Skill

pwn-chain

skill:zhaoxuya520/reverse-skill#pwn-chain

从逆向走到可用利用 (Working Exploit) 的全链路工程化方法。适用场景：拿到了二进制 + 漏洞点 + 目标环境，需要写出一个能稳定打通的 exploit（不是只能本地复现一下、远程一打就崩的脚本）。覆盖三大方向：栈溢出 / 堆利用 / 内核 pwn。强调"CTF 本地通 → 真实远程稳定打通"的工程差距：libc 版本错配、堆喷射时序、SMEP/SMAP/KASLR、栈对齐、远程缓冲。核心工具链：pwntools + GEF/pwndbg + ROPgadget/Ropper + one_gadget + libc-database + qemu-system 内核调试。触发关键词：pwn、栈溢出、堆溢出、ROP、ret2libc、ret2csu、one_gadget、libc-database、堆利用、tcache、fastbin、unsorted bin、kernel pwn、kROP、SMEP、SMAP、KASLR、modprobe_path、pwntools、GEF、pwndbg。

skills.sh SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 21:15 UTC at cab634b

findings

—

highest severity

threat classes

632

files scanned

0/12,291

checks satisfied

package advisories

Why this verdict

suspicious: floor fact PY-DECODED-DIRECTIVE (DET:1db51ba070ae8fdf)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:445751c13a899144)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:512afd519be3a5c3)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:69285b5dd3004f4c)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:6ad5f59dbc7d2082)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:99c00191afa001fb)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:a210e3011e109399)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:b170bfd31ea17eaf)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:b4d25e56a0df669b)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:e24064735db3dc45)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:e9883ac07f0f5470)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:07bbe9122d1f6ca7)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:109c7dca8814101a)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:1126f491cde8204d)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:11d03ed5df0cd7d7)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:1ad2f0de1c274efb)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:1bed18b55685e470)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:205be125577d001b)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:298451b81f4e470e)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:298aa9a06bd71661)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:2b50857c3269117a)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:3572a6b054983195)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:3c616a89c16c192a)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:3d1a9875c7759c54)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:413198c9168eac16)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:421b9b961d92ea78)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:4673a6be4d8d0abb)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:4846925366dab0dd)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:4fc491f833b59f1c)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:529030ebf22e4647)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:55dc8222e535ffd9)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:583c788642dfb923)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:59e45aa4ae213bce)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:6db7076809f9c97c)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:744658cad4329fb0)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:79e9cf14d729e4ae)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:80bd8c0eaa66bcb9)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:8194eda02104d09d)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:85b590d5544dbedf)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:90464416d044ce56)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:92ac21d06b681fe0)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:958692397bae7183)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:984a1d9b733b9282)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:9ca922d0a0f3a722)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:9f6107657fdda565)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:a6219ae2391b77b7)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:aa8b388acae59965)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:b5ee0ce711f25b8e)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:b8c5b33e83b34260)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:bcf0dfc72479c85d)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:be145326e3353048)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:c2b4923077656638)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:ca9e90734e96ada5)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:cb19be356225a28d)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:cc5accf8f3964a5b)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:cf81987540c27406)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:d552ccf6c9f1947c)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:f049a845ea69b19a)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:f892c368b762c070)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:f93ce294f2ae98e0)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:fe86d1ea951460ae)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:ffcd7b114b4ce05a)

Security findings 0

No individual findings recorded

The suspicious verdict rests on the coverage gaps below.

Coverage gaps 12523

Parts of the artifact the static analysis could not fully examine.

context:unanalyzable_binary binary content is only byte-scanned

skills/pentest-tools/src-hunter/references/payloader/by-category/web/文件漏洞.md

context:unanalyzable_binary binary content is only byte-scanned

skills/pentest-tools/src-hunter/references/payloader/by-category/web/请求走私.md

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/cli/CommandLineArgumentException.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/cli/CommandLineOption.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/cli/CommandLineParser$AfterOptions.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/cli/CommandLineParser$BeforeFirstSubCommand.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/cli/CommandLineParser$KnownOptionParserState.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/cli/CommandLineParser$MissingOptionArgState.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/cli/CommandLineParser$OptionAwareParserState.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/cli/CommandLineParser$OptionParserState.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/cli/CommandLineParser$OptionString.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/cli/CommandLineParser$ParserState.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/cli/CommandLineParser$UnknownOptionParserState.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/cli/CommandLineParser.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/cli/ParsedCommandLine.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/cli/ParsedCommandLineOption.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/internal/file/PathTraversalChecker.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/internal/file/locking/ExclusiveFileAccessManager.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/util/internal/WrapperDistributionUrlConverter.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/wrapper/BootstrapMainStarter$1.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/wrapper/Download$DefaultDownloadProgressListener.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/wrapper/Download$ProxyAuthenticator.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/wrapper/Download.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/wrapper/GradleUserHomeLookup.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/wrapper/GradleWrapperMain.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/wrapper/Install$1.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/wrapper/Install$InstallCheck.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/wrapper/Install.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/wrapper/Logger.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/wrapper/PathAssembler.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/wrapper/SystemPropertiesHandler.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/wrapper/WrapperConfiguration.class

unanalyzable_binary java_class content is only byte-scanned

burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/wrapper/WrapperExecutor.class

unanalyzable_binary binary content is only byte-scanned

skills/pentest-tools/src-hunter/references/payloader/waf-bypass.md

unanalyzable_binary binary content is only byte-scanned

skills/pentest-tools/src-hunter/references/playbooks/file-upload.md

unanalyzable_binary binary content is only byte-scanned

skills/pentest-tools/src-hunter/references/playbooks/http-smuggling.md

frontmatter_unparseable while parsing a block mapping

skills/field-journal/2026-05-16_pentest-personalblog-fun-mass-assignment.md

no_dataflow_for_batch batch file: string-literal extraction only

burp-mcp-full/build.bat

no_dataflow_for_batch batch file: string-literal extraction only

burp-mcp-full/gradlew.bat

no_dataflow_for_java java file: string-literal extraction only

burp-mcp-full/src/main/java/com/burpmcp/BurpMcpExtension.java

no_dataflow_for_java java file: string-literal extraction only

burp-mcp-full/src/main/java/com/burpmcp/McpHttpServer.java