<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-exploit-reliability-testing
description: >-
  Test exploit reliability across target configurations, OS versions, and mitigation states including ASLR, DEP, CFI, and stack canary bypass verification with statistical success metrics.
domain: cybersecurity
subdomain: exploit-development
tags:
  - reliability
  - exploit-testing
  - aslr
  - dep
  - cfi
  - mitigation-bypass
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190", "T1203"]
  frameworks: ["MITRE ATT&CK", "Metasploit"]
  tools: ["python3", "pwntools", "checksec", "gdb"]
---

# Performing Exploit Reliability Testing

## Overview

Exploit reliability testing validates that exploits work consistently across
target configurations, OS versions, and mitigation states. Statistical testing
quantifies success rates and identifies failure modes for improvement.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `python3` | Security tooling |
| `pwntools` | Security tooling |
| `checksec` | Security tooling |
| `gdb` | Security tooling |
| `Docker for multi-version testing` | Security tooling |
| Working exploit in development state | Environment requirement |
| Multiple target versions for cross-version testing | Environment requirement |
| Isolated lab network | Environment requirement |

## Workflow

### Step 1: Target Environment Matrix

```bash
# Build test matrix from target configurations
node scripts/agent.js matrix --binary ./target \
  --os "ubuntu-20.04,ubuntu-22.04,debian-12" \
  --mitigations "aslr,dep,canary,pie"

# Check binary protections per target
checksec --file=./target_ubuntu2004
checksec --file=./target_ubuntu2204
checksec --file=./target_debian12
```

### Step 2: Statistical Reliability Testing

```bash
# Run exploit N times and collect success metrics
node scripts/agent.js test --exploit exploit.py --target target.lab \
  --port 9999 --runs 200 --output results.json

# Expected output:
# {
#   "total_runs": 200,
#   "successes": 186,
#   "failures": 14,
#   "success_rate": 0.93,
#   "failure_modes": {"timeout": 8, "crash": 4, "no_shell": 2},
#   "mean_time_ms": 1250,
#   "p95_time_ms": 3400
# }
```

### Step 3: Mitigation Impact Analysis

```bash
# Test with individual mitigations enabled/disabled
node scripts/agent.js mitigations --exploit exploit.py --target target.lab \
  --test-aslr --test-dep --test-canary --runs 100

# ASLR impact test
echo 0 | sudo tee /proc/sys/kernel/randomize_va_space  # Disable
python3 exploit.py --target target.lab  # Should work
echo 2 | sudo tee /proc/sys/kernel/randomize_va_space  # Enable
python3 exploit.py --target target.lab  # Test ASLR bypass
```

### Step 4: Failure Analysis and Improvement

```bash
# Analyze failure modes from test results
node scripts/agent.js analyze --results results.json

# Debug specific failure case
gdb -batch -ex "run" -ex "bt full" -ex "info registers" \
  --args python3 exploit.py --target target.lab --debug

# Generate reliability report
node scripts/agent.js report --results results.json --output reliability_report.md
```

## Detection

```yaml
title: Exploit Reliability Testing Detection
id: b650a29d-3671-4ff0-8475-f8bf736cc3eb
status: experimental
description: Detects suspicious activity related to performing exploit reliability testing techniques in exploit development context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*exploit*"
  condition: selection
level: critical
tags:
  - attack.t1190
  - attack.t1203
  - attack.execution
falsepositives:
  - Vulnerability scanner testing known exploit signatures
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Exploit Reliability Testing Detection | windows/process_creation | Sigma rule (critical) |
| ATT&CK Coverage | MITRE ATT&CK | T1190, T1203 |

## Verification

- [ ] Exploit tested across target environment matrix
- [ ] Success rate meets engagement threshold (>90% typical)
- [ ] Failure modes identified and documented
- [ ] Mitigation bypass verified for each protection
- [ ] Reliability report generated with statistical analysis

## References

- [checksec](https://github.com/slimm609/checksec.sh) — Binary protection checker
- [pwntools](https://docs.pwntools.com/) — Exploit development framework
- [ASLR Implementation](https://www.kernel.org/doc/html/latest/admin-guide/sysctl/kernel.html) — Linux kernel ASLR docs
