pwn-chain
Go from reverse engineering to a working exploit: stack/heap/kernel pwn workflows with pwntools, libc-database, ROP, and stabilization from CTF to authorized remote targets.
⚠️ AUTHORIZED USE ONLY
This skill is for educational purposes or authorized security assessments only.
You must have explicit, written permission from the system owner before using this tool.
Misuse of this tool is illegal and strictly prohibited.
Mandatory confirmation gate
Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
1. Ask the user to state the exact target URL, IP, account, or resource.
2. Ask the user to confirm written authorization and the permitted scope.
3. Show the exact command(s) and explain their expected effect.
4. Wait for explicit confirmation in the current conversation.
Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
When to Use
- A binary vulnerability is understood and needs a reliable exploit.
- Porting a CTF-style exploit to an authorized real-world target.
适用范围
当任务属于以下场景时使用本 skill：
- 拿到二进制 + 已知漏洞点 — 静态/审计/fuzz 已经找到溢出/UAF/double free，需要从触发到拿 shell
- CTF 题已经本地通了，远程打不通 — 远端环境差异导致脚本失效，需要稳定化
- 真实目标的二进制利用 — SRC / 红队场景下，已经识别到内存损坏漏洞，需要构造 RCE
- Linux 内核驱动的 ioctl bug — 用户态触发，目标是提权到 root
前提：你已经知道"哪里炸了"。本 skill 不负责发现漏洞（那是 fuzzing / 审计），只负责"从漏洞点写出 exploit"。
与其他 skill 的分工
| 场景 | 用什么 |
|---|---|
| 识别 custom VM / |
Subscribers only
The full skill, its 4 bundled files and every download is included with every paid Complete AI plan.
Details
| Source | zhaoxuya520/reverse-skill |
|---|---|
| License | MIT |
| Risk label | offensive ("critical" means the skill may run commands or touch files — read before use) |
| Files | SKILL.md, references/heap-pwn.md, references/kernel-pwn.md, references/stack-pwn.md |
| Added | 2026-08-25 |
Related skills
accesslint-diff
Diff a live page's accessibility violations against a baseline — by default compares uncommitted changes (stash-based), or pass --branch [<name>] to diff against a branch. Reports only new violations introduced, violations fixed, and pre-existing count. Use `scan` for a full audit with no diffing.
accesslint-scan
Audit a live page for accessibility issues, locate each WCAG violation precisely, and return a selector-grounded fix worklist without editing.
accint-commitments
Triage acc's open promises and close them with honest real-world verdicts via acc_act(runtime="outcome").
accint-frames
Drain acc's deliberation queue — open/waiting brain_frames checkpointed by headless runs — via acc_act(runtime="continue").
accint-solve
Route a goal through acc's scored-memory loop via acc_act(runtime="solve"); deliberate any returned brain_frame and submit via continue.
ad-creative
Create, iterate, and scale paid ad creative for Google Ads, Meta, LinkedIn, TikTok, and similar platforms. Use when generating headlines, descriptions, primary text, or large sets of ad variations for testing and performance optimization.