poc-validator

Files (11)

• SKILL.md
• Dockerfile.sandbox · assets/
• docker-compose.sandbox.yml · assets/
• docker_sandbox_setup.md · references/
• payload_patterns.md · references/
• safety_requirements.md · references/
• __init__.py · scripts/
• cleanup_sandbox.py · scripts/
• payload_generator.py · scripts/
• sandbox_executor.py · scripts/
• verify_exploit.py · scripts/

SKILL.md (first lines)

# PoC-Validator Skill

Validates vulnerability exploitability through controlled payload generation, sandboxed execution, and success verification.

## Quick Start

Generate and validate a PoC for SQL injection:
```python
from scripts.payload_generator import PayloadGenerator
from scripts.sandbox_executor import SandboxExecutor
from scripts.verify_exploit import ExploitVerifier

# Generate payload
gen = PayloadGenerator()
payload = gen.generate_sql_payload(
    target_url="http://target.com/login",
    parameter="username",
    technique="error_based"
)

# Execute in sandbox
executor = SandboxExecutor()
result = await executor.execute_sqlmap(
    target="http://target.com/login",
    payload=payload,
    risk_level=2
)

# Verify success
verifier = ExploitVerifier()
is_exploitable = await verifier.verify_sql_injection(result)
```

## Workflow

### 1. Payload Generation

Use `scripts/payload_generator.py` for:
- **CVE-based exploits**: Lookup known payloads from vulnerability_mapping.json
- **SQL Injection**: Error-based, Union-based, Time-based, Boolean-based
- **Command Injection**: System command payloads with evasion techniques
- **Path Traversal**: Directory traversal sequences
- **XXE/XML Injection**: External entity payloads

See [references/payload_patterns.md](references/payload_patterns.md) for complete payload library.

### 2. Sandbox Execution

Use `scripts/sandbox_executor.py` for isolated exploit testing:
- Docker container isolation with resource limits
- Network isolation (no egress to private ranges)
- Execution timeouts (default: 300s)
- Read-only filesystem with tmpfs for output
- Automatic cleanup post-execution

**Critical**: All exploit execution MUST use sandbox. Never run exploits directly on host.

### 3. Success Verification

Use `scripts/verify_exploit.py` to confirm exploitation:
- **SQL Injection**: Detect database version extraction, table enumeration
- **RCE**: Verify command output in response
- **Auth Bypass**: Confirm session token/admin access
- **Data Exfiltration**: Detect sensitive data patterns in responses
- **File Upload**: Verify file presence/execution

## Risk Levels

| Level | Payload Type | Tools | Use Case |
|-------|-------------|-------|----------|
| 0 | Passive detection | None | Vulnerability confirmation only |
| 1 | Safe payloads | SQLMap --risk 1 | Non-destructive testing |
| 2 | Active exploitation | SQLMap --risk 2, Metasploit | Controlled exploitation |
| 3 | Aggressive | All tools with full payloads | Full PoC validation |

## Integration with Zen-AI-Pentest

```python
# Integration with ExploitAgent
from autonomous.exploit_validator import ExploitValidator

def validate_poc(self, vulnerability: dict) -> dict:
    """Validate vulnerability with PoC execution."""
    validator = ExploitValidator(
        sandbox_enabled=True,
        risk_level=vulnerability.get("risk", 1)
    )

    return validator.validate(
        vuln_type=vulnerability["type"],
        target=vulnerability["target"],
        evidence=vulnerability["evidence"]
    )
```

## Safety Controls

Before any exploit execution:
1. Validate target is not in private ranges (guardrails/ip_validator.py)
2. Confirm explicit authorization in database
3. Set execution timeout
4. Enable Docker sandbox
5. Log all actions to audit trail

See [references/safety_requirements.md](references/safety_requirements.md) for complete safety checklist.

## Error Handling

| Error | Cause | Solution |
|-------|-------|----------|
| Sandbox timeout | Payload too slow | Increase timeout or use faster technique |
| Container crash | Resource exhaustion | Reduce threads, increase memory limit |
| Network blocked | Egress filtering | Verify allowed outbound in config |
| Verification failed | WAF/IPS blocking | Try evasion techniques from payload_patterns.md |

## Output Format

```json
{

From SHAdd0WTAka/Zen-Ai-Pentest, MIT.

More from SHAdd0WTAka/Zen-Ai-Pentest