---
name: exploit-development
description: Turn a known vulnerability into a reproducible PoC or reliable authorized exploit, including stack/heap/kernel pwn, patch-diff analysis, exploit chains, fuzzing, and remote-environment stabilization.
allowed-tools: Read Grep Glob Bash Edit Write TaskCreate TaskList TaskUpdate
---

# Exploit development

Read `${UR_PLUGIN_ROOT}/UR-INTEGRATION.md`. Active execution requires a currently approved scope; local code authoring and artifact analysis do not.

## Workflow

1. State the vulnerability primitive and evidence: corruption/control, read/write capability, authentication boundary, reachable input, affected versions, and reliability constraints.
2. Reproduce with the smallest deterministic trigger. Capture build/version, mitigations, crash state, registers, stack/heap evidence, and sanitizer/debugger output.
3. Select a strategy from the actual mitigations and environment: controlled crash, info leak, ROP/JOP, ret2libc, heap primitive, race stabilization, sandbox escape boundary, or kernel primitive.
4. Separate stages: trigger → primitive → control → payload/effect → cleanup. Test each stage independently.
5. Parameterize target-specific values. Detect versions and fail closed on mismatch; do not silently spray or broaden targets.
6. For patch diffing, compare vulnerable/fixed paths, identify the invariant introduced by the patch, create a non-destructive regression PoC, then assess exploitability.
7. Stabilize for the approved environment: transport buffering, timeouts, ASLR leaks, libc/build IDs, stack alignment, heap grooming, retries with bounded rates, and observable failure modes.
8. Deliver source, exact invocation, expected output, limitations, impact, detection ideas, and remediation/regression tests.

Use destructive effects only when explicitly requested, within an owned/lab scope, and after the specific tool action is approved. Prefer proof markers over persistent shells when either demonstrates impact.