manesec
diff --git a/‎SUMMARY.md‎
Lines changed: 0 additions & 1 deletion b/‎SUMMARY.md‎
Lines changed: 0 additions & 1 deletion
diff --git a/‎binary-exploitation/arbitrary-write-2-exec/aw2exec-got-plt.md‎
Lines changed: 8 additions & 1 deletion b/‎binary-exploitation/arbitrary-write-2-exec/aw2exec-got-plt.md‎
Lines changed: 8 additions & 1 deletion
@@ -764,7 +764,6 @@
   * [WWW2Exec - \_\_malloc\_hook](binary-exploitation/arbitrary-write-2-exec/aw2exec-\_\_malloc\_hook.md)
 * [Common Exploiting Problems](binary-exploitation/common-exploiting-problems.md)
 * [Windows Exploiting (Basic Guide - OSCP lvl)](binary-exploitation/windows-exploiting-basic-guide-oscp-lvl.md)
-* [Linux Exploiting (Basic) (SPA)](binary-exploitation/linux-exploiting-basic-esp.md)
 
 ## 🔩 Reversing
 
 
@@ -60,14 +60,21 @@ The **GOT of libc** is usually compiled with **partial RELRO**, making it a nice
 
 Common functions of the libc are going to call **other internal functions** whose GOT could be overwritten in order to get code execution.
 
-Find [**more information about this tachnique here**](https://github.com/nobodyisnobody/docs/blob/main/code.execution.on.last.libc/README.md#1---targetting-libc-got-entries).
+Find [**more information about this technique here**](https://github.com/nobodyisnobody/docs/blob/main/code.execution.on.last.libc/README.md#1---targetting-libc-got-entries).
 
 ## **One Gadget**
 
 {% content-ref url="../rop-return-oriented-programing/ret2lib/one-gadget.md" %}
 [one-gadget.md](../rop-return-oriented-programing/ret2lib/one-gadget.md)
 {% endcontent-ref %}
 
+## **Abusing GOT from Heap**
+
+A common way to obtain RCE from a heap vulnerability is to abuse a fastbin so it's possible to add the part of the GOT table into the fast bin, so whenever that chunk is allocated it'll be possible to **overwrite the pointer of a function, usually `free`**.\
+Then, pointing `free` to `system` and freeing a chunk were was written `/bin/sh\x00` will execute a shell.
+
+It's possible to find an [**example here**](https://ctf-wiki.mahaloz.re/pwn/linux/glibc-heap/chunk\_extend\_overlapping/#hitcon-trainging-lab13)**.**
+
 ## **Protections**
 
 The **Full RELRO** protection is meant to protect agains this kind of technique by resolving all the addresses of the functions when the binary is started and making the **GOT table read only** after it: