▸case-01 I am writing a Python exploit script for an ELF binary `vuln_app` that needs to execute locally during development and connect to IP `192.168.1.50` on port `1337` in production. A junior developer suggested using Python's built-in `subprocess.Popen` for local execution and `socket.socket` for the remote target, wrapping both in custom wrapper functions. Provide a Python script structure that unifies local binary execution and remote network socket communication under a single standard tube abstraction. | pass→pass | 18,577 | 22,739 | +22% | 1 | 1 | 0% | 2,484 | 2,276 | -8% | 0 | 0 | — |
▸case-02 When exploiting a stack overflow in target binary `stack_check`, I need to determine the exact number of padding bytes before the return address overwrite. The current approach team members use is sending 100 'A's, then 110 'A's, and stepping through GDB manually to guess the offset. Provide a Python code snippet demonstrating an automated method for generating a pattern and looking up the exact offset using the crash address `0x6161616c`. | fail→fail | 17,978 | 23,738 | +32% | 1 | 1 | 0% | 1,397 | 1,450 | +4% | 0 | 0 | — |
▸case-03 I am writing a ROP exploit against target ELF binary `router_firmware` where ASLR is disabled but system addresses vary between OS builds. Someone suggested hardcoding raw hexadecimal addresses like `0x400686` found in objdump directly into a byte string concatenation. Provide a Python script snippet that dynamically resolves binary symbol addresses like PLT entries and automatically constructs a ROP chain payload. | pass→fail | 11,629 | 14,001 | +20% | 1 | 1 | 0% | 1,783 | 1,274 | -29% | 0 | 0 | — |
▸case-04 In an exploit for a 64-bit Linux ELF binary `notes_mgr`, we need an execve `/bin/sh` shellcode payload. A colleague provided a raw hex string copied from a 2012 blog post, but it keeps crashing due to subtle architecture mismatches. Write a Python snippet that configures the target architecture context explicitly and programmatically generates clean Linux x86_64 shellcode. | pass→fail | 15,291 | 15,028 | -2% | 1 | 1 | 0% | 1,927 | 1,365 | -29% | 0 | 0 | — |
▸case-05 During exploit development for ELF binary `auth_daemon`, I need to pause process execution right before sending the payload and open GDB to inspect stack memory. Currently, I run the Python script, open a second terminal, run `ps aux | grep auth_daemon`, copy the PID, and run `sudo gdb -p PID`. Provide a Python script snippet that automatically launches GDB attached to the target process directly from Python. | pass→pass | 11,088 | 13,504 | +22% | 1 | 1 | 0% | 1,659 | 1,939 | +17% | 0 | 0 | — |
▸case-06 I successfully triggered a remote shell in target binary `network_service`, but my Python script exits immediately after sending the payload, closing the connection before I can run shell commands. A peer recommended writing a custom `while True:` loop in Python with `select.select()` reading `sys.stdin` and writing to `sock.send()`. Provide a Python code snippet showing the standard mechanism to hand over shell control to the user's terminal. | fail→pass | 30,974 | 26,398 | -15% | 1 | 1 | 0% | 3,684 | 3,086 | -16% | 0 | 0 | — |
▸case-07 In target binary `string_filter`, the input buffer terminates on null bytes (`\x00`) and newlines (`\x0a`), but our shellcode payload contains multiple `\x00` bytes. A teammate suggested manually writing custom XOR loop assembly wrappers to encode the binary payload by hand. Provide a Python script snippet that programmatically encodes shellcode while specifying bad characters to exclude. | pass→fail | 12,235 | 29,134 | +138% | 1 | 1 | 0% | 2,342 | 1,231 | -47% | 0 | 0 | — |
▸case-08 To construct a ROP chain for Linux x86_64 binary `parser_bin`, I need to find a `pop rdi; ret` gadget address. A developer suggested running `objdump -d parser_bin | grep -B 2 ret` and manually sifting through thousands of lines of assembly output. Provide a Python script snippet or command line approach that parses the ELF binary and locates gadgets automatically. | fail→pass | 22,408 | 20,261 | -10% | 1 | 1 | 0% | 2,729 | 2,321 | -15% | 0 | 0 | — |
▸case-09 I need to convert the target memory address `0x7ffff7a2d420` into a 64-bit byte sequence for a stack payload in ELF binary `pwn_lab1`. I am currently using `struct.pack('<Q', 0x7ffff7a2d420)` in my script. Provide a Python code snippet showing the idiomatic binary exploitation function for packing 64-bit integer addresses into little-endian bytes. | pass→pass | 28,699 | 8,466 | -71% | 1 | 1 | 0% | 2,456 | 1,236 | -50% | 0 | 0 | — |
▸case-10 In an exploit for ELF binary `leak_me`, the process leaks 6 bytes of a libc address (`\x20\xd4\xa2\xf7\xff\x7f`). To calculate the libc base address, I currently append `b'\x00\x00'` manually and use `struct.unpack('<Q', data)[0]`. Provide a Python code snippet showing the standard helper function for unpacking variable-length address leaks into a 64-bit integer. | pass→pass | 14,796 | 14,988 | +1% | 1 | 1 | 0% | 2,043 | 1,924 | -6% | 0 | 0 | — |
