Agent skill · security · yaklang
heap-exploitation
Heap exploitation playbook. Use when targeting ptmalloc2/glibc heap vulnerabilities including UAF, double free, overflow, off-by-one/null, and leveraging tcache/fastbin/unsortedbin attacks for arbitrary write or code execution.
Why this skill is useful
Adds detailed exploitation techniques and scripts for targeting specific glibc heap vulnerabilities that are not commonly known.
What it needs
About 5k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Heap Exploitation — Expert Attack Playbook AI LOAD INSTRUCTION: Expert glibc heap exploitation techniques. Covers ptmalloc2 internals, bin structures, tcache mechanics, libc/heap leak methods, and attack selection by glibc version. Distilled from ctf-wiki heap sections, how2heap, and real-world exploitation. Base models often confuse glibc version constraints and miss safe-linking (PROTECTPTR) introduced in 2.32. 0. RELATED ROUTING stack-overflow-and-rop — when the overflow is on the stack rather than the heap format-string-exploitation — leak heap/libc addresses via format string arbitrary-write-to-rce — convert heap arbitrary write into code execution binary-protection-bypass — bypass ASLR/RELRO to use heap write effectively Advanced References HOUSEOFTECHNIQUES.md — House of Force/Spirit/Orange/Einherjar/Roman/Pig/Banana/Cat/Apple and tcache attacks IOFILEEXPLOITATION.md — IOFILE vtable hijack, FSOP, stdout/stdin abuse, exit flow exploitation --- 1. PTMALLOC2 STRUCTURE QUICK REFERENCE mallocchunk Layout (64-bit) Bin Types Bin Size Range (64-bit) Structure LIFO/FIFO --- --- --- --- tcache (per-thread) ≤ 0x410 (7 entries per size) Singly linked (next pointer) LIFO fastbin ≤ 0x80 (default) Singly linked (fd) LIFO unsortedbin Any freed size Doubly linked circular FIFO smallbin < 0x400 Doubly linked circular FIFO largebin ≥ 0x400 Doubly linked + size-sorted Sorted Key Global Structures Structure Location Purpose --- --- --- mainarena libc .data segment Contains bin heads, top chunk, systemmem mp libc .data malloc parameters (tcache settings, mmap threshold) tcacheperthreadstruct Heap (first allocation) Per-thread tcache bins and counts --- 2. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/heap-exploitation