basic-exploitation

Teaches foundational Linux binary exploitation techniques including ROP chains, ret2libc, and shellcode injection.

Updated Jun 26, 2026
One-click install
npx skills add https://github.com/brukal001/brukal --skill basic-exploitation-brukal001
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: basic-exploitation
Source: https://github.com/brukal001/brukal/tree/main/skills/claude-red/exploit-dev/offensive-basic-exploitation
Command: npx skills add https://github.com/brukal001/brukal --skill basic-exploitation-brukal001

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pwntools, ropgadget.

What problem does it solve? Learning binary exploitation requires a structured, hands-on methodology that is hard to assemble from scattered resources. This Skill provides a complete Week 5 curriculum for foundational exploitation on Linux with mitigations disabled, guiding you from environment setup through working proof-of-concept exploits. ## Core Features & Use Cases - Structured Exploitation Methodology: Step-by-step labs covering stack buffer overflows, EIP/RIP control, offset discovery with cyclic patterns, and return address overwrites on AMD64. - pwntools and GDB Workflows: Ready-to-use exploit templates using pwntools (ELF analysis, ROP gadget finding, shellcraft) and pwndbg debugging techniques. - Mitigation Fundamentals: Compiler flag profiles and explanations for ASLR, NX, stack canaries, and RELRO, preparing you for bypass techniques in later weeks. - Use Case: You are working through a pwn CTF challenge or exploit development course and need to build your first ret2shellcode exploit against a vulnerable binary—activate this Skill to get the full checklist, code templates, and debugging workflow. ## Quick Start Walk me through exploiting a stack buffer overflow in my vulnerable AMD64 Linux binary using pwntools, from finding the offset to getting a shell.

Frequently Asked Questions about basic-exploitation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit a stack buffer overflow on Linux with pwntools?▼

Find the offset to the return address using a cyclic pattern, then overwrite it with a jmp rsp gadget address followed by shellcode. The curriculum provides complete pwntools templates using process(), p64(), and shellcraft.amd64.linux.sh() to build and send the payload.

How to find the buffer overflow offset in a binary?▼

Generate a cyclic pattern with pwntools, send it to crash the program, then use pwndbg's cyclic -l command on the value at RSP to calculate the exact offset. For a 64-byte buffer on AMD64, the offset is typically 72 bytes including the saved RBP.

What compiler flags disable Linux binary protections for exploitation practice?▼

Use -fno-stack-protector to disable canaries, -no-pie to disable PIE, -z execstack to disable NX, and -fcf-protection=none to disable CET. The included Makefile provides training profiles for shellcode, ROP, and RELRO exercises.

Does this exploitation curriculum work on 32-bit x86 binaries?▼

The curriculum targets AMD64 (x86-64) exclusively, using 8-byte addresses, the System V AMD64 calling convention with RDI/RSI/RDX registers, and the syscall instruction. 32-bit techniques like int 0x80 and stack-based arguments are not covered.

Why does my shellcode fail when using hardcoded stack addresses?▼

Stack addresses vary between GDB and normal execution due to environment variables and terminal differences. Use a jmp rsp or call rsp gadget instead, since RSP reliably points to your controlled data right after the ret instruction executes.

Should I disable ASLR system-wide for exploitation labs?▼

No, keep ASLR enabled system-wide for security. Disable it only per-process using setarch x86_64 -R, GDB's set disable-randomization on, or pwntools' process('./binary', aslr=False) for deterministic lab addresses.