{"enrichment":{"faq":[{"a":"heap-exploitation teaches exploitation of glibc's ptmalloc2 allocator, covering use-after-free, double-free, heap overflow, and off-by-one attacks. The skill addresses bin structures (fastbin, tcache, unsorted bin), leak methods for ASLR bypass, tcache mechanics, and version-specific tactics across glibc 2.26 through 2.34, including safe-linking bypass and post-hook exploitation strategies.","q":"What heap exploitation techniques does heap-exploitation cover for ptmalloc2/glibc?"},{"a":"heap-exploitation covers arbitrary code execution through heap vulnerabilities by teaching chunk metadata corruption, fastbin duplication for arbitrary allocation, heap overlapping techniques, and IO_FILE vtable hijacking for file operation exploitation. The skill includes methods to leak libc addresses, bypass protections like safe-linking, and chain exploits to reach code execution via one-gadget RCE or malloc hook techniques.","q":"How can I execute arbitrary code via heap overflow or UAF attacks?"},{"a":"heap-exploitation covers tcache poisoning and fastbin attack mechanics, including fastbin duplication for arbitrary allocation, tcache fd pointer manipulation, and protect_ptr deobfuscation in glibc 2.32+. The skill teaches how to bypass tcache key checks and safe-linking protections, enabling controlled chunk allocation to arbitrary memory addresses for exploitation chains.","q":"What methods does heap-exploitation teach for tcache poisoning and fastbin attacks?"},{"a":"heap-exploitation teaches address leak techniques including unsorted bin libc leak methods and heap base leaks via tcache fd inspection. The skill covers using pwndbg for heap bins inspection and chunk metadata analysis to extract pointers, enabling ASLR bypass necessary for reliable exploitation of glibc across versions 2.26\u20132.34.","q":"How do I leak libc and heap addresses to bypass ASLR using heap-exploitation?"},{"a":"heap-exploitation covers glibc version-specific mitigations and constraints from 2.26 through 2.34, including safe-linking introduction in glibc 2.32, tcache key checks, and post-hook exploitation strategies. The skill teaches how different versions affect fastbin, tcache, and unsorted bin behavior, and provides tactics to adapt exploits across versions.","q":"What glibc version-specific heap attack constraints does heap-exploitation address?"},{"a":"Yes, heap-exploitation covers off-by-one and null byte heap vulnerabilities as part of its comprehensive playbook. The skill teaches chunk metadata corruption via these primitives, heap overlapping techniques, and how to chain them with other attacks like house of force and spirit orange to achieve arbitrary write and code execution.","q":"Does heap-exploitation include off-by-one and null byte heap exploitation?"}],"shadow_tags":["memory-corruption","binary-exploitation","ctf-techniques","libc-internals","arbitrary-code-execution","vulnerability-chaining","reverse-engineering","exploit-development","security-research"],"summary_rewrite":"Learn to exploit heap vulnerabilities in glibc's ptmalloc2 allocator, from use-after-free and double-free to overflow and off-by-one attacks. This playbook covers bin structures, leak methods, tcache mechanics, and version-specific tactics across glibc 2.26 through 2.34, including safe-linking bypass and post-hook exploitation strategies."},"files":[{"bytes":9294,"path":"skills/heap-exploitation/SKILL.md","sha256":"aa73ba2c7b9fd6af67ed7651787852acae5886914271fcbf6e4e12894ed13180","url":"https://skillfed.io/files/yaklang/hack-skills/heap-exploitation/a2702a2f/SKILL.md"}],"id":"yaklang/hack-skills/heap-exploitation","links":{"html":"https://skillfed.io/yaklang/hack-skills/heap-exploitation","md":"https://skillfed.io/yaklang/hack-skills/heap-exploitation.md","repo":"https://github.com/yaklang/hack-skills"},"meta":{"agents_supported":[],"first_seen":"2026-07-28","forks":196,"language":"CSS","last_updated":"2026-06-16","license":"MIT","name":"heap-exploitation","publisher":"yaklang","stars":1480},"relations":{"similar":[{"id":"hypnguyen1209/offensive-claude/exploit-development"},{"id":"ljagiello/ctf-skills/ctf-pwn"},{"id":"yaklang/hack-skills/arbitrary-write-to-rce"},{"id":"yaklang/hack-skills/binary-protection-bypass"},{"id":"yaklang/hack-skills/format-string-exploitation"},{"id":"cyberkaida/reverse-engineering-assistant/ctf-pwn"},{"id":"yaklang/hack-skills/stack-overflow-and-rop"},{"id":"mohitmishra786/low-level-dev-skills/custom-allocators"},{"id":"terrylica/cc-skills/python-memory-safe-scripts"},{"id":"gmh5225/awesome-game-security/windows-kernel"}]},"slug":{"owner":"yaklang","repo":"hack-skills","skill":"heap-exploitation"},"version":"a2702a2f"}