Individual skill
ctf-pwn
Provides binary exploitation techniques for CTF challenges. Use when you already have a vulnerable native target or service and need to turn memory corruption or low-level primitives into code execution or privilege escalation, such as buffer overflows, format strings, heap bugs, ROP, ret2libc, shellcode, kernel exploitation, seccomp bypass, sandbox escape, or Windows/Linux exploit chains. Do not use it when the main blocker is understanding what the binary does; use reverse engineering first. Do not use it for pure web bugs, disk or packet forensics, or standalone crypto/math challenges.
ctf-pwn/SKILL.md
Source commit a6106aaf5f1f4eeb6b95908f11c2314c7150dfac
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Network or broad shell
- Last checked
- Nov 9, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 3,684
- Repository last updated
- Nov 10, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent-skills Repository topic
- claude-code-skills Repository topic
- ctf Repository topic
- security Repository topic
- claude-code Repository topic
- codex Repository topic
- codex-cli Repository topic
- gemini Repository topic
- gemini-cli Repository topic
- opencode Repository topic
- engineering Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 20,932 bytesSKILL.mdcore · 20,932 bytesSKILL.mdcore · 20,932 bytesSKILL.mdcore · 20,932 bytesSKILL.mdcore · 20,932 bytesSKILL.mdcore · 20,932 bytesSKILL.mdcore · 20,932 bytesSKILL.mdcore · 20,932 bytesSKILL.mdcore · 20,932 bytesadvanced-exploits-2.mddoc · 31,086 bytesadvanced-exploits-3.mddoc · 33,241 bytesadvanced-exploits-4.mddoc · 31,214 bytesadvanced-exploits-5.mddoc · 6,291 bytesadvanced-exploits.mddoc · 35,834 bytesadvanced.mddoc · 14,624 bytesattack-playbook.mddoc · 5,762 bytesfield-notes.mddoc · 26,325 bytesformat-string.mddoc · 33,099 bytesheap-fsop.mddoc · 15,194 bytesheap-techniques-2.mddoc · 20,242 bytesheap-techniques.mddoc · 38,048 byteskernel-bypass.mddoc · 20,050 byteskernel-techniques.mddoc · 19,054 byteskernel.mddoc · 32,764 bytesoverflow-basics.mddoc · 26,821 bytespwnable-tw/3x17.mddoc · 11,534 bytespwnable-tw/README.mddoc · 55,336 bytespwnable-tw/alive_note.mddoc · 14,201 bytespwnable-tw/applestore.mddoc · 14,334 bytespwnable-tw/babyallocator.mddoc · 15,142 bytespwnable-tw/babystack.mddoc · 15,360 bytespwnable-tw/bash.mddoc · 10,520 bytespwnable-tw/bash_revenge.mddoc · 14,569 bytespwnable-tw/bookwriter.mddoc · 13,034 bytespwnable-tw/bounty_program_a.mddoc · 14,395 bytespwnable-tw/bounty_program_b.mddoc · 13,812 bytespwnable-tw/break_out.mddoc · 14,408 bytespwnable-tw/calc.mddoc · 13,538 bytespwnable-tw/caov.mddoc · 13,697 bytespwnable-tw/criticalheap.mddoc · 14,313 bytespwnable-tw/criticalheap_pp.mddoc · 13,593 bytespwnable-tw/de_aslr.mddoc · 15,115 bytespwnable-tw/death_note.mddoc · 13,993 bytespwnable-tw/digimon.mddoc · 14,870 bytespwnable-tw/dubblesort.mddoc · 11,824 bytespwnable-tw/food_store.mddoc · 13,093 bytespwnable-tw/ghost_party.mddoc · 13,471 bytespwnable-tw/hacknote.mddoc · 12,745 bytespwnable-tw/heap_paradise.mddoc · 12,720 bytespwnable-tw/hitcon_ftp.mddoc · 14,047 bytespwnable-tw/kidding.mddoc · 13,633 bytespwnable-tw/mno2.mddoc · 12,799 bytespwnable-tw/omegago.mddoc · 13,878 bytespwnable-tw/orw.mddoc · 12,077 bytespwnable-tw/printable.mddoc · 14,017 bytespwnable-tw/re_alloc.mddoc · 11,873 bytespwnable-tw/re_alloc_revenge.mddoc · 11,756 bytespwnable-tw/seccomptools.mddoc · 12,621 bytespwnable-tw/secret_garden.mddoc · 14,202 bytespwnable-tw/secret_of_my_heart.mddoc · 12,886 bytespwnable-tw/seethefile.mddoc · 12,700 bytespwnable-tw/silver_bullet.mddoc · 14,324 bytespwnable-tw/spirited_away.mddoc · 12,169 bytespwnable-tw/starbound.mddoc · 13,645 bytespwnable-tw/start.mddoc · 10,953 bytespwnable-tw/stupid_boss.mddoc · 13,682 bytespwnable-tw/tcache_tear.mddoc · 12,785 bytespwnable-tw/unexploitable.mddoc · 14,751 bytespwnable-tw/wannaheap.mddoc · 13,177 bytesrop-advanced.mddoc · 33,031 bytesrop-and-shellcode.mddoc · 28,791 bytessandbox-escape.mddoc · 15,428 bytesscripts/fmtstr_payload_suite.pyruns · 3,174 bytesscripts/ret2libc_two_stage.pyruns · 2,571 bytesscripts/seccomp_orw_generator.pyruns · 3,305 bytesscripts/shellcraft_asm.pyruns · 2,776 bytesscripts/srop_execve.pyruns · 2,724 bytesstatic-signals.mddoc · 2,256 bytestools-mcp.mddoc · 12,111 bytes
Read excerpt
# CTF Binary Exploitation (Pwn)
Quick reference for binary exploitation (pwn) CTF challenges. Each technique has a one-liner here; see supporting files for full details.
## Prerequisites
**Python packages (all platforms):**
```bash
pip install "pwntools==4.15.0" "ROPgadget==7.7" "ropper==1.13.13"
# or via script: bash scripts/install_ctf_tools.sh python
```
**uv alternative:**
```bash