@nockdev/awf 6.2.0 → 6.2.2

package/.agent/skills/core/security/data/binary-exploitation.yaml

@@ -1,339 +1,339 @@
 metadata:
   skill: security
   domain: binary_exploitation
-  version: 6.2.0
-  updated: '2026-02-05'
-  migrated_from: binary-exploitation.csv
+  version: 6.2.2
+  updated: "2026-02-05"
+  migrated_from: binary-exploitation.yaml
   patterns_count: 25
   columns:
-  - id
-  - name
-  - severity
-  - category
-  - description
-  - detection_pattern
-  - fix_pattern
-  - cwe
-  - tools
-  - example_attack
-  - defense
+    - id
+    - name
+    - severity
+    - category
+    - description
+    - detection_pattern
+    - fix_pattern
+    - cwe
+    - tools
+    - example_attack
+    - defense
 patterns:
-- id: BE-01
-  name: Stack Canary Bypass
-  severity: CRITICAL
-  category: Exploit
-  description: Stack cookie can be leaked or brute-forced
-  detection_pattern: __stack_chk_fail|canary(?!.*random)
-  fix_pattern: Use ASLR compile with -fstack-protector-strong
-  cwe: CWE-693
-  tools:
-  - gdb
-  - pwntools
-  example_attack: '# Leak canary via format string\npayload = b''%15$p'' # Leaks canary'
-  defense: Compile with -fstack-protector-all use ASLR
-- id: BE-02
-  name: Return Oriented Programming
-  severity: CRITICAL
-  category: Exploit
-  description: ROP gadgets chained to bypass NX/DEP
-  detection_pattern: .text.*ret(?!.*CFI)
-  fix_pattern: Enable CFI Control Flow Integrity and CET
-  cwe: CWE-94
-  tools:
-  - ROPgadget
-  - ropper
-  example_attack: from pwn import *\nrop = ROP(binary)\nrop.call('system', ['/bin/sh'])
-  defense: Compile with -fcf-protection=full enable CET
-- id: BE-03
-  name: ASLR Bypass via Leak
-  severity: CRITICAL
-  category: Exploit
-  description: Address leak defeats ASLR randomization
-  detection_pattern: puts.*got|printf.*libc(?!.*PIE)
-  fix_pattern: Always use PIE with ASLR avoid format string bugs
-  cwe: CWE-200
-  tools:
-  - pwntools
-  - gdb
-  example_attack: '# Leak libc address\nlibc_leak = u64(io.recv(6) + b''\\x00\\x00'')'
-  defense: Compile with -fPIE -pie fix all info leaks
-- id: BE-04
-  name: Heap Feng Shui
-  severity: HIGH
-  category: Exploit
-  description: Heap layout manipulated for exploitation
-  detection_pattern: malloc.*free.*malloc(?!.*sanitize)
-  fix_pattern: Use hardened allocators like jemalloc-hardened
-  cwe: CWE-416
-  tools:
-  - gdb
-  - heapinspect
-  example_attack: '# Spray heap to control allocation\nfor i in range(100): alloc(0x100)'
-  defense: Use MALLOC_CHECK_=3 Address Sanitizer in debug
-- id: BE-05
-  name: GOT Overwrite
-  severity: CRITICAL
-  category: Exploit
-  description: Global Offset Table overwritten for code execution
-  detection_pattern: \.got.*write(?!.*RELRO)
-  fix_pattern: Enable FULL RELRO with -Wl,-z,relro,-z,now
-  cwe: CWE-94
-  tools:
-  - objdump
-  - pwntools
-  example_attack: '# Overwrite GOT entry\nwrite(elf.got[''puts''], system_addr)'
-  defense: Link with -z relro -z now for FULL RELRO
-- id: BE-06
-  name: JOP JIT Spray
-  severity: HIGH
-  category: Exploit
-  description: Jump Oriented Programming in JIT compiled code
-  detection_pattern: jit.*spray|trampoline(?!.*verify)
-  fix_pattern: Implement W^X strictly verify JIT code
-  cwe: CWE-94
-  tools:
-  - IDA
