Exploit Development Skill for Claude

Use when turning a memory-corruption bug into a working PoC — stack/ROP, glibc heap & FSOP, format strings, browser/JIT type confusion & UAF, Linux/Windows kernel LPE against ASLR/DEP/CFG/CET/V8-Sandbox

27k tokens

context cost

the whole folder, loaded on every use

files

ships runnable scripts

copies elsewhere

how many repositories repackaged it

334

stars on the repo

on the repository, not the skill itself

Install

one command, takes just this skill from the repository

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill exploit-development

What comes with it

99 681 bytes besides the instruction

references/browser-jit-uaf.md

references/exploit-feasibility.md

references/format-string-leaks.md

references/heap-glibc-fsop.md

references/kernel-exploitation.md

references/stack-rop-mitigations.md

scripts/exploit_context.py

scripts/feasibility_profile.py

scripts/fmtstr_leak.py

scripts/heap_fsop.py

scripts/kernel_lpe_skeleton.c

scripts/offset_finder.py

scripts/rop_autochain.py

scripts/safe_linking.py

scripts/v8_primitives.js

The instruction itself

6 sections, as written by the author

Exploit Development

End-to-end weaponization: turn a confirmed bug class into a reliable, version-pinned PoC, then a primitive chain (leak -> R/W -> control flow), against current mitigations. Every cluster pairs the offensive path with detection telemetry and OPSEC.

When to Activate

A confirmed vulnerability needs a working, reliable PoC (>=90% success target).
Userland binary exploitation: stack overflow, heap (UAF/overflow/double-free), format string.
Defeating modern mitigations: ASLR/PIE, NX/DEP, stack canaries, Full RELRO, CFG, Intel CET shadow stack, V8 Sandbox/pointer compression.
Browser/JIT engine exploitation (V8 type confusion, addrof/fakeobj, WASM jump-table pivot).
Local privilege escalation via Linux/Windows kernel memory corruption.
Converting a crash into a stable read/write/execute primitive chain.

Technique Map

|-----------|--------|-----|-----------|--------|

Quick Start

# 0. Fingerprint target + libc (pin every version)
file ./target; pwn checksec ./target
strings -a libc.so.6 | grep -m1 'release version'   # exact glibc build
patchelf --set-interpreter ./ld.so --replace-needed libc.so.6 ./libc.so.6 ./target

# 1. Crash + offset (cyclic) — see scripts/offset_finder.py
python3 scripts/offset_finder.py ./target            # auto pattern_create/offset

# 2. Gadgets + one_gadget
ROPgadget --binary ./libc.so.6 > gadgets.txt
ropper -f ./libc.so.6 --search 'pop rdi; ret'
one_gadget ./libc.so.6

# 3. Build chain (leak -> base -> system/execve) — scripts/rop_autochain.py
python3 scripts/rop_autochain.py ./target ./libc.so.6 --leak puts --remote host:port

# 4. Heap targets: poison fd with safe-linking math, FSOP for the endgame
python3 scripts/safe_linking.py --chunk 0x55...000 --target 0x7f...   # encrypt fd
python3 scripts/heap_fsop.py --libc ./libc.so.6 --mode apple2         # FSOP payload

# 5. Verify reliability before delivery
for i in $(seq 1 50); do python3 exploit.py >/dev/null 2>&1 && echo ok; done | wc -l

> Cache the target context once. Steps 0–2 (file/checksec/libc build, gadget table,

> one_gadget) describe the *target*, not a single attempt — compute them once and reuse them across

> every PoC iteration. Re-running recon on each attempt wastes budget and pollutes telemetry; an

> autopilot loop should treat the fingerprint + gadget set as cached input, not a per-iteration step.

> A future empirical feasibility profile (raptor-adoption PR-3) will rebuild the crash witness

> under several mitigation profiles and emit a machine-readable map of which techniques the target

> actually permits — the PoC is then forbidden from using a technique that map marks blocked. Until

> it lands: record the checksec/mitigation state explicitly and do not claim a technique the target's

> protections rule out.

