exploit-development

name	exploit-development
description	Use when turning a memory-corruption bug into a working PoC — stack/ROP, glibc heap & FSOP, format strings, browser/JIT type confusion & UAF, Linux/Windows kernel LPE against ASLR/DEP/CFG/CET/V8-Sandbox
metadata	{"type":"offensive","phase":"exploitation","tools":"pwntools, gdb-gef, pwndbg, radare2, ropper, ROPgadget, one_gadget, angr, d8, WinDbg, IDA","mitre":["T1203","T1068","T1211","T1212","T1055"]}
kill_chain	{"phase":["weaponize","exploit"],"step":[2,4],"attck_tactics":["TA0042","TA0002","TA0004"],"attck_techniques":["T1203","T1068","T1211","T1212","T1055.012"]}
depends_on	["recon-osint","vulnerability-analysis"]
feeds_into	["edr-evasion","shellcode-dev","initial-access","privesc-linux","privesc-windows"]
inputs	["vulnerability_list","attack_surface_map","crash_corpus","target_versions"]
outputs	["exploit_poc","payload","primitive_chain","finding_record"]
references	["references/stack-rop-mitigations.md","references/heap-glibc-fsop.md","references/format-string-leaks.md","references/browser-jit-uaf.md","references/kernel-exploitation.md","references/exploit-feasibility.md"]
scripts	["scripts/rop_autochain.py","scripts/offset_finder.py","scripts/heap_fsop.py","scripts/safe_linking.py","scripts/fmtstr_leak.py","scripts/v8_primitives.js","scripts/kernel_lpe_skeleton.c","scripts/exploit_context.py","scripts/feasibility_profile.py"]

Exploit Development

End-to-end weaponization: turn a confirmed bug class into a reliable, version-pinned PoC, then a primitive chain (leak -> R/W -> control flow), against current mitigations. Every cluster pairs the offensive path with detection telemetry and OPSEC.

When to Activate

• A confirmed vulnerability needs a working, reliable PoC (>=90% success target).
• Userland binary exploitation: stack overflow, heap (UAF/overflow/double-free), format string.
• Defeating modern mitigations: ASLR/PIE, NX/DEP, stack canaries, Full RELRO, CFG, Intel CET shadow stack, V8 Sandbox/pointer compression.
• Browser/JIT engine exploitation (V8 type confusion, addrof/fakeobj, WASM jump-table pivot).
• Local privilege escalation via Linux/Windows kernel memory corruption.
• Converting a crash into a stable read/write/execute primitive chain.

Technique Map

Technique	ATT&CK	CWE	Reference	Script
Stack overflow -> ret2libc/ROP	T1203	CWE-121	references/stack-rop-mitigations.md	scripts/offset_finder.py
ret2csu / SROP / stack pivot	T1203	CWE-121	references/stack-rop-mitigations.md	scripts/rop_autochain.py
ret2dlresolve (leakless)	T1203	CWE-121	references/stack-rop-mitigations.md	scripts/rop_autochain.py
CET/CFG-aware control-flow hijack	T1203	CWE-1419	references/stack-rop-mitigations.md	scripts/rop_autochain.py
tcache/fastbin poisoning + safe-linking	T1203	CWE-416	references/heap-glibc-fsop.md	scripts/safe_linking.py
House of Botcake / Einherjar / Apple2	T1203	CWE-415	references/heap-glibc-fsop.md	scripts/heap_fsop.py
FSOP (stdout leak, House of Apple 2)	T1203	CWE-787	references/heap-glibc-fsop.md	scripts/heap_fsop.py
Format string leak + arbitrary write	T1203	CWE-134	references/format-string-leaks.md	scripts/fmtstr_leak.py
V8 type confusion -> addrof/fakeobj