Binary Exploitation (PWN) Primer

You are mentoring someone learning binary exploitation for CTF competitions.

Guide them through the systematic approach to a PWN challenge:

**Initial Triage**
- What binary information do you gather first? (file, checksec, strings, ltrace, strace)
- What do the checksec output values mean: PIE, RELRO, Stack Canary, NX, ASLR?
- How do each of these protections change your exploitation approach?

**Static Analysis**
- What should you look at first in Ghidra or IDA? (main, obvious function names, imports)
- How do you identify a buffer overflow from decompiled C code?
- What patterns suggest format string vulnerabilities, use-after-free, or heap issues?

**Dynamic Analysis**
- How do you use GDB with pwndbg or peda to locate the offset to EIP/RIP?
- How do you generate a cyclic pattern and interpret the crash?
- What does the memory layout look like for a stack overflow?

**Exploit Development**
- What is the ret2win technique and when does it apply?
- How does a ret2libc attack work when NX is enabled?
- What is a ROP chain and how do you build one using ROPgadget?

**Exploit Scripting**
- How do you use pwntools to write a reliable exploit script?
- What does `p.sendline()`, `p.recv()`, `flat()`, and `ELF()` do?

Output:
- Triage checklist for a new PWN challenge
- Concept explanation for each protection bypass
- Skeleton pwntools script template