exploit-validation

Files (1)

• SKILL.md

SKILL.md (first lines)

A finding is only real once you've demonstrated impact. This skill builds the smallest PoC that proves it, using Nutaan's terminal and built-in browser, and nothing more aggressive than needed.

## Principles

- **Minimal.** The PoC proves the vulnerability and stops. For SQLi, extract one harmless value (e.g. `version()`), not the users table. For RCE, echo a unique marker, not a shell. For SSRF, prove the internal fetch, don't pull secrets.
- **Non-destructive by default.** No dropping tables, deleting records, or degrading availability. Anything destructive needs explicit prior sign-off — and even then, prefer a read-only proof.
- **Reproducible.** Capture the exact request (method, URL, headers, body) and the exact response that shows impact, so anyone can re-run it.
- **Scoped.** Only against the authorized target. Don't pivot to systems outside scope even if reachable.

## How to build it

Work in the scratch directory, not the target's repo.

- **HTTP-level** — a single `curl` or a short Python `requests`/Node script that sends the payload and prints the telling part of the response. Save it as `poc_<finding>.sh`/`.py`.
- **Browser-level** (XSS, CSRF, clickjacking) — drive the built-in browser: load the injected page, show the payload executing (an `alert`/DOM marker), screenshot it. For CSRF, host a minimal auto-submitting form and show the state change.
- **Timing/blind** — measure response-time deltas (blind SQLi/command injection) or use an out-of-band marker you control to prove blind SSRF/RCE.
- **Auth/JWT** — forge the token (alg confusion, weak secret) and show it being accepted on a protected endpoint.

## Confirm impact, then classify

For each validated finding, capture:

- What an attacker gains (data read, account takeover, code exec, privilege gain).
- The precondition (auth level needed, user interaction, specific configuration).
- Reliability (always / race-dependent / conditional).

Then compute a CVSS vector and OWASP category (hand this to `pentest-report`). If the PoC fails to prove real impact, drop the finding — do not report unvalidated hunches. A reflection that doesn't execute, an error that leaks nothing useful, or an id swap that returns only your own data are not findings.

From Tecosys/Nutaan-Code, AGPL-3.0.

More from Tecosys/Nutaan-Code