ctf-pwn

Trace data flow and exploit memory corruption in CTF pwn challenges.

Updated Aug 23, 2026

Search Tags:#ctf #vulnerability analysis #rop #binary exploitation #format string #heap exploitation #exploit planning

Ready to run

npx skills add https://github.com/3xecutablefile/opencode-rev-forensics --skill ctf-pwn-3xecutablefile

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ctf-pwn
Source: https://github.com/3xecutablefile/opencode-rev-forensics/tree/main/skills/ctf-pwn
Command: npx skills add https://github.com/3xecutablefile/opencode-rev-forensics --skill ctf-pwn-3xecutablefile

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you systematically break down CTF pwn challenges by finding memory-corruption vulnerabilities and turning them into working exploits that read the flag.

Core Features & Use Cases

Vulnerability-first exploitation workflow: Traces attacker-controlled input through data flow, memory safety assumptions, and control-flow impact.
Stack and heap reasoning: Guides buffer/offset analysis for stack overflows and chunk/pointer lifecycle analysis for heap bugs (UAF, double-free, heap overflow).
Multi-primitive planning: Supports common exploitation primitives such as leaks, arbitrary read/write, ret2libc, and ROP, including protection-aware bypass planning.

Quick Start

Use the ctf-pwn skill to analyze a pwn binary by identifying the input-to-vulnerability path, estimating offsets and nearby targets, and planning the exploit steps to reach flag retrieval.

Frequently Asked Questions about ctf-pwn

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I exploit memory corruption vulnerabilities like stack overflows to get a flag?▼

Exploit memory corruption vulnerabilities by tracing attacker-controlled input through data flow to identify buffer overflows, then estimating offsets and planning exploit steps to retrieve the flag.

What is the best way to plan an exploit for heap vulnerabilities and use-after-free bugs?▼

Plan heap exploitation by analyzing chunk and pointer lifecycle data flow to identify use-after-free or double-free bugs, then selecting exploitation primitives like arbitrary write to recover the flag.

How do I bypass protection states when developing binary exploitation primitives?▼

Bypass protection states during binary exploitation by applying protection-aware strategy planning to select appropriate primitives such as ret2libc, ROP, or format string leaks for reliable control-flow hijacking.

Can I use this to analyze format string bugs for arbitrary read and write operations?▼

Yes, you can analyze format string bugs by tracing attacker-controlled input to verify memory safety assumptions, enabling you to plan arbitrary read/write primitives for flag retrieval.

How do I find the correct offsets and nearby targets for a CTF pwn challenge?▼

Find correct offsets and nearby targets by systematically reasoning about memory layout, tracing data flow from input to vulnerability, and estimating buffer distances to nearby control-flow targets.

Why does my exploit fail against integer-overflow driven memory corruption?▼

Exploits for integer-overflow driven memory corruption fail when protection-aware strategy planning is incomplete, requiring systematic data-flow tracing to verify the exact memory safety assumptions and primitive selection.