Learning offensive security through CTFs is a tried and true method. Most of the best researchers in the world got their start by playing CTFs. However, moving from finding vulnerabilities in small, bite-sized challenge problems to full blown applications can be a daunting task. Often times, it requires a shift in mindset, methodology, and tooling.In this talk, we will walk through the key points to consider when attacking real world applications and devices. We'll start with high level methodology such as understanding attack surfaces, subsystem selection and vulnerability research tooling. We'll then delve into practical exercises, such as crafting an exploit for a known vulnerability (CVE-2023-35138) and conducting variant analysis to identify ineffective patches. Finally, we will look at a handful of 0-days discovered using this methodology, including a kernel driver overflow leading to a local privilege escalation (CVE-2023-30257), and a command injection leading to RCE (CVE-2022–23900).