-  - Binary Ninja
-  example_attack: '# JIT spray NOP equivalent\nfor i in range(0x1000): emit_jmp()'
-  defense: Isolate JIT pages with guard pages proper W^X
-- id: BE-07
-  name: Type Confusion Exploit
-  severity: CRITICAL
-  category: Exploit
-  description: Object type confused for arbitrary access
-  detection_pattern: dynamic_cast.*vtable(?!.*check)
-  fix_pattern: Use static types bounds check virtual calls
-  cwe: CWE-843
-  tools:
-  - IDA
-  - WinDbg
-  example_attack: // Cast to wrong type\nBase* p = (Base*)evil_obj;
-  defense: Add runtime type checks CFI for virtual calls
-- id: BE-08
-  name: Integer Underflow Exploit
-  severity: HIGH
-  category: Exploit
-  description: Unsigned subtraction wraps to large value
-  detection_pattern: unsigned.*-(?!.*check)
-  fix_pattern: Use signed types or check for underflow first
-  cwe: CWE-191
-  tools:
-  - gdb
-  - pwntools
-  example_attack: size_t len = user_len - 1; // If 0, wraps to MAX
-  defense: if (user_len == 0) return; size_t len = user_len - 1;
-- id: BE-09
-  name: Null Byte Injection
-  severity: MEDIUM
-  category: Exploit
-  description: Null byte terminates string prematurely for bypass
-  detection_pattern: strcpy.*\\0.*injection
-  fix_pattern: Use length-counted strings not null-terminated
-  cwe: CWE-626
-  tools:
-  - Burp
-  - custom
-  example_attack: // Bypass path check\npath = 'admin.txt\\x00.jpg'
-  defense: Use strnlen and length parameters not null termination
-- id: BE-10
-  name: Unlink Exploit
-  severity: CRITICAL
-  category: Exploit
-  description: Heap metadata corruption via fake chunks
-  detection_pattern: unlink|FD.*BK(?!.*safe_unlink)
-  fix_pattern: Use safe_unlink checks in allocator
-  cwe: CWE-416
-  tools:
-  - gdb
-  - heapinspect
-  example_attack: '# Craft fake chunk for unlink\nfake_chunk = p64(fd) + p64(bk)'
-  defense: Use modern glibc with safe_unlink enabled
-- id: BE-11
-  name: Format String Write
-  severity: CRITICAL
-  category: Exploit
-  description: Format string used for arbitrary write via %n
-  detection_pattern: printf.*%n(?!.*disabled)
-  fix_pattern: Never pass user input directly to printf
-  cwe: CWE-134
-  tools:
-  - pwntools
-  - gdb
-  example_attack: '# Write to address via %n\npayload = fmtstr_payload(offset, {addr: value})'
-  defense: Compile with -Wformat-security use %s always
-- id: BE-12
-  name: Sigreturn Oriented
-  severity: HIGH
-  category: Exploit
-  description: SROP uses sigreturn for ROP without gadgets
-  detection_pattern: sigreturn.*frame(?!.*seccomp)
-  fix_pattern: Enable seccomp to filter syscalls
-  cwe: CWE-94
-  tools: pwntools ropper
-  example_attack: frame = SigreturnFrame()\nframe.rax = constants.SYS_execve
-  defense: Use seccomp to whitelist allowed syscalls
-- id: BE-13
-  name: Vtable Hijacking
-  severity: CRITICAL
-  category: Exploit
-  description: C++ virtual table pointer overwritten
-  detection_pattern: vtable.*overwrite|vptr(?!.*CFI)
-  fix_pattern: Enable CFI for vtable protection
-  cwe: CWE-843
-  tools:
-  - IDA
-  - gdb
-  example_attack: // Overwrite vptr\n*(void**)obj = fake_vtable;
-  defense: Compile with -fsanitize=cfi MSVC /guard:cf
-- id: BE-14
-  name: Blind ROP Attack
-  severity: HIGH
-  category: Exploit
