{"enrichment":{"faq":[{"a":"exploit-development guides you through converting a confirmed crash into a reliable PoC by building primitive chains: information leak \u2192 arbitrary read/write \u2192 control flow hijack. The skill covers constructing these chains across userland binaries, browser engines (V8), and kernel targets, with techniques for heap spray reclaim, gadget discovery, and exploit reliability testing to achieve consistent success rates.","q":"How do I turn a crash into a working exploit?"},{"a":"exploit-development addresses modern protections: ASLR, PIE, NX/DEP, stack canaries, RELRO, CFG, Intel CET, and V8 Sandbox. It provides mitigation-aware techniques including ret2libc/ret2csu chains, safe-linking bypass, shadow stack evasion, and sandbox escape methods (type confusion, UAF, addrof/fakeobj primitives) tailored to each defense layer.","q":"What mitigations does exploit-development help defeat?"},{"a":"exploit-development covers browser/JIT engine exploitation via V8-specific primitives: type confusion for type oracle bypass, use-after-free with heap spray and reclaim techniques, addrof for address leaks, and fakeobj for arbitrary object construction. These combine into read/write primitives and sandbox escape chains targeting WASM jump tables and V8 internals.","q":"How can I develop V8 type confusion and UAF exploits?"},{"a":"exploit-development addresses Linux and Windows kernel privilege escalation against memory corruption bugs. Techniques include msg_msg infoleak spray, dirty pagetable exploitation, glibc tcache/fastbin poisoning with safe-linking bypass, FSOP (file structure operation) chains, and stack pivot methods\u2014all integrated with OPSEC and detection telemetry for reliable exploitation.","q":"What techniques does exploit-development teach for kernel LPE?"},{"a":"exploit-development integrates gadget discovery and exploit chain generation automation using frameworks like pwntools and angr. This enables rapid PoC development, feasibility profiling against mitigation matrices, and reliability testing. Automation reduces manual effort in ROP/JOP chain construction and primitive chain validation across target architectures.","q":"Does exploit-development include automation tooling?"},{"a":"exploit-development teaches reliable chains as: (1) information leak via format string, heap infoleak, or side-channel; (2) arbitrary read/write via heap corruption, FSOP, or type confusion; (3) control flow hijack via ROP, ret2libc, or JIT code reuse. Each stage is hardened against mitigations (ASLR bypass, canary leak, CFG evasion) and tested for 90%+ success rates before deployment.","q":"What does a reliable exploit primitive chain look like?"}],"shadow_tags":["memory-corruption-weaponization","primitive-chain-building","mitigation-bypass-techniques","browser-engine-exploitation","kernel-memory-attacks","gadget-chain-automation","heap-spray-reclaim","control-flow-hijacking","version-pinned-poc","opsec-telemetry-evasion"],"summary_rewrite":"Build weaponized proof-of-concept exploits from confirmed vulnerabilities, constructing reliable primitive chains (leak \u2192 read/write \u2192 control flow) across userland binaries, browser engines, and kernel targets. Handles modern protections including ASLR, DEP, stack canaries, CFG, Intel CET, and V8 Sandbox with integrated OPSEC and detection telemetry."},"files":[{"bytes":9365,"path":"skills/exploit-development/SKILL.md","sha256":"d79bb8b322a9add0a587d2845f74893813c73f6276b853e3b45fb3996a3ba279","url":"https://skillfed.io/files/hypnguyen1209/offensive-claude/exploit-development/57bebed3/SKILL.md"}],"id":"hypnguyen1209/offensive-claude/exploit-development","links":{"html":"https://skillfed.io/hypnguyen1209/offensive-claude/exploit-development","md":"https://skillfed.io/hypnguyen1209/offensive-claude/exploit-development.md","repo":"https://github.com/hypnguyen1209/offensive-claude"},"meta":{"agents_supported":[],"first_seen":"2026-07-28","forks":58,"language":"Python","last_updated":"2026-07-03","license":"MIT","name":"exploit-development","publisher":"hypnguyen1209","stars":326},"relations":{"similar":[{"id":"hypnguyen1209/offensive-claude/browser-exploitation"},{"id":"yaklang/hack-skills/heap-exploitation"},{"id":"ljagiello/ctf-skills/ctf-pwn"},{"id":"hypnguyen1209/offensive-claude/windows-boundaries"},{"id":"hypnguyen1209/offensive-claude/privesc-linux"},{"id":"hypnguyen1209/offensive-claude/vulnerability-analysis"},{"id":"hypnguyen1209/offensive-claude/windows-mitigations"},{"id":"hypnguyen1209/offensive-claude/privesc-windows"},{"id":"yaklang/hack-skills/kernel-exploitation"},{"id":"yaklang/hack-skills/binary-protection-bypass"}]},"slug":{"owner":"hypnguyen1209","repo":"offensive-claude","skill":"exploit-development"},"version":"57bebed3"}