Loading...
Loading...
Found 5 Skills
Exploit development expert. Buffer overflow, shellcode, ROP, format strings, binary exploitation. Use for exploit writing and PoC development.
Format string exploitation playbook. Use when printf-family functions receive user-controlled format strings, enabling arbitrary stack reads (%p/%s), arbitrary memory writes (%n/%hn/%hhn), GOT/hook overwrites, and canary/libc/PIE leaks.
Solve CTF binary exploitation challenges by discovering and exploiting memory corruption vulnerabilities to read flags. Use for buffer overflows, format strings, heap exploits, ROP challenges, or any pwn/exploitation task.
Firmware / IoT Penetration Chain. Starting from a .bin / .img file, complete the closed-loop process of reverse engineering → extraction → emulation → exploitation. The methodology follows the OWASP FSTM 9-stage framework; the toolchain mainly includes binwalk v3, unblob, EMBA, Firmadyne, AFL++. Applicable scenarios: Router/camera/smart home firmware auditing, firmware upgrade package reverse engineering, IoT CVE reproduction, embedded 0day vulnerability discovery. Trigger keywords: firmware, firmware, IoT, binwalk, unblob, UART, JTAG, squashfs, UBI, JFFS2, Firmadyne, QEMU full-system emulation, EMBA, firmware penetration, router firmware, embedded vulnerability exploitation, bootloader, NVRAM, FAT, firmware analysis toolkit.
End-to-end engineering approach from reverse engineering to working exploit. Applicable scenarios: You have obtained the binary, vulnerability point, and target environment, and need to write a stable exploit (not a script that only works locally but crashes immediately when used remotely). Covers three major areas: stack overflow / heap exploitation / kernel pwn. Emphasizes the engineering gap between "CTF local success → stable remote execution in real scenarios": libc version mismatch, heap spray timing, SMEP/SMAP/KASLR, stack alignment, remote buffering. Core toolchain: pwntools + GEF/pwndbg + ROPgadget/Ropper + one_gadget + libc-database + qemu-system kernel debugging. Trigger keywords: pwn, stack overflow, heap overflow, ROP, ret2libc, ret2csu, one_gadget, libc-database, heap exploitation, tcache, fastbin, unsorted bin, kernel pwn, kROP, SMEP, SMAP, KASLR, modprobe_path, pwntools, GEF, pwndbg.