-  description: ROP without binary using stack reading
-  detection_pattern: brop|blind.*rop(?!.*canary)
-  fix_pattern: Use stack canaries and ASLR together
-  cwe: CWE-94
-  tools:
-  - pwntools
-  - custom
-  example_attack: '# BROP: scan for stop gadget\nfor addr in range(0x400000, 0x500000): try_addr()'
-  defense: Strong stack canary ASLR PIE together
-- id: BE-15
-  name: Ret2libc Attack
-  severity: CRITICAL
-  category: Exploit
-  description: Return to libc function bypassing NX
-  detection_pattern: ret2libc|system.*binsh
-  fix_pattern: Use ASLR with PIE avoid libc addresses in binary
-  cwe: CWE-94
-  tools:
-  - pwntools
-  - gdb
-  example_attack: rop.call(libc.sym['system'], [next(libc.search(b'/bin/sh'))])
-  defense: Full ASLR PIE no hardcoded addresses
-- id: BE-16
-  name: Gadget Finder Detection
-  severity: MEDIUM
-  category: Static
-  description: Binary scanned for ROP gadgets
-  detection_pattern: ROPgadget|ropper(?!.*strip)
-  fix_pattern: Strip symbols reduce gadget availability
-  cwe: CWE-200
-  tools:
-  - ROPgadget
-  - ropper
-  example_attack: $ ROPgadget --binary vuln --ropchain
-  defense: Strip binary use control flow integrity
-- id: BE-17
-  name: Dangling Pointer Spray
-  severity: HIGH
-  category: Exploit
-  description: Freed pointer reallocated with attacker data
-  detection_pattern: free.*spray(?!.*null)
-  fix_pattern: Set pointer to NULL after free immediately
-  cwe: CWE-416
-  tools:
-  - gdb
-  - pwntools
-  example_attack: free(ptr); spray(0x100); ptr->func();
-  defense: ptr = NULL; after free use smart pointers
-- id: BE-18
-  name: Shadow Stack Missing
-  severity: HIGH
-  category: Mitigation
-  description: No shadow stack protection for return addresses
-  detection_pattern: (!.*shadow_stack|CET)
-  fix_pattern: Enable Intel CET or ARM PAC
-  cwe: CWE-693
-  tools:
-  - gdb
-  - IDA
-  example_attack: // No shadow stack\nret // Can be hijacked
-  defense: Compile with -fcf-protection=return use CET
-- id: BE-19
-  name: Double Fetch TOCTOU
-  severity: HIGH
-  category: Kernel
-  description: Race between user check and kernel use
-  detection_pattern: copy_from_user.*check.*use
-  fix_pattern: Use get_user once or copy entire structure atomically
-  cwe: CWE-367
-  tools: kernel debugger
-  example_attack: // Check then copy - can be modified between\nif (user->size < 100) copy_from_user()
-  defense: Copy once then validate the copy
-- id: BE-20
-  name: Kernel Pointer Leak
-  severity: CRITICAL
-  category: Kernel
-  description: Kernel address leaked to userspace
-  detection_pattern: /proc/.*(maps|kallsyms)(?!.*restrict)
-  fix_pattern: Enable kernel hardening kptr_restrict=2
-  cwe: CWE-200
-  tools: /proc
-  example_attack: $ cat /proc/kallsyms
-  defense: sysctl kernel.kptr_restrict=2
-- id: BE-21
-  name: Sandbox Escape
-  severity: CRITICAL
-  category: Sandbox
-  description: Attacker escapes from sandbox/container
-  detection_pattern: seccomp.*bypass|container.*escape
-  fix_pattern: Defense in depth multiple sandbox layers
-  cwe: CWE-693
-  tools:
-  - docker
-  - crictl
-  example_attack: // Escape via kernel vuln\nexploit_kernel_from_container()
-  defense: Use gVisor/Kata containers defense in depth
-- id: BE-22
-  name: Use After Scope
