What problem does it solve? Analyzing a vulnerable binary and choosing the right exploitation path requires juggling protection mechanisms (ASLR, NX, Canary, PIE, RELRO), vulnerability types, and glibc version constraints. This Skill provides a structured six-phase methodology that walks from initial binary triage through protection identification, vulnerability classification, exploit strategy selection, payload development, and testing. ## Core Features & Use Cases - Protection Mechanism Analysis: Decision trees for checksec output covering Stack Canary, NX, PIE, ASLR, and RELRO, with concrete bypass methods for each. - Exploit Strategy Selection: Complete decision trees mapping vulnerability types (stack overflow, format string, heap overflow, UAF) to exploitation strategies (ret2win, ret2shellcode, ROP, ret2libc, SROP, stack pivoting). - In-Depth References: Dedicated guides for heap exploitation (tcache poisoning, fastbin, unsorted bin, House of X), format string attacks, libc version identification, and seccomp sandbox assessment. - Use Case: Given a pwn challenge binary with NX and PIE enabled, follow the methodology to leak a libc address via ROP, identify the remote libc version from the leaked offset, compute system and /bin/sh addresses, and build a ret2libc chain with pwntools. ## Quick Start Analyze the attached binary with checksec, identify its vulnerability type, and build a pwntools exploit script following the binary exploitation methodology.
