Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIDeepSeekDeepSeekMuseMuse+22 more

    Exploit Mitigations: Detect It, Then Plan the Bypass

    1

    You have a primitive and a target that refuses to cooperate, and the real question is which protection is stopping you and what it would take to get past it.

    $9.99

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    Exploit Mitigations: Detect It, Then Plan the Bypass

    Exploit Mitigations: Detect It, Then Plan the Bypass

    Example session with this skill installed

    checksec says my target has NX and full ASLR on, partial RELRO, a stack canary on, and CFG off. I have a stack overflow. What's actually blocking me?

    • Read your context and instructions
    • Compiled the exploit mitigations

    Mitigation assessment: stack overflow on a hardened binary

    Verdict (example run): Two layers block a classic shellcode exploit. Solve ASLR first, because everything downstream needs an address.

    What each protection does here

    ProtectionStateEffect on your overflow
    DEP / NXOnStack shellcode will not execute. Pivot to ROP.
    ASLR / PIEOnNo fixed gadget or libc address. You need a leak.
    Stack canaryOnA linear overwrite trips the canary before return.
    CFGOffIndirect-call checks are not in the way.
    RELROPartialThe GOT is a viable overwrite target.

    Order of operations

    1. Get an info leak to defeat ASLR (format string, OOB read, or an uninitialized pointer).
    2. Leak or brute the canary, or find a write that skips it.
    3. Build a ROP chain against the leaked base. CFG is off, so classic ROP is fine.

    Defensive note

    Turning CFG on and setting full RELRO would remove the GOT target and raise the ROP cost.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    You have a primitive and a target that refuses to cooperate, and the real question is which protection is stopping you and what it would take to get past it. Guess wrong and you waste days on a ROP chain when the actual blocker was a canary. This skill reads the protection set and gives you the order to solve it in.

    What your agent does

    • Fingerprints the target: checksec, Get-ProcessMitigation, dumpbin headers and /proc/cpuinfo, so you know what is actually enforced.
    • Classifies the blocker: memory layout (ASLR/KASLR/PIE), execution (DEP/NX/W^X/ACG), control flow (CFG/XFG/CET/PAC/BTI), or isolation (seccomp, namespaces, VBS).
    • Names the prerequisite: an info leak for ASLR, a valid call target or data-only primitive for CFG/CET, so you solve them in the right order.
    • Keeps bypass work in a lab: it plans chains against an isolated VM that matches the target's exact OS build and hardware flags.
    • Writes the defensive side: each bypass is paired with the hardening that stops it, so a blue team can check posture.

    Built-in guard rails

    • Reads flags, changes nothing: it explains protections from output you provide. Any bypass testing is yours to run in a lab.
    • No secrets needed: it works from checksec output and binary headers.
    • Authorized use only: bypass planning assumes a target you are permitted to test.

    What's inside

    One SKILL.md of about 7,800 words across 16 sections, covering detection and known bypasses for each protection layer, plus a LICENSE.txt.

    Works with Claude Code, Codex, Cursor, and any agent that loads SKILL.md.

    Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for Security.

    It classifies and plans; it does not run bypasses for you. Testing a bypass needs a lab VM that matches the target's exact OS build and hardware flags. Use it only where you are authorized.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before buying a skill.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed 1 day ago

    Software
    Claude Code
    orCodex
    orCursor
    Optional
    checksecGet-ProcessMitigationlab VM matching the target OS build

    Permissions

    Terminal / Shell
    Read Files
    Listed1 day ago

    What's inside

    Frequently Asked Questions

    No. It reads protection flags you provide and explains them. Any bypass testing is yours to do in an isolated lab.

    No. It works from checksec output and binary headers.

    An agent that loads SKILL.md, plus checksec or Get-ProcessMitigation output from your target.

    Yes. Each entry pairs the bypass with the hardening that stops it, so you can check your own posture.

    New in Security