heap-exploitation
Learn to exploit heap vulnerabilities in glibc's ptmalloc2 allocator, from use-after-free and double-free to overflow and off-by-one attacks. This playbook covers bin structures, leak methods, tcache mechanics, and version-specific tactics across glibc 2.26 through 2.34, including safe-linking bypass and post-hook exploitation strategies.
Heap Exploitation teaches ptmalloc2/glibc heap attack techniques including UAF, double free, overflow, and tcache poisoning across glibc versions.
AI-generated summary based on this skill's SKILL.md
Install
yaklang/hack-skills/heap-exploitation · repository language: CSS
git clone https://github.com/yaklang/hack-skills
cp -r hack-skills/skills/heap-exploitation ~/.claude/skills/heap-exploitationnpx skillfed install yaklang/hack-skills/heap-exploitationFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What heap exploitation techniques does heap-exploitation cover for ptmalloc2/glibc?
heap-exploitation teaches exploitation of glibc's ptmalloc2 allocator, covering use-after-free, double-free, heap overflow, and off-by-one attacks. The skill addresses bin structures (fastbin, tcache, unsorted bin), leak methods for ASLR bypass, tcache mechanics, and version-specific tactics across glibc 2.26 through 2.34, including safe-linking bypass and post-hook exploitation strategies.
How can I execute arbitrary code via heap overflow or UAF attacks?
heap-exploitation covers arbitrary code execution through heap vulnerabilities by teaching chunk metadata corruption, fastbin duplication for arbitrary allocation, heap overlapping techniques, and IO_FILE vtable hijacking for file operation exploitation. The skill includes methods to leak libc addresses, bypass protections like safe-linking, and chain exploits to reach code execution via one-gadget RCE or malloc hook techniques.
What methods does heap-exploitation teach for tcache poisoning and fastbin attacks?
heap-exploitation covers tcache poisoning and fastbin attack mechanics, including fastbin duplication for arbitrary allocation, tcache fd pointer manipulation, and protect_ptr deobfuscation in glibc 2.32+. The skill teaches how to bypass tcache key checks and safe-linking protections, enabling controlled chunk allocation to arbitrary memory addresses for exploitation chains.
How do I leak libc and heap addresses to bypass ASLR using heap-exploitation?
heap-exploitation teaches address leak techniques including unsorted bin libc leak methods and heap base leaks via tcache fd inspection. The skill covers using pwndbg for heap bins inspection and chunk metadata analysis to extract pointers, enabling ASLR bypass necessary for reliable exploitation of glibc across versions 2.26–2.34.
What glibc version-specific heap attack constraints does heap-exploitation address?
heap-exploitation covers glibc version-specific mitigations and constraints from 2.26 through 2.34, including safe-linking introduction in glibc 2.32, tcache key checks, and post-hook exploitation strategies. The skill teaches how different versions affect fastbin, tcache, and unsorted bin behavior, and provides tactics to adapt exploits across versions.
Does heap-exploitation include off-by-one and null byte heap exploitation?
Yes, heap-exploitation covers off-by-one and null byte heap vulnerabilities as part of its comprehensive playbook. The skill teaches chunk metadata corruption via these primitives, heap overlapping techniques, and how to chain them with other attacks like house of force and spirit orange to achieve arbitrary write and code execution.
SKILL.md
rendered from the published skill — quoted content, verbatim
SKILL: Heap Exploitation — Expert Attack Playbook
> AI LOAD INSTRUCTION: Expert glibc heap exploitation techniques. Covers ptmalloc2 internals, bin structures, tcache mechanics, libc/heap leak methods, and attack selection by glibc version. Distilled from ctf-wiki heap sections, how2heap, and real-world exploitation. Base models often confuse glibc version constraints and miss safe-linking (PROTECT_PTR) introduced in 2.32.
0. RELATED ROUTING
- stack-overflow-and-rop — when the overflow is on the stack rather than the heap
- format-string-exploitation — leak heap/libc addresses via format string
- arbitrary-write-to-rce — convert heap arbitrary write into code execution
- binary-protection-bypass — bypass ASLR/RELRO to use heap write
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 3 files
skills/heap-exploitation/HOUSE_OF_TECHNIQUES.md
skills/heap-exploitation/IO_FILE_EXPLOITATION.md
skills/heap-exploitation/SKILL.md