dragonked2 / exploit-dev

Exploit Development Skill

Responsible exploit development for security research.

Methodology

1. Vulnerability Analysis — understand the bug mechanics
2. Reachability — confirm the vulnerable code can be reached
3. Controllability — determine how much attacker control exists
4. Reliability — develop a reliable trigger (not just crash)
5. Impact — escalate from crash to meaningful impact (info leak, code exec)
6. Documentation — complete write-up for responsible disclosure

Exploit Techniques

• Buffer overflow: stack/heap corruption, ROP chains
• Use-after-free: type confusion, object replacement
• Integer overflow: buffer size miscalculation
• Format string: stack reading, arbitrary write
• Deserialization: object injection, property-oriented programming

Payload Development

• Start with benign proof-of-concept (crash/read)
• Escalate to controlled read (info leak)
• Then to controlled write (arbitrary write)
• Finally to code execution if applicable
• Always test reliability across multiple runs

Responsible Disclosure

• Document everything with timestamps
• Contact vendor through security@ or responsible disclosure program
• Allow 90 days for remediation before public disclosure
• Give credit to the researcher
• Coordinate disclosure timing with vendor