exploit-development
Build weaponized proof-of-concept exploits from confirmed vulnerabilities, constructing reliable primitive chains (leak → read/write → control flow) across userland binaries, browser engines, and kernel targets. Handles modern protections including ASLR, DEP, stack canaries, CFG, Intel CET, and V8 Sandbox with integrated OPSEC and detection telemetry.
Exploit Development converts confirmed vulnerabilities into reliable, version-pinned proof-of-concept exploits with primitive chains against modern mitigations.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-03
Exploit Development converts confirmed vulnerabilities into reliable, version-pinned proof-of-concept exploits with primitive chains against modern mitigations. Build weaponized proof-of-concept exploits from confirmed vulnerabilities, constructing reliable primitive chains (leak → read/write → control flow) across userland binaries, browser engines, and kernel targets. Handles modern protections including ASLR, DEP, stack canaries, CFG, Intel CET, and V8 Sandbox with integrated OPSEC and detection telemetry.
Use it when
- exploit-development addresses modern protections: ASLR, PIE, NX/DEP, stack canaries, RELRO, CFG, Intel CET, and V8 Sandbox.
- exploit-development covers browser/JIT engine exploitation via V8-specific primitives: type confusion for type oracle bypass.
Verify before relying
Read SKILL.md below before installing (16 files). Open directory: indexed for reading, not audited.
Install
hypnguyen1209/offensive-claude/exploit-development · repository language: Python
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How do I turn a crash into a working exploit?
exploit-development guides you through converting a confirmed crash into a reliable PoC by building primitive chains: information leak → arbitrary read/write → control flow hijack. The skill covers constructing these chains across userland binaries, browser engines (V8), and kernel targets, with techniques for heap spray reclaim, gadget discovery, and exploit reliability testing to achieve consistent success rates.
What mitigations does exploit-development help defeat?
exploit-development addresses modern protections: ASLR, PIE, NX/DEP, stack canaries, RELRO, CFG, Intel CET, and V8 Sandbox. It provides mitigation-aware techniques including ret2libc/ret2csu chains, safe-linking bypass, shadow stack evasion, and sandbox escape methods (type confusion, UAF, addrof/fakeobj primitives) tailored to each defense layer.
How can I develop V8 type confusion and UAF exploits?
exploit-development covers browser/JIT engine exploitation via V8-specific primitives: type confusion for type oracle bypass, use-after-free with heap spray and reclaim techniques, addrof for address leaks, and fakeobj for arbitrary object construction. These combine into read/write primitives and sandbox escape chains targeting WASM jump tables and V8 internals.
What techniques does exploit-development teach for kernel LPE?
exploit-development addresses Linux and Windows kernel privilege escalation against memory corruption bugs. Techniques include msg_msg infoleak spray, dirty pagetable exploitation, glibc tcache/fastbin poisoning with safe-linking bypass, FSOP (file structure operation) chains, and stack pivot methods—all integrated with OPSEC and detection telemetry for reliable exploitation.
Does exploit-development include automation tooling?
exploit-development integrates gadget discovery and exploit chain generation automation using frameworks like pwntools and angr. This enables rapid PoC development, feasibility profiling against mitigation matrices, and reliability testing. Automation reduces manual effort in ROP/JOP chain construction and primitive chain validation across target architectures.
What does a reliable exploit primitive chain look like?
