<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: writing-exploit-documentation
description: >-
  Write comprehensive exploit documentation including vulnerability writeups, CVE submissions, advisory templates, reproduction steps, detection signatures, and remediation guidance.
domain: cybersecurity
subdomain: exploit-development
tags:
  - documentation
  - cve-submission
  - advisory
  - writeup
  - responsible-disclosure
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
  frameworks: ["MITRE ATT&CK", "Metasploit"]
  tools: ["python3", "markdown", "pandoc"]
---

# Writing Exploit Documentation

## Overview

Exploit documentation transforms technical findings into actionable reports for
vendors, CVE authorities, detection teams, and internal stakeholders. Good
documentation enables patching, detection, and informed risk decisions.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `python3` | Security tooling |
| `pandoc (optional` | Security tooling |
| `for PDF generation)` | Security tooling |
| Completed vulnerability analysis and exploit development | Environment requirement |
| CVE reservation (if applicable) via MITRE or CNA | Environment requirement |
| Understanding of responsible disclosure timelines | Environment requirement |

## Workflow

### Step 1: Vulnerability Writeup

```bash
# Generate writeup template from exploit metadata
node scripts/agent.js template --type writeup --cve CVE-2024-XXXX \
  --product "CustomApp" --version "1.2.0" --output writeup.md

# Structure:
# 1. Summary (CVE, CVSS, CWE, affected versions)
# 2. Root Cause Analysis (code path, vulnerable function)
# 3. Exploitation (step-by-step, screenshots, PoC)
# 4. Impact Assessment (technical + business)
# 5. Detection (network + host signatures)
# 6. Remediation (patch, workaround, compensating control)
# 7. Timeline (discovery, vendor contact, patch, disclosure)
```

### Step 2: CVE Submission

```bash
# Generate CVE submission form data
node scripts/agent.js cve-form --cve CVE-2024-XXXX \
  --product "CustomApp" --vendor "ExampleCorp" \
  --versions "1.0.0-1.2.0" --cwe CWE-787 \
  --cvss "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"

# Validate CVSS vector
node scripts/agent.js validate-cvss \
  --vector "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
```

### Step 3: Advisory Generation

```bash
# Generate vendor advisory template
node scripts/agent.js template --type advisory --cve CVE-2024-XXXX \
  --severity critical --output advisory.md

# Generate detection rule documentation
node scripts/agent.js detection-docs --exploit exploit.py \
  --formats "sigma,suricata,yara" --output detection_rules.md
```

### Step 4: Report Assembly

```
Final Report Structure:
├── Executive Summary — One-page risk overview
├── Technical Details
│   ├── Vulnerability Description
│   ├── Root Cause Analysis
│   ├── Exploitation Walkthrough
│   └── Memory/Data Flow Diagrams
├── Impact Assessment
│   ├── CVSS Score and Vector
│   ├── Business Impact
│   └── Affected Systems Count
├── Detection & Response
│   ├── IOCs and Signatures
│   ├── Detection Rules (Sigma/Suricata)
│   └── Incident Response Steps
├── Remediation
│   ├── Vendor Patch
│   ├── Workarounds
│   └── Compensating Controls
├── Appendices
│   ├── PoC Code
│   ├── PCAP Samples
│   └── Disclosure Timeline
└── References
```

### Step 5: Publication

```bash
# Convert to PDF for formal delivery
pandoc writeup.md -o writeup.pdf --pdf-engine=xelatex

# Validate all sections present
node scripts/agent.js validate-doc --document writeup.md --template full_writeup

# Package for disclosure
node scripts/agent.js package --writeup writeup.md --poc poc.py \
  --pcap capture.pcap --output disclosure_package.zip
```

## Detection

```yaml
title: Writing Exploit Documentation Detection
id: 8efadc24-8b41-40c6-bf1d-0893430e8a03
status: experimental
description: Detects suspicious activity related to writing exploit documentation techniques in exploit development context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*writing*exploit*"
  condition: selection
level: critical
tags:
  - attack.t1190
  - attack.execution
falsepositives:
  - Vulnerability scanner testing known exploit signatures
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Writing Exploit Documentation Detection | windows/process_creation | Sigma rule (critical) |
| ATT&CK Coverage | MITRE ATT&CK | T1190 |

## Verification

- [ ] Writeup covers all required sections (summary through references)
- [ ] CVSS vector validated and score justified
- [ ] Reproduction steps tested by independent reviewer
- [ ] Detection rules tested against exploit traffic
- [ ] Disclosure timeline documented and followed
- [ ] Vendor notification sent before public disclosure

## References

- [CVE Program](https://www.cve.org/) — Vulnerability identification
- [CVSS v3.1 Calculator](https://www.first.org/cvss/calculator/3.1) — Scoring standard
- [CWE](https://cwe.mitre.org/) — Weakness classification
- [CERT/CC Disclosure Policy](https://vuls.cert.org/confluence/display/Wiki/Vulnerability+Disclosure+Policy) — Disclosure guidelines
