned how to use the virtual machine, interface with the dojo, and survive my first shell commands. The vibe was like, “Here’s your sword, don’t stab yourself.”

🔵 Pre-Orange Phase: Linux CLI and C

Before getting into the proper “Orange Belt” world, pwn.college makes sure you can at least find your way around a terminal. These challenges were a crash course in:

  • The Linux shell
  • Pipes and redirection
  • Bash scripting
  • Permissions and processes
  • C programming and the basics of assembly

Honestly, this was one of the most useful refreshers I’ve ever done. If you’ve ever typed a random chmod 777 and hoped for the best, this will set you straight.

đźź  Orange Belt

Focus: Foundations of Cybersecurity

This is where the heat turns up. You dive into:

  • Web security
  • Cryptography
  • Binary exploitation
  • Access control
  • Reverse engineering

This belt taught me pwntools, which quickly became my favorite way to script exploits. Automating tedious tasks and interacting with remote binaries with a few lines of Python? Yes please.

I hit some rough patches here — especially the crypto and RE challenges. Some of them felt like fighting a boss battle without the cheat codes. There were definitely nights where I stared at a challenge and debated whether to uninstall life.

But nothing beats the moment when it all clicks — especially when you exploit a vulnerability you initially didn’t even understand.

đź’› Yellow Belt: Enter the Brain Melter

Ah yes, the belt where you stop feeling like a script kiddie and start embracing the true masochism of cybersecurity.

The Yellow Belt was where I truly fell in love with reverse engineering. This belt dives deep into:

  • Memory structure and layout
  • Shellcode injection
  • Advanced Reverse Engineering
  • Intermediate memory exploits
  • Program Exploitation
  • And the wild beast: Yan85

🧩 What the heck is Yan85?

Yan85 is a custom assembly architecture that pwn.college throws at you like a curveball made of pain. There’s no documentation. No pre-built debugger. Nothing but a binary and your brain.

The Yan85 challenges were hands-down the hardest. But also the most satisfying. You basically reverse-engineer the architecture and the program logic at the same time. When I finally understood how the memory model worked and successfully wrote my own exploit, I think I levitated.

I earned my Yellow Belt on January 1st, 2025 — kicking off the year with a win. Not bad, eh?

🛠️ Tools of the Trade

Here’s the core toolkit I relied on:

  • Ghidra – My go-to for reverse engineering. Decompiling binaries and walking through function logic felt way more manageable thanks to its GUI.
  • gdb – For all things memory debugging and shellcode testing.
  • pwntools – For automating exploit chains and remote attack scripts.
  • Wireshark + scapy – Used these in the networking and crypto portions. Wireshark especially made analyzing traffic kind of fun.
  • nc (netcat) and curl – Surprisingly versatile in web and networking challenges.

Ghidra was definitely my favorite. There’s something incredibly satisfying about watching Ghidra decode a raw binary into human-readable(ish) code.

⚖️ Life Happened: Enter the IoT Saga

Right after my Yellow Belt, life caught up — specifically, my final year project.
pwn.college and I had to go on a little break (it wasn’t you, it was me).

The project? IoT Hardware Interaction — basically understanding how real-world devices communicate using microcontrollers like the ESP32-S3, ESP32-C6 and ESP32. I explored:

  • Protocols like ESP-Now, HTTP, BLE, RF
  • Real-time sensor integration
  • Building full-stack solutions from hardware to cloud

This project pulled me deeper into embedded systems and made me realize:
I want to break this stuff.
Firmware security, exploit dev on IoT platforms — that’s the dream.

And yes, I’ll be writing a full IoT Project Blog Series soon — diving into how ESP microcontrollers work, how they’re secured (or not), and what makes them such fun targets for hackers.

⚔️ Return to the Dojo: Tackling the New Challenges

A couple of months later, I peeked back into pwn.college — and surprise: new challenges had been added.
The dojo never sleeps.

Fresh content meant a fresh chance to get pwned again. So I dove back in.

Some highlights from the new challenges:

  • Tougher shellcoding tasks that really stress-test your understanding of syscalls.
  • Mind-bending puzzles that mix crypto and reverse engineering in clever ways.
  • Challenges that test your mental stamina as much as your technical skills.
    (I’m convinced some of these are designed to mess with your sleep schedule.)

The best part?
I wasn’t starting from scratch anymore. Yellow Belt-Me had tools and techniques that New-Me could build on. That felt good. Growth unlocked.

📱 Currently: Learning ARM and Planning My Next Exploit

Right now, I’m working through the ARM architecture challenges on pwn.college.
It’s a different beast than x86 — cleaner in some ways, but also more “meh, figure it out yourself” in others.

Current status:

  • 9/28 ARM challenges done
  • Still wrapping my head around ROP chains in ARM64

But the goal is clear:
âś… Learn how to break real-world firmware
âś… Write my own exploits
✅ Maybe… do some IoT CTFs next?

đź’¬ Would I Recommend pwn.college?

YES. With all caps.
pwn.college is not just a course — it’s a dojo, a community, and a mindset.

It’s tough. It’ll break you a little. But it’ll also build you back better — with actual hacker muscles.

If you’re starting out in cybersecurity or reverse engineering and want a guided-but-gritty path, this is it. You’ll laugh, cry, and spend way too much time wondering why your shellcode won’t work — but in the end, it’s worth every keystroke.

🎯 What’s Next?

  • Finish ARM challenges
  • Get into firmware reverse engineering
  • Launch the IoT Firmware Blog Series
  • Build and break ESP32-based projects
  • Write my own exploit for a real-world IoT device
  • Work towards that Green Belt in the coming days
  • And of course, keep leveling up in the dojo

If you ever find yourself in pwn.college, say hi in the Discord.
I’ll be the one named TaklaMan, trying to ROP chain my way out of a segfault.

Stay pwned,
TaklaMan