exploit-development teaches reliable chains as: (1) information leak via format string, heap infoleak, or side-channel; (2) arbitrary read/write via heap corruption, FSOP, or type confusion; (3) control flow hijack via ROP, ret2libc, or JIT code reuse. Each stage is hardened against mitigations (ASLR bypass, canary leak, CFG evasion) and tested for 90%+ success rates before deployment.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
name: exploit-development description: Use when turning a memory-corruption bug into a working PoC — stack/ROP, glibc heap & FSOP, format strings, browser/JIT type confusion & UAF, Linux/Windows kernel LPE against ASLR/DEP/CFG/CET/V8-Sandbox metadata: type: offensive phase: exploitation tools: pwntools, gdb-gef, pwndbg, radare2, ropper, ROPgadget, one_gadget, angr, d8, WinDbg, IDA mitre: [T1203, T1068, T1211, T1212, T1055] kill_chain: phase: [weaponize, exploit] step: [2, 4] attck_tactics: [TA0042, TA0002, TA0004] attck_techniques: [T1203, T1068, T1211, T1212, T1055.012] depends_on: [recon-osint, vulnerability-analysis] feeds_into: [edr-evasion, shellcode-dev, initial-access, privesc-linux, privesc-windows] inputs: [vulnerability_list, attack_surface_map, crash_corpus, target_versions] outputs: [exploit_poc, payload, primitive_chain, finding_record] references: - references/stack-rop-mitigations.md - references/heap-glibc-fsop.md - references/format-string-leaks.md - references/browser-jit-uaf.md - references/kernel-exploitation.md - references/exploit-feasibility.md scripts: - scripts/rop_autochain.py - scripts/offset_finder.py -
(truncated - see the full file via the links below)
File tree — 15 files
skills/exploit-development/SKILL.md
skills/exploit-development/references/browser-jit-uaf.md
skills/exploit-development/references/exploit-feasibility.md
skills/exploit-development/references/format-string-leaks.md
skills/exploit-development/references/heap-glibc-fsop.md
skills/exploit-development/references/kernel-exploitation.md
skills/exploit-development/references/stack-rop-mitigations.md
skills/exploit-development/scripts/exploit_context.py
skills/exploit-development/scripts/feasibility_profile.py
skills/exploit-development/scripts/fmtstr_leak.py
skills/exploit-development/scripts/heap_fsop.py
skills/exploit-development/scripts/kernel_lpe_skeleton.c
skills/exploit-development/scripts/offset_finder.py
skills/exploit-development/scripts/rop_autochain.py
skills/exploit-development/scripts/safe_linking.py
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Convert confirmed vulnerability into reliable working PoC with primitive chain”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Binary Analysis guides you through reverse engineering workflows for CTF challenges and vulnerability research. It combines security property checks, static disassembly, firmware extraction, and dynamic debugging to uncover exploitable weaknesses and craft targeted payloads.
Weaponize client-side browser vulnerabilities into full host compromise by chaining JS-engine bugs through multiple sandbox layers. This skill covers V8 and JavaScriptCore exploitation, heap-sandbox escape techniques, OS-sandbox bypass via Mojo IPC and GPU processes, and Electron/webview misconfigurations. Includes scripts, references, and OPSEC guidance for assembling 1-click drive-by RCE delivery.
Learn to exploit heap vulnerabilities in glibc's ptmalloc2 allocator, from use-after-free and double-free to overflow and off-by-one attacks. This playbook covers bin structures, leak methods, tcache mechanics, and version-specific tactics across glibc 2.26 through 2.34, including safe-linking bypass and post-hook exploitation strategies.
ctf-pwn equips you with techniques to weaponize memory corruption vulnerabilities in CTF challenges. From buffer overflows and format strings to advanced heap exploitation, ROP chains, and kernel attacks, it covers the full spectrum of low-level privilege escalation and code execution paths. Use it when you have a vulnerable target and need to convert corruption primitives into shell access.
Master the identification and circumvention of modern binary protections including ASLR, PIE, NX/DEP, stack canaries, RELRO, FORTIFY_SOURCE, CET, and MTE. This playbook pairs each protection mechanism with its bypass methods and required primitives, drawing from real-world exploitation and CTF techniques. Learn information leaks, ROP chains, ret2libc, and alternative targeting strategies when standard approaches are blocked.
Windows Boundaries equips you with techniques and tools to cross Windows security boundaries—from kernel/user mode transitions via win32k/dxgkrnl exploits and BYOVD drivers, to UAC elevation, AppContainer/LPAC sandbox escapes, PPL circumvention, and RPC/ALPC-based token impersonation. Includes enumeration scripts, proof-of-concept exploits, and OPSEC guidance for each attack vector.
More skills stack-overflow-and-rop (MIT) · browser-exploitation-v8 (MIT) · kernel-exploitation (MIT) · windows-mitigations-bypass (MIT) · privesc-windows (MIT) · kernel-security (MIT)