skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

bypassing-binary-exploitation-mitigations

Identifies and bypasses ASLR, PIE, stack canaries, NX, and RELRO during authorized binary exploitation.

954|172|Updated Mar 13, 2026
Search Tags:#exploit development#pwntools#binary exploitation#RELRO#ASLR bypass#ROP chain#stack canary
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill bypassing-binary-exploitation-mitigations
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: bypassing-binary-exploitation-mitigations
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/binary-exploitation/bypassing-binary-exploitation-mitigations
Command: npx skills add https://github.com/xalgord/xalgorix --skill bypassing-binary-exploitation-mitigations

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Modern binaries ship with hardening mitigations (ASLR, PIE, stack canaries, NX/DEP, RELRO) that block naive memory-corruption exploits, and each mitigation must be defeated independently with the correct technique. This Skill provides a systematic methodology to enumerate active protections and select the right bypass for each one during authorized exploitation work.

Core Features & Use Cases

  • Protection Enumeration: Uses checksec, readelf, and /proc/sys/kernel/randomize_va_space to profile RELRO, canary, NX, PIE, and ASLR status before planning the exploit path.
  • Mitigation-Specific Bypasses: Covers address leaks via format strings and ret2plt, byte-by-byte canary brute-forcing on forked servers, ROP/ret2libc/SROP for NX, and GOT overwrite vs. ROP-into-libc decisions based on Partial vs. Full RELRO.
  • Use Case: During an authorized engagement against a forked network service with PIE, canary, NX, and Full RELRO, leak libc via ret2plt, brute-force the canary byte-by-byte using the crash-vs-survive oracle, then finish with a pure ROP-into-libc system("/bin/sh") chain that requires no GOT write.

Quick Start

Ask the AI to run checksec on the target binary and build a mitigation bypass plan for each protection it reports.

Frequently Asked Questions about bypassing-binary-exploitation-mitigations

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I bypass a stack canary in a forked server?▼

Forked servers that call fork() without execve() share the parent's canary across children, so you can brute-force it byte-by-byte using a crash-versus-clean-response oracle, at most 256 tries per byte. Alternatively, leak the canary with a format string and replay it in the overflow.

How to bypass ASLR and PIE in binary exploitation?▼

Leak one code or libc address using a format string read or ret2plt call like puts(puts@got), then compute the base as leak minus the known symbol offset. Verify the leak by checking the base is page-aligned, meaning the low 12 bits are zero.

What is the difference between Partial and Full RELRO exploitation?▼

Partial RELRO leaves .got.plt writable, so GOT overwrites and ret2dlresolve still work. Full RELRO makes the entire GOT read-only via BIND_NOW, forcing you to target libc's GOT, C++ vtables, or use pure ROP-into-libc with no GOT writes.

Why does my leaked canary only show 7 bytes?▼

The canary's least significant byte is always 0x00 on both x86 and x64, and string functions stop at NUL bytes, so a printed leak shows only the 7 random bytes on x64. Account for the NUL LSB when re-inserting the canary into your overflow payload.

Can I use shellcode when NX is enabled?▼

No, NX marks the stack and heap non-executable, so injected shellcode will fault. Use code-reuse techniques like ROP, ret2libc, or ret2syscall instead, or ROP a call to mprotect to make a page RWX and then jump into shellcode placed there.

Related Skills

Explore More Software Engineering Skills→
th3w1zard1th3w1zard1

ctf-pwn

Identify memory corruption vulnerabilities in binary CTF challenges and plan exploits.

Community
Advanced
jinyimeng01jinyimeng01
54

report-agent

Generate HackerOne-format vulnerability reports from validated security findings.

Community
Advanced
riparinoriparino
1

offensive-crash-analysis

Triage Windows and Linux crash dumps to determine exploitability.

Community
Advanced
utsavthakurutsavthakur

symbolic-execution-tools

Automate binary code analysis with angr, Z3, and Unicorn.

Community
Advanced