Peter Van Eeckhoutte

Peter Van Eeckhoutte is a Belgian security researcher and trainer best known as the founder of the Corelan Security Team and the author of the Corelan Exploit Writing Tutorials, a series that helped popularize and standardize the study of Windows memory-corruption exploitation for a generation of security researchers and penetration testers.

Early life and career

According to his own account on corelan.be, Van Eeckhoutte was born in 1975 and grew up in Vichte, Belgium. He began his professional career in 2000 as a systems administrator, later moving through roles including membership in a Center of Excellence for Security and Messaging, the Core Active Directory Team, and a worldwide Security Competence Center, before being appointed IT Security Officer. He continued to rise through corporate IT security management, becoming CISO / Corporate IST Security Officer in January 2012 and Director of IST Infrastructure Services and Security in September 2014.

Founding Corelan

Van Eeckhoutte started the corelan.be website in 2007, initially to post networking and systems-administration notes. As his personal research into Windows memory corruption and exploit development matured, he began publishing his findings there, and these notes became what he describes as "the infamous Corelan Exploit Writing Tutorials." The series, published between July 2009 and December 2011, covers topics progressing from basic stack-based buffer overflows to SEH-based exploitation, bypassing stack cookies, SafeSEH, SEHOP, hardware DEP and ASLR, Unicode-based exploitation, Win32 egg hunting, Win32 shellcoding, ROP chaining to defeat DEP, and heap spraying.

In September 2009, he founded the Corelan Security Team, describing it as a group of security enthusiasts united around the goals to "research, learn and share," which went on to conduct coordinated vulnerability research and disclosure. Alongside the tutorials, he developed mona.py, an exploit-development automation plugin for debuggers such as Immunity Debugger and WinDbg that assists researchers with tasks like finding usable ROP gadgets, pattern generation/offset-finding, and memory analysis; the tool is reportedly named after his daughter, Mona.

Later career and training

Van Eeckhoutte left his corporate employment in October 2018, and in February 2019 founded Corelan Consulting bvba, becoming fully self-employed and building a living through Corelan Training. Corelan Training offers hands-on courses on stack- and heap-based exploitation, taught directly by Van Eeckhoutte, positioned as a deeper, practical complement to the freely available online tutorials. He continues to be active in the security community under the handle "corelanc0d3r," maintaining a presence on platforms including X (Twitter), LinkedIn, and Mastodon.

Note: Some secondary details commonly associated with the Corelan project — such as specific conference training engagements (e.g., Black Hat, DEF CON) — could not be independently verified from primary sources during this research and are omitted here as unconfirmed.

Timeline

• 2000Began career as a Systems Administrator.
• 2007Started the corelan.be website, initially covering networking/sysadmin topics.
• 2009-07-19Published "Exploit writing tutorial part 1: Stack Based Overflows", the start of the Corelan Exploit Writing Tutorials series.
• 2009-09Founded the Corelan Security Team.
• 2010-06-16Published tutorial part 10 on chaining DEP bypass with ROP.
• 2011-12-31Published tutorial part 11, "Heap Spraying Demystified".
• 2012-01Became CISO / Corporate IST Security Officer at his employer.
• 2014-09Became Director of IST Infrastructure Services and Security.
• 2018-10Left corporate employment.
• 2019-02Founded Corelan Consulting bvba, becoming fully self-employed and focusing on Corelan Training.