-  severity: HIGH
-  category: Memory
-  description: Local variable accessed after scope ends
-  detection_pattern: \\{.*\\&local.*\\}.*use_ptr
-  fix_pattern: Avoid taking address of locals use heap allocation
-  cwe: CWE-416
-  tools:
-  - ASAN
-  - gdb
-  example_attack: int* getPtr() { int x = 5; return &x; }
-  defense: Use heap allocation or static if needed
-- id: BE-23
-  name: Stack Pivot Attack
-  severity: HIGH
-  category: Exploit
-  description: ESP/RSP moved to attacker controlled memory
-  detection_pattern: xchg.*esp|leave.*ret(?!.*verify)
-  fix_pattern: Use stack canaries CFI and shadow stack
-  cwe: CWE-94
-  tools:
-  - pwntools
-  - IDA
-  example_attack: '# Pivot stack to heap\nxchg_esp_eax = 0x8048abc'
-  defense: Strong CFI shadow stack CET protection
-- id: BE-24
-  name: One Gadget RCE
-  severity: CRITICAL
-  category: Exploit
-  description: Single gadget provides system("/bin/sh")
-  detection_pattern: one_gadget|magic_gadget
-  fix_pattern: No direct defense - prevent memory corruption
-  cwe: CWE-94
-  tools:
-  - one_gadget
-  - pwntools
-  example_attack: $ one_gadget libc.so.6\n0x4f3d5 execve(\/bin/sh\"
-  defense: rsp+0x40)"
-- id: BE-25
-  name: Partial Overwrite
-  severity: HIGH
-  category: Exploit
-  description: Only low bytes overwritten bypassing ASLR partially
-  detection_pattern: \\x00.*overwrite(?!.*full_aslr)
-  fix_pattern: Ensure full 64-bit ASLR no page alignment
-  cwe: CWE-330
-  tools:
-  - pwntools
-  - gdb
-  example_attack: '# Overwrite only low 2 bytes\npayload = b''AA'' # Only affects low 16 bits'
-  defense: Full 64-bit ASLR high entropy
+  - id: BE-01
+    name: Stack Canary Bypass
+    severity: CRITICAL
+    category: Exploit
+    description: Stack cookie can be leaked or brute-forced
+    detection_pattern: __stack_chk_fail|canary(?!.*random)
+    fix_pattern: Use ASLR compile with -fstack-protector-strong
+    cwe: CWE-693
+    tools:
+      - gdb
+      - pwntools
+    example_attack: '# Leak canary via format string\npayload = b''%15$p'' # Leaks canary'
+    defense: Compile with -fstack-protector-all use ASLR
+  - id: BE-02
+    name: Return Oriented Programming
+    severity: CRITICAL
+    category: Exploit
+    description: ROP gadgets chained to bypass NX/DEP
+    detection_pattern: .text.*ret(?!.*CFI)
+    fix_pattern: Enable CFI Control Flow Integrity and CET
+    cwe: CWE-94
+    tools:
+      - ROPgadget
+      - ropper
+    example_attack: from pwn import *\nrop = ROP(binary)\nrop.call('system', ['/bin/sh'])
+    defense: Compile with -fcf-protection=full enable CET
+  - id: BE-03
+    name: ASLR Bypass via Leak
+    severity: CRITICAL
+    category: Exploit
+    description: Address leak defeats ASLR randomization
+    detection_pattern: puts.*got|printf.*libc(?!.*PIE)
+    fix_pattern: Always use PIE with ASLR avoid format string bugs
+    cwe: CWE-200
+    tools:
+      - pwntools
+      - gdb
+    example_attack: '# Leak libc address\nlibc_leak = u64(io.recv(6) + b''\\x00\\x00'')'
+    defense: Compile with -fPIE -pie fix all info leaks
+  - id: BE-04
+    name: Heap Feng Shui
+    severity: HIGH
+    category: Exploit
+    description: Heap layout manipulated for exploitation
+    detection_pattern: malloc.*free.*malloc(?!.*sanitize)
