exploit-analysis

Files (1)

• SKILL.md

SKILL.md (first lines)

# Exploit Analysis

Develop proof-of-concept exploits from vulnerability findings.

## When to use

- "write a PoC for this vulnerability"
- "exploit this bug"
- "can this be exploited?"
- "what's the impact of this finding?"
- "escalate from X to code execution"
- "reverse engineer this binary"

## Methodology

### Step 1 — Understand the bug

```
read_file on the vulnerable code path (full trace)
search_files for all callers and data sources
Map: user input → sanitization → sink
```

### Step 2 — Research

```
web_search for similar CVE + "exploit" / "PoC"
web_search for the vulnerability class + "exploit technique"
Check exploit-db, GitHub for reference exploits
```

### Step 3 — Minimal reproduction

```
execute_python with minimal code to trigger the bug
Start simple: crash first, then control
Document exact preconditions
```

### Step 4 — Escalate

| From | To | Technique |
|------|----|-----------|
| Crash | Controlled crash | Adjust input size/alignment |
| Controlled crash | RIP/EIP control | Find offset to return address |
| RIP control | Code execution | ROP chain / shellcode |
| SQL error | Data extraction | UNION injection, error-based, blind |
| XSS | Session theft | Cookie exfiltration payload |
| SSRF | Internal access | AWS metadata / internal API calls |
| Path traversal | File read | /etc/passwd → source code → secrets |
| File upload | RCE | PHP shell, polyglot payloads |

### Step 5 — Document

```markdown
## Exploit: <title>

### Vulnerability
- CWE: <id>
- File: <path:lines>
- Root cause: <one sentence>

### Preconditions
- <list>

### Exploit Steps
1. ...
2. ...
3. ...

### PoC Code
```python
# Working exploit
```

### Impact
- Confidentiality: <high/medium/low>
- Integrity: <high/medium/low>
- Availability: <high/medium/low>

### Remediation
- <specific fix>
```

## Binary exploitation

When target is a binary:

```
analyze_binary(deep=True) — get sections, strings, security features
Check: PIE, NX, Stack Canary, RELRO, FORTIFY
execute_shell with gdb/radare2 if available
Find: buffer overflows, format strings, use-after-free, integer overflows
```

## Safety

- NEVER run exploits against targets you don't own
- Use local test environments (Docker, VMs)
- Document the exploit; don't weaponize beyond PoC
- Provide the fix alongside the exploit

From freire19/Mythos, MIT.

More from freire19/Mythos