exploit-development
Build weaponized proof-of-concept exploits from confirmed vulnerabilities, constructing reliable primitive chains (leak → read/write → control flow) across userland binaries, browser engines, and kernel targets. Handles modern protections including ASLR, DEP, stack canaries, CFG, Intel CET, and V8 Sandbox with integrated OPSEC and detection telemetry.
Exploit Development converts confirmed vulnerabilities into reliable, version-pinned proof-of-concept exploits with primitive chains against modern mitigations.
AI-generated summary based on this skill's SKILL.md
Install
hypnguyen1209/offensive-claude/exploit-development · repository language: Python
git clone https://github.com/hypnguyen1209/offensive-claude
cp -r offensive-claude/skills/exploit-development ~/.claude/skills/exploit-developmentnpx skillfed install hypnguyen1209/offensive-claude/exploit-developmentFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How do I turn a crash into a working exploit?
exploit-development guides you through converting a confirmed crash into a reliable PoC by building primitive chains: information leak → arbitrary read/write → control flow hijack. The skill covers constructing these chains across userland binaries, browser engines (V8), and kernel targets, with techniques for heap spray reclaim, gadget discovery, and exploit reliability testing to achieve consistent success rates.
What mitigations does exploit-development help defeat?
exploit-development addresses modern protections: ASLR, PIE, NX/DEP, stack canaries, RELRO, CFG, Intel CET, and V8 Sandbox. It provides mitigation-aware techniques including ret2libc/ret2csu chains, safe-linking bypass, shadow stack evasion, and sandbox escape methods (type confusion, UAF, addrof/fakeobj primitives) tailored to each defense layer.
How can I develop V8 type confusion and UAF exploits?
exploit-development covers browser/JIT engine exploitation via V8-specific primitives: type confusion for type oracle bypass, use-after-free with heap spray and reclaim techniques, addrof for address leaks, and fakeobj for arbitrary object construction. These combine into read/write primitives and sandbox escape chains targeting WASM jump tables and V8 internals.
What techniques does exploit-development teach for kernel LPE?
exploit-development addresses Linux and Windows kernel privilege escalation against memory corruption bugs. Techniques include msg_msg infoleak spray, dirty pagetable exploitation, glibc tcache/fastbin poisoning with safe-linking bypass, FSOP (file structure operation) chains, and stack pivot methods—all integrated with OPSEC and detection telemetry for reliable exploitation.
Does exploit-development include automation tooling?
exploit-development integrates gadget discovery and exploit chain generation automation using frameworks like pwntools and angr. This enables rapid PoC development, feasibility profiling against mitigation matrices, and reliability testing. Automation reduces manual effort in ROP/JOP chain construction and primitive chain validation across target architectures.
What does a reliable exploit primitive chain look like?
exploit-development teaches reliable chains as: (1) information leak via format string, heap infoleak, or side-channel; (2) arbitrary read/write via heap corruption, FSOP, or type confusion; (3) control flow hijack via ROP, ret2libc, or JIT code reuse. Each stage is hardened against mitigations (ASLR bypass, canary leak, CFG evasion) and tested for 90%+ success rates before deployment.
SKILL.md
rendered from the published skill — quoted content, verbatim
name: exploit-development description: Use when turning a memory-corruption bug into a working PoC — stack/ROP, glibc heap & FSOP, format strings, browser/JIT type confusion & UAF, Linux/Windows kernel LPE against ASLR/DEP/CFG/CET/V8-Sandbox metadata: type: offensive phase: exploitation tools: pwntools, gdb-gef, pwndbg, radare2, ropper, ROPgadget, one_gadget, angr, d8, WinDbg, IDA mitre: [T1203, T1068, T1211, T1212, T1055] kill_chain: phase: [weaponize, exploit] step: [2, 4] attck_tactics: [TA0042, TA0002, TA0004] attck_techniques: [T1203, T1068, T1211, T1212, T1055.012] depends_on: [recon-osint, vulnerability-analysis] feeds_into: [edr-evasion, shellcode-dev, initial-access, privesc-linux, privesc-windows] inputs: [vulnerability_list, attack_surface_map, crash_corpus, target_versions] outputs: [exploit_poc, payload, primitive_chain, finding_record] references: - references/stack-rop-mitigations.md - references/heap-glibc-fsop.md - references/format-string-leaks.md - references/browser-jit-uaf.md - references/kernel-exploitation.md - references/exploit-feasibility.md scripts: - scripts/rop_autochain.py - scripts/offset_finder.py -
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 15 files
skills/exploit-development/SKILL.md
skills/exploit-development/references/browser-jit-uaf.md
skills/exploit-development/references/exploit-feasibility.md
skills/exploit-development/references/format-string-leaks.md
skills/exploit-development/references/heap-glibc-fsop.md
skills/exploit-development/references/kernel-exploitation.md
skills/exploit-development/references/stack-rop-mitigations.md
skills/exploit-development/scripts/exploit_context.py
skills/exploit-development/scripts/feasibility_profile.py
skills/exploit-development/scripts/fmtstr_leak.py
skills/exploit-development/scripts/heap_fsop.py
skills/exploit-development/scripts/kernel_lpe_skeleton.c
skills/exploit-development/scripts/offset_finder.py
skills/exploit-development/scripts/rop_autochain.py
skills/exploit-development/scripts/safe_linking.py