+    fix_pattern: Use hardened allocators like jemalloc-hardened
+    cwe: CWE-416
+    tools:
+      - gdb
+      - heapinspect
+    example_attack: '# Spray heap to control allocation\nfor i in range(100): alloc(0x100)'
+    defense: Use MALLOC_CHECK_=3 Address Sanitizer in debug
+  - id: BE-05
+    name: GOT Overwrite
+    severity: CRITICAL
+    category: Exploit
+    description: Global Offset Table overwritten for code execution
+    detection_pattern: \.got.*write(?!.*RELRO)
+    fix_pattern: Enable FULL RELRO with -Wl,-z,relro,-z,now
+    cwe: CWE-94
+    tools:
+      - objdump
+      - pwntools
+    example_attack: '# Overwrite GOT entry\nwrite(elf.got[''puts''], system_addr)'
+    defense: Link with -z relro -z now for FULL RELRO
+  - id: BE-06
+    name: JOP JIT Spray
+    severity: HIGH
+    category: Exploit
+    description: Jump Oriented Programming in JIT compiled code
+    detection_pattern: jit.*spray|trampoline(?!.*verify)
+    fix_pattern: Implement W^X strictly verify JIT code
+    cwe: CWE-94
+    tools:
+      - IDA
+      - Binary Ninja
+    example_attack: '# JIT spray NOP equivalent\nfor i in range(0x1000): emit_jmp()'
+    defense: Isolate JIT pages with guard pages proper W^X
+  - id: BE-07
+    name: Type Confusion Exploit
+    severity: CRITICAL
+    category: Exploit
+    description: Object type confused for arbitrary access
+    detection_pattern: dynamic_cast.*vtable(?!.*check)
+    fix_pattern: Use static types bounds check virtual calls
+    cwe: CWE-843
+    tools:
+      - IDA
+      - WinDbg
+    example_attack: // Cast to wrong type\nBase* p = (Base*)evil_obj;
+    defense: Add runtime type checks CFI for virtual calls
+  - id: BE-08
+    name: Integer Underflow Exploit
+    severity: HIGH
+    category: Exploit
+    description: Unsigned subtraction wraps to large value
+    detection_pattern: unsigned.*-(?!.*check)
+    fix_pattern: Use signed types or check for underflow first
+    cwe: CWE-191
+    tools:
+      - gdb
+      - pwntools
+    example_attack: size_t len = user_len - 1; // If 0, wraps to MAX
+    defense: if (user_len == 0) return; size_t len = user_len - 1;
+  - id: BE-09
+    name: Null Byte Injection
+    severity: MEDIUM
+    category: Exploit
+    description: Null byte terminates string prematurely for bypass
+    detection_pattern: strcpy.*\\0.*injection
+    fix_pattern: Use length-counted strings not null-terminated
+    cwe: CWE-626
+    tools:
+      - Burp
+      - custom
+    example_attack: // Bypass path check\npath = 'admin.txt\\x00.jpg'
+    defense: Use strnlen and length parameters not null termination
+  - id: BE-10
+    name: Unlink Exploit
+    severity: CRITICAL
+    category: Exploit
+    description: Heap metadata corruption via fake chunks
+    detection_pattern: unlink|FD.*BK(?!.*safe_unlink)
+    fix_pattern: Use safe_unlink checks in allocator
+    cwe: CWE-416
+    tools:
+      - gdb
+      - heapinspect
+    example_attack: '# Craft fake chunk for unlink\nfake_chunk = p64(fd) + p64(bk)'
+    defense: Use modern glibc with safe_unlink enabled
+  - id: BE-11
+    name: Format String Write
+    severity: CRITICAL
+    category: Exploit
+    description: Format string used for arbitrary write via %n
