skills.rest
wgpsec
wgpsecOFFICIAL
Explore all skills by this author →
Website𝕏@wgpsecGitHub

binary-exploitation-tools

Guides selection and usage of debugging, exploitation, and reverse engineering tools for binary analysis.

1.7k|238|Updated Dec 7, 2019
Search Tags:#reverse engineering#Debugging#pwntools#GDB#pwn#binary exploitation#rop gadgets
One-click install
npx skills add https://github.com/wgpsec/AboutSecurity --skill binary-exploitation-tools
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: binary-exploitation-tools
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/exploit/binary/binary-exploitation-tools
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill binary-exploitation-tools

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Choosing and correctly using the right tool for binary vulnerability analysis is difficult given the large ecosystem of debuggers, exploit frameworks, and decompilers. This Skill provides a decision tree and command references so an agent can pick the correct tool for each phase of binary exploitation work.

Core Features & Use Cases

  • Tool Selection Decision Tree: Maps scenarios (debugging, decompiling, exploit development, dynamic tracing, offset calculation) to concrete tools such as GDB/GEF, pwntools, Ghidra, and ROPgadget.
  • Command References: Provides ready-to-use command syntax for GDB/GEF debugging, pwntools exploit scripting, ROP gadget searching, one_gadget lookup, msfvenom shellcode generation, and strace/ltrace dynamic analysis.
  • Use Case: When analyzing a stack overflow in a Linux ELF binary, the agent can follow the workflow to check protections with GEF's checksec, compute the offset with pattern create/search, find gadgets with ROPgadget, and build the exploit chain with pwntools.

Quick Start

Use the binary-exploitation-tools skill to help me debug this ELF binary with GDB and find the ROP gadgets needed to build a pwntools exploit.

Frequently Asked Questions about binary-exploitation-tools

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I choose between GDB with GEF and pwndbg for binary debugging?▼

Both are GDB enhancement plugins with similar commands like checksec and pattern search. GEF offers helpers like format-string-helper and heap-analysis-helper for vulnerability detection, while pwndbg automatically displays registers, stack, and disassembly in its interface.

How do I find the buffer overflow offset in a binary?▼

Generate a unique pattern with GEF's pattern create or msf-pattern_create, crash the program, then use pattern search on the saved RIP value to compute the exact offset. Ghidra's decompiled view also shows stack variable positions like local_bc for offset calculation.

How do I find ROP gadgets in a binary or libc?▼

Use ROPgadget --binary ./binary with filters like --only "pop|ret", or ropper --file ./binary --search "pop rdi". For libc one-shot shells, run one_gadget against the target libc.so.6 to get execve gadgets with their constraints.

Can I debug a remote or embedded binary with GDB?▼

Yes, run gdbserver --multi 0.0.0.0:23947 on the target, then connect from the host with gdb using target remote <ip>:23947. For cross-architecture targets, use gdb-multiarch on the host side.

Why do GDB addresses differ from actual runtime addresses?▼

Environment variables shift stack addresses between GDB and normal execution. Fix this by running unset env LINES, unset env COLUMNS, and set env _=/absolute/path/to/binary inside GDB, and use the same absolute path when running normally.

How do I compile a test binary with all protections disabled?▼

Use gcc -fno-stack-protector -D_FORTIFY_SOURCE=0 -z norelro -z execstack -no-pie -o vuln vuln.c to disable canary, Fortify, RELRO, NX, and PIE. Add -g for debug symbols, and disable ASLR system-wide via /proc/sys/kernel/randomize_va_space.

Related Skills

Explore More Software Engineering Skills→
jd-opensourcejd-opensource
299

pentest-ctf-binary

Analyze binary files to identify memory corruption vulnerabilities and develop exploits.

Official
Advanced
uphiagouphiago
1.1k

docker-privesc

Escalate Docker container privileges to host root access.

Community
Intermediate
258369123258369123
2

ctf-pwn

Identify and exploit memory corruption vulnerabilities in CTF binaries.

Community
Advanced
AcczdyAcczdy
2

performing-fuzzing-with-aflplusplus

Automate coverage-guided fuzzing of compiled binaries with AFL++.

Community
Advanced