tanweai/xianzhi-research

Overview

This skill packages a distilled meta-methodology for vulnerability research derived from analysis of 5,600+ security write-ups. It provides a layered thinking pyramid, a decision loop, and cross-domain formulas to guide systematic discovery, verification, and exploitation planning. The goal is to give researchers, red teamers, and auditors a repeatable cognitive framework to find and chain weaknesses efficiently.

How this skill works

The skill codifies four thinking levels: attack-surface identification, hypothesis validation, boundary exploration, and defense-reverse engineering. It prescribes a decision loop: input identification → context analysis → hypothesis → payload construction → response analysis → iterative refinement. It also maps domain-specific core formulas (code audit, binary, domain/AD, web) and points to targeted modules for concrete tactics and examples.

When to use it

• Performing structured vulnerability discovery during web, binary, or protocol analysis
• Conducting code audits requiring Source→Sink taint and sanitizer reasoning
• Planning red-team attack chains or CTF problem solving under time pressure
• Designing bypass strategies for WAF, EDR, sandbox, or antivirus
• Guiding reverse engineering or fuzzing with prioritized hypothesis-driven tests

Best practices

• Start from L1-L4 pyramid: identify interfaces, build hypotheses, probe boundaries, then reverse engineer defenses
• Follow the iterate: hypothesize→test→analyze→refine loop; automate small feedback cycles
• Think in chains: aim to combine smaller primitives into an end-to-end exploit path
• Use defense artifacts (patches, filter rules) to reverse-engineer bypass points
• Remain version-sensitive: verify behavior across versions and component boundaries

Example use cases

• Web injection: use semantic-difference tests and WAF strategy trees to reach unintended parsers
• Deserialization audit: hunt gadget chains and check protocol downgrade/secondary-deserialize paths
• Binary exploitation: map info leaks → primitives → control-flow primitives and combine foreach target glibc
• Domain penetration test: enumerate and abuse delegation/trust chains to escalate to domain compromise
• Reverse/anti-VM analysis: apply entropy reduction, symbolic/constraint techniques and targeted instrumentation