+    detection_pattern: printf.*%n(?!.*disabled)
+    fix_pattern: Never pass user input directly to printf
+    cwe: CWE-134
+    tools:
+      - pwntools
+      - gdb
+    example_attack: '# Write to address via %n\npayload = fmtstr_payload(offset, {addr: value})'
+    defense: Compile with -Wformat-security use %s always
+  - id: BE-12
+    name: Sigreturn Oriented
+    severity: HIGH
+    category: Exploit
+    description: SROP uses sigreturn for ROP without gadgets
+    detection_pattern: sigreturn.*frame(?!.*seccomp)
+    fix_pattern: Enable seccomp to filter syscalls
+    cwe: CWE-94
+    tools: pwntools ropper
+    example_attack: frame = SigreturnFrame()\nframe.rax = constants.SYS_execve
+    defense: Use seccomp to whitelist allowed syscalls
+  - id: BE-13
+    name: Vtable Hijacking
+    severity: CRITICAL
+    category: Exploit
+    description: C++ virtual table pointer overwritten
+    detection_pattern: vtable.*overwrite|vptr(?!.*CFI)
+    fix_pattern: Enable CFI for vtable protection
+    cwe: CWE-843
+    tools:
+      - IDA
+      - gdb
+    example_attack: // Overwrite vptr\n*(void**)obj = fake_vtable;
+    defense: Compile with -fsanitize=cfi MSVC /guard:cf
+  - id: BE-14
+    name: Blind ROP Attack
+    severity: HIGH
+    category: Exploit
+    description: ROP without binary using stack reading
+    detection_pattern: brop|blind.*rop(?!.*canary)
+    fix_pattern: Use stack canaries and ASLR together
+    cwe: CWE-94
+    tools:
+      - pwntools
+      - custom
+    example_attack: '# BROP: scan for stop gadget\nfor addr in range(0x400000, 0x500000): try_addr()'
+    defense: Strong stack canary ASLR PIE together
+  - id: BE-15
+    name: Ret2libc Attack
+    severity: CRITICAL
+    category: Exploit
+    description: Return to libc function bypassing NX
+    detection_pattern: ret2libc|system.*binsh
+    fix_pattern: Use ASLR with PIE avoid libc addresses in binary
+    cwe: CWE-94
+    tools:
+      - pwntools
+      - gdb
+    example_attack: rop.call(libc.sym['system'], [next(libc.search(b'/bin/sh'))])
+    defense: Full ASLR PIE no hardcoded addresses
+  - id: BE-16
+    name: Gadget Finder Detection
+    severity: MEDIUM
+    category: Static
+    description: Binary scanned for ROP gadgets
+    detection_pattern: ROPgadget|ropper(?!.*strip)
+    fix_pattern: Strip symbols reduce gadget availability
+    cwe: CWE-200
+    tools:
+      - ROPgadget
+      - ropper
+    example_attack: $ ROPgadget --binary vuln --ropchain
+    defense: Strip binary use control flow integrity
+  - id: BE-17
+    name: Dangling Pointer Spray
+    severity: HIGH
+    category: Exploit
+    description: Freed pointer reallocated with attacker data
+    detection_pattern: free.*spray(?!.*null)
+    fix_pattern: Set pointer to NULL after free immediately
+    cwe: CWE-416
+    tools:
+      - gdb
+      - pwntools
+    example_attack: free(ptr); spray(0x100); ptr->func();
+    defense: ptr = NULL; after free use smart pointers
+  - id: BE-18
+    name: Shadow Stack Missing
+    severity: HIGH
+    category: Mitigation
+    description: No shadow stack protection for return addresses
+    detection_pattern: (!.*shadow_stack|CET)
+    fix_pattern: Enable Intel CET or ARM PAC
+    cwe: CWE-693