OPSEC & Detection (summary)

|-----------|---------------|-----------------------|------------|

| ROP/ret2libc | Stack exec faults, abnormal execve("/bin/sh") child of network daemon | EDR: child shell from listener; auditd execve of /bin/sh w/ empty argv | Use in-memory ORW (open/read/write flag) instead of shell to avoid execve IOC |

| Heap/FSOP | glibc * stack smashing */malloc(): ... aborts in logs; SIGABRT crash loops | Sigma: repeated SIGABRT/SIGSEGV from same PID; coredump bursts | Disable coredumps (prctl(PR_SET_DUMPABLE,0)); tune spray to avoid abort()s |

| Format string | %n/%p strings in request/argv logs; segfault on bad write | WAF/Sigma on %n,%[0-9]+\$n in inputs | Pre-stage write target; minimize % count, avoid huge field widths |

| V8 type confusion | Renderer crash dumps, chrome_crashpad, GPU/renderer restarts | Crashpad telemetry; EDR on renderer spawning unexpected processes | Keep corruption inside cage; clean up sprayed arrays; avoid renderer crash on failure |

| Kernel LPE | dmesg oops/RIP, KASAN splats, apparmor/audit LPE child = root | Sigma: process gaining uid=0 w/o setuid path; EDR kernel-callback | Fileless (no SUID drop); restore corrupted state; clear dmesg only if authorized |

Deep Dives

references/stack-rop-mitigations.md — Stack overflow, ret2libc/ROP, ret2csu, SROP, stack pivots, ret2dlresolve; defeating ASLR/PIE/NX/canary/RELRO and CET shadow stack / CFG-aware constraints. Backed by offset_finder.py, rop_autochain.py.
references/heap-glibc-fsop.md — glibc 2.35-2.40 internals, tcache/fastbin poisoning under safe-linking, House of Botcake/Einherjar/Apple 2/Tangerine, stdout FSOP leak, post-hook-removal endgames. Backed by safe_linking.py, heap_fsop.py.
references/format-string-leaks.md — Read/write mechanics, stack-arg indexing, %n arbitrary write, PIE/libc/canary leaks, fmtstr automation and one-shot GOT/exit-handler overwrite. Backed by fmtstr_leak.py.
references/browser-jit-uaf.md — V8 element-kind confusion, addrof/fakeobj, arbitrary R/W under pointer compression, 2024-2025 Maglev/TurboFan CVEs, V8 Sandbox escape via WASM jump table, generic UAF reclaim. Backed by v8_primitives.js.
references/kernel-exploitation.md — Linux UAF/cross-cache, Dirty Pagetable/Pagedirectory (CVE-2024-1086), msg_msg leak/spray, SLUBStick; Windows pool spray, PreviousMode + I/O Ring R/W, CLFS/AFD CVEs. Backed by kernel_lpe_skeleton.c.
references/exploit-feasibility.md — empirical mitigation matrix: rebuild the crash witness under permissive/distro/hardened/asan profiles, record which still fire, derive the blocked-technique map; /exploit is forbidden a technique the map marks blocked. Backed by feasibility_profile.py (build/replay, Linux/devcontainer) + exploit_context.py (cached checksec/libc + the assert_allowed gate). Pairs with reverse-engineering/references/rr-time-travel.md + coverage-reachability.md.

Other skills for the same job

different authors, same section of the catalogue

Backend Security Coder

by ComeOnOliver

×2

Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.

5k tokens

Cloud Penetration Testing

by ComeOnOliver

×2

This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources", "exploit cloud misconfigurations", "test O365 security", "extract secrets from cloud environments", or "audit cloud infrastructure". It provides comprehensive techniques for security assessment across major cloud platforms.

16k tokens

Codebase Cleanup Deps Audit

by ComeOnOliver

×2

You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.

Comprehensive Flow Nexus platform management - authentication, sandboxes, app deployment, payments, and challenges

14k tokens

Linux Privilege Escalation

by ComeOnOliver

×2

This skill should be used when the user asks to "escalate privileges on Linux", "find privesc vectors on Linux systems", "exploit sudo misconfigurations", "abuse SUID binaries", "exploit cron jobs for root access", "enumerate Linux systems for privilege escalation", or "gain root access from low-privilege shell". It provides comprehensive techniques for identifying and exploiting privilege escalation paths on Linux systems.

Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification. Handles static/dynamic analysis, unpacking, and IOC extraction. Use PROACTIVELY for malware triage, threat hunting, incident response, or security research.

This skill should be used when the user asks to "use Metasploit for penetration testing", "exploit vulnerabilities with msfconsole", "create payloads with msfvenom", "perform post-exploitation", "use auxiliary modules for scanning", or "develop custom exploits". It provides comprehensive guidance for leveraging the Metasploit Framework in security assessments.

7k tokens

Mobile Security Coder

by ComeOnOliver

×2

Expert in secure mobile coding practices specializing in input validation, WebView security, and mobile-specific security patterns. Use PROACTIVELY for mobile security implementations or mobile security code reviews.

6k tokens

How to use it

Copy the folder

Take hypnguyen1209/exploit-development from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.