exploitation

Exploitation — Proof of Concept

For each candidate in findings-candidates.json, attempt a real, reproducible PoC against url (curl and/or browser). Only run after the orchestrator's authorization gate confirmed exploitation.

Per class produce 04-exploit-<class>.md and append to findings-confirmed.json:

{
  "confirmed": [
    {
      "id": "inj-001", "class": "injection", "severity": "high",
      "confidence": "high", "endpoint": "POST /search", "param": "q",
      "poc": "curl -s 'https://target/search' --data \"q=' OR 1=1--\"",
      "evidence": "Response leaked 1000 rows / DB error revealing schema.",
      "remediation": "Use parameterized queries."
    }
  ]
}

Rules:

• Only candidates with a working PoC go into findings-confirmed.json.
• Failed attempts are noted in the per-class md as "could not confirm" with what was tried — never fatal, continue to the next candidate.
• Keep payloads minimal and non-destructive; never run mass/DoS payloads. Write files into pentest-workspace/<run-id>/.