leak

Name: leak
Availability: InStock
Author: dcbz

Extract libc, heap, and module base addresses via controlled out-of-bounds reads.

1|Updated Apr 5, 2026

Search Tags:#memory #deterministic #heap #exploit #address #leak #grooming

Ready to run

npx skills add https://github.com/dcbz/exploit_skillz --skill leak

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: leak
Source: https://github.com/dcbz/exploit_skillz/tree/main/sequential/leak
Command: npx skills add https://github.com/dcbz/exploit_skillz --skill leak

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Leverage a repeatable leak primitive to reliably reveal libc, heap, or module base addresses using controlled out-of-bounds reads aligned with a groomed heap, without crashing the process.

Core Features & Use Cases

Deterministic heap-layout-driven leaks enabling precise address disclosure
Supports leaks of libc base, heap base, and module bases in restartable environments
Safe, non-crashing techniques suitable for lab testing and research scenarios

Quick Start

Develop a repeatable leak primitive that deterministically reveals the target addresses in a restartable heap.

Frequently Asked Questions about leak

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I leak libc base addresses using out-of-bounds reads?▼

You can leak libc base addresses by applying controlled out-of-bounds reads within a deterministically groomed heap. This requires allocating and freeing chunks to align the overflow adjacent to a target object for safe, non-crashing address disclosure.

What is heap grooming for deterministic memory leaks?▼

Heap grooming for deterministic memory leaks is the process of creating a repeatable heap layout by allocating and freeing chunks. This controlled arrangement places overflow primitives adjacent to target objects, enabling reliable extraction of critical base addresses.

Can I extract heap base addresses without crashing the process?▼

Yes, you can extract heap base addresses without crashing the process by using safe leakage reads. This technique aligns controlled out-of-bounds reads with a groomed heap to reveal pointers while avoiding memory access violations that cause crashes.

Do I need a heap grooming primitive to perform reliable address leaks?▼

Yes, you need a heap grooming primitive to perform reliable address leaks. This prerequisite allows you to deterministically allocate and free chunks, establishing the exact heap layout required to position overflows adjacent to target objects for successful extraction.

What is the best way to reveal module bases in a restartable environment?▼

The best way to reveal module bases in a restartable environment is to develop a repeatable leak primitive. By leveraging deterministic heap layouts and controlled out-of-bounds reads, you can safely extract module bases during debugging and validation workflows.

When should I use out-of-bounds reads for exploit development?▼

You should use out-of-bounds reads for exploit development when you need to identify exact memory addresses like libc or heap bases. This approach is suited for research workflows and training scenarios where deterministic heap layouts can be safely groomed to reveal critical pointers.