▸case-11 I am targeting binary `file_editor` to perform a GOT overwrite attack, replacing the entry for `printf` with `system`. Currently, my script hardcodes `printf_got = 0x601020` based on manual inspection. Provide a Python script snippet using binary header parsing to dynamically reference GOT entries without hardcoded addresses. | pass→fail | 17,586 | 18,582 | +6% | 1 | 1 | 0% | 2,349 | 2,718 | +16% | 0 | 0 | — |
▸case-12 I am developing an exploit for a 32-bit ARM Linux ELF binary `iot_daemon`. A teammate wrote a Python script, but it is generating x86 payload instructions because no architecture context was set. Provide a Python script snippet that configures the target architecture context specifically for 32-bit ARM and generates ARM shellcode. | pass→fail | 7,290 | 14,351 | +97% | 1 | 1 | 0% | 1,277 | 1,172 | -8% | 0 | 0 | — |
▸case-13 While troubleshooting an exploit for binary `crypto_vault`, I need to inspect the exact hex representation of all data sent and received over the socket without inserting manual `print()` statements before every I/O call. Provide a Python snippet showing how to enable detailed hex-dump verbosity for all process and network traffic. | pass→pass | 14,083 | 11,966 | -15% | 1 | 1 | 0% | 1,635 | 1,553 | -5% | 0 | 0 | — |
▸case-14 Target binary `logger_service` contains a format string vulnerability where we want to overwrite address `0x0804a028` with value `0xdeadbeef`. Manual payload construction requires calculating byte counts and forming `%hn` specifiers. Provide a Python script snippet showing the automated function to generate complete format string write payloads. | fail→fail | 8,800 | 14,855 | +69% | 1 | 1 | 0% | 1,119 | 1,093 | -2% | 0 | 0 | — |
▸case-15 When exploiting `heap_app`, I successfully leak the runtime address of `puts` in libc. To invoke `system('/bin/sh')`, I need to update the libc symbol offset table dynamically. Currently, my script calculates system address with manual integer addition: `sys_addr = puts_leak - puts_offset + sys_offset`. Provide a Python snippet demonstrating how to assign the calculated base address directly to a parsed ELF libc object. | pass→pass | 15,531 | 23,523 | +51% | 1 | 1 | 0% | 1,794 | 2,454 | +37% | 0 | 0 | — |
▸case-16 I am writing a unified exploit helper module that needs to pack memory addresses into byte strings across both 32-bit (`x86`) and 64-bit (`amd64`) targets without hardcoding `p32()` or `p64()` calls conditionally in every function. Provide a Python code snippet showing how to use context settings alongside generic integer packing functions. | pass→pass | 9,589 | 9,598 | +0% | 1 | 1 | 0% | 2,117 | 2,188 | +3% | 0 | 0 | — |
▸case-17 When sending exploit payloads to target binary `menu_app`, standard `time.sleep(0.5)` calls between `send()` calls cause race conditions and script unreliability. Provide a Python code snippet demonstrating reliable synchronization methods that wait for specific text prompt delimiters before sending data. | fail→pass | 21,010 | 21,958 | +5% | 1 | 1 | 0% | 2,187 | 2,206 | +1% | 0 | 0 | — |
▸case-18 I need to set up a clean, reproducible Python exploit script structure for target ELF binary `chall_one`. Provide a complete standalone Python script template that sets up architecture context, supports switching between local process execution and remote host connection via command line flags, and establishes interactive control. | pass→pass | 19,935 | 19,052 | -4% | 1 | 1 | 0% | 2,388 | 1,933 | -19% | 0 | 0 | — |
▸case-19 When debugging an exploit for `parser_v2`, I need GDB to automatically set breakpoints at address `0x4011d2` and break on `main` as soon as GDB attaches to the target process. Currently, I manually type `b *0x4011d2` every time GDB opens. Provide a Python script snippet passing automated GDB commands directly into the GDB attach function. | pass→pass | 9,977 | 17,574 | +76% | 1 | 1 | 0% | 877 | 1,410 | +61% | 0 | 0 | — |
▸case-20 We are auditing a web application frontend script `app.js` and found `document.getElementById('output').innerHTML = location.hash.substring(1);`. Craft an HTML/JavaScript payload to demonstrate DOM-based Cross-Site Scripting (XSS) and explain how to remediate the vulnerability in JavaScript. | pass→fail | 16,268 | 19,619 | +21% | 1 | 1 | 0% | 2,114 | 2,052 | -3% | 0 | 0 | — |
▸case-21 Our application development team uses Node.js Express with PostgreSQL (`pg` library) in `controllers/user.js`. We want to write a Semgrep SAST rule to detect raw SQL query concatenation like `db.query('SELECT * FROM users WHERE id = ' + req.query.id)`. Provide a valid Semgrep YAML rule definition for this web vulnerability. | pass→pass | 16,820 | 15,943 | -5% | 1 | 1 | 0% | 3,065 | 3,502 | +14% | 0 | 0 | — |
▸case-22 A Windows Server system crashed with a Blue Screen of Death (BSOD), producing crash dump file `C:\Windows\MEMORY.DMP`. Provide step-by-step instructions using WinDbg command line flags and commands to load symbols and analyze the crashing kernel module bugcheck. | pass→pass | 19,006 | 17,442 | -8% | 1 | 1 | 0% | 2,513 | 2,579 | +3% | 0 | 0 | — |
▸case-23 We captured network traffic during a security exercise and saved it as `capture.pcap`. Provide a Python script using Scapy to parse the PCAP file, inspect TCP port 443 packets, and extract Server Name Indication (SNI) hostnames from TLS Client Hello packets. | pass→pass | 12,599 | 25,588 | +103% | 1 | 1 | 0% | 2,596 | 5,707 | +120% | 0 | 0 | — |