+    tools:
+      - gdb
+      - IDA
+    example_attack: // No shadow stack\nret // Can be hijacked
+    defense: Compile with -fcf-protection=return use CET
+  - id: BE-19
+    name: Double Fetch TOCTOU
+    severity: HIGH
+    category: Kernel
+    description: Race between user check and kernel use
+    detection_pattern: copy_from_user.*check.*use
+    fix_pattern: Use get_user once or copy entire structure atomically
+    cwe: CWE-367
+    tools: kernel debugger
+    example_attack: // Check then copy - can be modified between\nif (user->size < 100) copy_from_user()
+    defense: Copy once then validate the copy
+  - id: BE-20
+    name: Kernel Pointer Leak
+    severity: CRITICAL
+    category: Kernel
+    description: Kernel address leaked to userspace
+    detection_pattern: /proc/.*(maps|kallsyms)(?!.*restrict)
+    fix_pattern: Enable kernel hardening kptr_restrict=2
+    cwe: CWE-200
+    tools: /proc
+    example_attack: $ cat /proc/kallsyms
+    defense: sysctl kernel.kptr_restrict=2
+  - id: BE-21
+    name: Sandbox Escape
+    severity: CRITICAL
+    category: Sandbox
+    description: Attacker escapes from sandbox/container
+    detection_pattern: seccomp.*bypass|container.*escape
+    fix_pattern: Defense in depth multiple sandbox layers
+    cwe: CWE-693
+    tools:
+      - docker
+      - crictl
+    example_attack: // Escape via kernel vuln\nexploit_kernel_from_container()
+    defense: Use gVisor/Kata containers defense in depth
+  - id: BE-22
+    name: Use After Scope
+    severity: HIGH
+    category: Memory
+    description: Local variable accessed after scope ends
+    detection_pattern: \\{.*\\&local.*\\}.*use_ptr
+    fix_pattern: Avoid taking address of locals use heap allocation
+    cwe: CWE-416
+    tools:
+      - ASAN
+      - gdb
+    example_attack: int* getPtr() { int x = 5; return &x; }
+    defense: Use heap allocation or static if needed
+  - id: BE-23
+    name: Stack Pivot Attack
+    severity: HIGH
+    category: Exploit
+    description: ESP/RSP moved to attacker controlled memory
+    detection_pattern: xchg.*esp|leave.*ret(?!.*verify)
+    fix_pattern: Use stack canaries CFI and shadow stack
+    cwe: CWE-94
+    tools:
+      - pwntools
+      - IDA
+    example_attack: '# Pivot stack to heap\nxchg_esp_eax = 0x8048abc'
+    defense: Strong CFI shadow stack CET protection
+  - id: BE-24
+    name: One Gadget RCE
+    severity: CRITICAL
+    category: Exploit
+    description: Single gadget provides system("/bin/sh")
+    detection_pattern: one_gadget|magic_gadget
+    fix_pattern: No direct defense - prevent memory corruption
+    cwe: CWE-94
+    tools:
+      - one_gadget
+      - pwntools
+    example_attack: $ one_gadget libc.so.6\n0x4f3d5 execve(\/bin/sh\"
+    defense: rsp+0x40)"
+  - id: BE-25
+    name: Partial Overwrite
+    severity: HIGH
+    category: Exploit
+    description: Only low bytes overwritten bypassing ASLR partially
+    detection_pattern: \\x00.*overwrite(?!.*full_aslr)
+    fix_pattern: Ensure full 64-bit ASLR no page alignment
+    cwe: CWE-330
+    tools:
+      - pwntools
+      - gdb
+    example_attack: '# Overwrite only low 2 bytes\npayload = b''AA'' # Only affects low 16 bits'
+    defense: Full 64-bit ASLR high entropy