A Disciplined Heap Workflow

• Map the program's heap use: which sizes are allocated, when they are freed, and whether freed pointers are reused.
• Find the bug: UAF, double-free, or overflow — and the input that triggers it.
• Confirm the layout in pwndbg: sizes, bins, adjacency.
• Choose a primitive: arbitrary write via poisoning, or type confusion via UAF/double-free.
• Pick a target: GOT entry, return address, function pointer (hooks on older glibc).
• Escalate to shell and verify.