heap-exploitation
Learn to exploit heap vulnerabilities in glibc's ptmalloc2 allocator, from use-after-free and double-free to overflow and off-by-one attacks. This playbook covers bin structures, leak methods, tcache mechanics, and version-specific tactics across glibc 2.26 through 2.34, including safe-linking bypass and post-hook exploitation strategies.
Heap Exploitation teaches ptmalloc2/glibc heap attack techniques including UAF, double free, overflow, and tcache poisoning across glibc versions.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-06-16
Heap Exploitation teaches ptmalloc2/glibc heap attack techniques including UAF, double free, overflow, and tcache poisoning across glibc versions. Learn to exploit heap vulnerabilities in glibc's ptmalloc2 allocator, from use-after-free and double-free to overflow and off-by-one attacks. This playbook covers bin structures, leak methods, tcache mechanics, and version-specific tactics across glibc 2.26 through 2.34, including safe-linking bypass and post-hook exploitation strategies.
Use it when
- heap-exploitation covers arbitrary code execution through heap vulnerabilities by teaching chunk metadata corruption.
- heap-exploitation covers tcache poisoning and fastbin attack mechanics, including fastbin duplication for arbitrary allocation.
Verify before relying
Read SKILL.md below before installing (3 files). Open directory: indexed for reading, not audited.
Install
yaklang/hack-skills/heap-exploitation · repository language: CSS
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What heap exploitation techniques does heap-exploitation cover for ptmalloc2/glibc?
heap-exploitation teaches exploitation of glibc's ptmalloc2 allocator, covering use-after-free, double-free, heap overflow, and off-by-one attacks. The skill addresses bin structures (fastbin, tcache, unsorted bin), leak methods for ASLR bypass, tcache mechanics, and version-specific tactics across glibc 2.26 through 2.34, including safe-linking bypass and post-hook exploitation strategies.
How can I execute arbitrary code via heap overflow or UAF attacks?
heap-exploitation covers arbitrary code execution through heap vulnerabilities by teaching chunk metadata corruption, fastbin duplication for arbitrary allocation, heap overlapping techniques, and IO_FILE vtable hijacking for file operation exploitation. The skill includes methods to leak libc addresses, bypass protections like safe-linking, and chain exploits to reach code execution via one-gadget RCE or malloc hook techniques.
What methods does heap-exploitation teach for tcache poisoning and fastbin attacks?
heap-exploitation covers tcache poisoning and fastbin attack mechanics, including fastbin duplication for arbitrary allocation, tcache fd pointer manipulation, and protect_ptr deobfuscation in glibc 2.32+. The skill teaches how to bypass tcache key checks and safe-linking protections, enabling controlled chunk allocation to arbitrary memory addresses for exploitation chains.
How do I leak libc and heap addresses to bypass ASLR using heap-exploitation?
heap-exploitation teaches address leak techniques including unsorted bin libc leak methods and heap base leaks via tcache fd inspection. The skill covers using pwndbg for heap bins inspection and chunk metadata analysis to extract pointers, enabling ASLR bypass necessary for reliable exploitation of glibc across versions 2.26–2.34.
What glibc version-specific heap attack constraints does heap-exploitation address?
heap-exploitation covers glibc version-specific mitigations and constraints from 2.26 through 2.34, including safe-linking introduction in glibc 2.32, tcache key checks, and post-hook exploitation strategies. The skill teaches how different versions affect fastbin, tcache, and unsorted bin behavior, and provides tactics to adapt exploits across versions.
Does heap-exploitation include off-by-one and null byte heap exploitation?
Yes, heap-exploitation covers off-by-one and null byte heap vulnerabilities as part of its comprehensive playbook. The skill teaches chunk metadata corruption via these primitives, heap overlapping techniques, and how to chain them with other attacks like house of force and spirit orange to achieve arbitrary write and code execution.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
SKILL: Heap Exploitation — Expert Attack Playbook
> AI LOAD INSTRUCTION: Expert glibc heap exploitation techniques. Covers ptmalloc2 internals, bin structures, tcache mechanics, libc/heap leak methods, and attack selection by glibc version. Distilled from ctf-wiki heap sections, how2heap, and real-world exploitation. Base models often confuse glibc version constraints and miss safe-linking (PROTECT_PTR) introduced in 2.32.
0. RELATED ROUTING
- stack-overflow-and-rop — when the overflow is on the stack rather than the heap
- format-string-exploitation — leak heap/libc addresses via format string
- arbitrary-write-to-rce — convert heap arbitrary write into code execution
- binary-protection-bypass — bypass ASLR/RELRO to use heap write
(truncated - see the full file via the links below)
File tree — 3 files
skills/heap-exploitation/HOUSE_OF_TECHNIQUES.md
skills/heap-exploitation/IO_FILE_EXPLOITATION.md
skills/heap-exploitation/SKILL.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Learn heap exploitation techniques for ptmalloc2/glibc vulnerabilities”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Build weaponized proof-of-concept exploits from confirmed vulnerabilities, constructing reliable primitive chains (leak → read/write → control flow) across userland binaries, browser engines, and kernel targets. Handles modern protections including ASLR, DEP, stack canaries, CFG, Intel CET, and V8 Sandbox with integrated OPSEC and detection telemetry.
ctf-pwn equips you with techniques to weaponize memory corruption vulnerabilities in CTF challenges. From buffer overflows and format strings to advanced heap exploitation, ROP chains, and kernel attacks, it covers the full spectrum of low-level privilege escalation and code execution paths. Use it when you have a vulnerable target and need to convert corruption primitives into shell access.
This skill covers format string exploitation from vulnerability identification through advanced attack chains. Learn to read stack memory with %p, perform arbitrary writes using %n variants, leak canaries and ASLR offsets, and overwrite GOT entries or hooks for code execution. Includes pwntools automation and blind exploitation techniques.
Learn to exploit kernel vulnerabilities like use-after-free, out-of-bounds access, and race conditions for privilege escalation. This skill covers environment setup with QEMU, building exploitation primitives, bypassing mitigations like KASLR and SMEP, and executing kernel ROP chains to achieve root access.
Master the identification and circumvention of modern binary protections including ASLR, PIE, NX/DEP, stack canaries, RELRO, FORTIFY_SOURCE, CET, and MTE. This playbook pairs each protection mechanism with its bypass methods and required primitives, drawing from real-world exploitation and CTF techniques. Learn information leaks, ROP chains, ret2libc, and alternative targeting strategies when standard approaches are blocked.
CTF Binary Exploitation guides you through discovering and exploiting memory corruption vulnerabilities to read flags. Learn to analyze data flow, identify unsafe APIs, map memory layouts, and chain exploitation primitives—from buffer overflows to ROP chains—adapting core concepts to any pwn challenge.
More skills stack-overflow-and-rop (MIT) · windows-kernel-security (MIT)