Exploit Development

When you've confirmed a vulnerability and need a working PoC, this handles the messy parts of exploitation. It covers classic stack and heap overflows, ROP chain construction with pwntools, format string attacks, and modern heap techniques like tcache poisoning and House of Apple for glibc 2.35+. The mitigation bypass table is solid, mapping each protection (ASLR, DEP, canaries, CFI) to actual techniques. It includes shellcode generation with msfvenom, constraint handling for null-free and alphanumeric payloads, and deserialization exploits across Python pickle, Java ysoserial, and .NET. The quality standards are worth reading: it pushes for 90% reliability and proper documentation of exact versions. This is focused on binary and web exploitation with real code templates, not theoretical concepts.

GitHub stars: 280
last updated: May 28, 2026

View on GitHub

Install

$ npx -y skills add hypnguyen1209/offensive-claude --skill exploit-development --agent claude-code

Installs into .claude/skills of the current project.

Files

Exploit Development

End-to-end weaponization: turn a confirmed bug class into a reliable, version-pinned PoC, then a primitive chain (leak -> R/W -> control flow), against current mitigations. Every cluster pairs the offensive path with detection telemetry and OPSEC.

When to Activate

A confirmed vulnerability needs a working, reliable PoC (>=90% success target).
Userland binary exploitation: stack overflow, heap (UAF/overflow/double-free), format string.
Defeating modern mitigations: ASLR/PIE, NX/DEP, stack canaries, Full RELRO, CFG, Intel CET shadow stack, V8 Sandbox/pointer compression.
Browser/JIT engine exploitation (V8 type confusion, addrof/fakeobj, WASM jump-table pivot).
Local privilege escalation via Linux/Windows kernel memory corruption.
Converting a crash into a stable read/write/execute primitive chain.