
You have identified a known CVE affecting a target service during an authorized penetration test. Reason through the process of understanding and weaponizing it responsibly.

**CVE Triage**
- What information do you extract from the NVD entry, vendor advisory, and PoC code before touching anything?
- How do you verify the target is actually running the vulnerable version (not just the version string)?
- What are the conditions required for exploitation? (authentication, network position, specific configuration)

**PoC Evaluation**
- Given a public PoC, how do you assess whether it is safe to run in a real engagement?
- What modifications might a raw PoC need to work reliably in a pentest context?
- How do you sandbox-test a PoC before running it against a production system?

**Exploitation in Context**
- How do you adapt an exploit that was written for one OS version to a slightly different target?
- What does "authentication bypass" mean differently across: web apps, VPNs, network devices, databases?
- How do you handle a CVE that requires a specific race condition?

**Weaponization Ethics & Scope**
- What additional authorization do you need before running a potentially destructive exploit?
- How do you document your exploitation attempts and their impact on the target system?
- When do you stop mid-exploitation if something unexpected happens?

**Post-Exploitation From CVE**
- Once you have code execution via a CVE, what are your next three actions?
- How do you establish persistence without using the same CVE path twice?

Output:
- CVE evaluation framework (triage → test → adapt → execute)
- Risk decision tree: proceed / modify / skip
- Post-exploitation immediate actions checklist


CVE Analysis & Weaponization


You are planning a complex attack chain that requires combining multiple vulnerabilities across different systems to reach your objective.

**Chain Design Principles**
- What makes an exploit chain reliable vs fragile?
- How do you handle failure at any single link — what is your fallback at each step?
- How does chain length affect detection probability and operational security?

**Pre-Chain Requirements**
- What reconnaissance must be complete before you begin chaining?
- How do you validate each prerequisite without tipping off defenders?
- What persistence mechanism do you establish before beginning a noisy chain?

**Transition Points**
- How do you move cleanly from external to internal network access?
- When switching from web application exploitation to OS-level access, what changes in your approach?
- How do you maintain a stable foothold while executing subsequent chain steps?

**Example Chain Types**

*Web → OS → Domain*
- XSS credential theft → VPN login → internal web app → command injection → domain enumeration

*Phishing → Endpoint → Network*
- Malicious document → macro → staged payload → local priv-esc → lateral movement

*Supply Chain → Customer Environment*
- Compromise of a software vendor → backdoored update → mass deployment → C2 activation

**Timing & Synchronization**
- When does it matter to execute chain steps quickly vs slowly?
- How do you handle time-limited tokens or sessions mid-chain?

Output:
- Chain planning template with prerequisite, action, fallback per step
- Risk assessment at each transition point
- Two complete chain examples with annotated reasoning


Multi-Step Exploit Chain Planning


You are exploiting a classic stack buffer overflow in a 32-bit Linux binary during a CTF or authorized penetration test.

**Vulnerability Confirmation**
- How do you confirm a buffer overflow is stack-based vs heap-based?
- What crash output confirms EIP control? What does a segfault without EIP control tell you?
- How do you determine the exact offset to EIP using a cyclic/De Bruijn pattern?

**Environment Profiling**
- Which protections are active? (ASLR, NX/DEP, Stack Canary, PIE)
- How does each active protection change your exploit strategy?
- How do you check for exploitable memory regions when NX is off?

**Shellcode Approach (NX disabled)**
- How do you find a reliable return address to your shellcode?
- Why do NOPs matter and how large should a NOP sled be?
- How do you handle bad characters in your shellcode?
- How do you generate shellcode for a specific OS and architecture?

**ROP Approach (NX enabled)**
- What is a ROP gadget and how do you find one?
- What is the minimum ROP chain to call system("/bin/sh")?
- How do you handle ASLR if a library base leak is available?

**Exploit Reliability**
- What makes an exploit unreliable across environments?
- How do you test an exploit across multiple OS versions or configurations?

Output:
- Step-by-step exploitation methodology
- Checklist: protections → technique selection
- Pwntools skeleton for 32-bit Linux ret2shellcode and ret2libc


Stack Buffer Overflow Exploitation


You have completed a vulnerability scan and identified 47 findings across a target environment. You have limited time and need to decide which to exploit first.

**Scoring Beyond CVSS**
- Why is CVSS score alone a poor prioritization metric in a real engagement?
- What factors actually determine exploitability in context? (network position, authentication required, patch status, compensating controls)
- How do you weight a low-CVSS finding that gives code execution vs a Critical-CVSS finding that is unpatched but unexploitable in this network?

**Attack Chain Thinking**
- How do you chain low-severity findings together for higher-impact results?
- What is a "pivot point" vulnerability and why does it deserve higher priority than its standalone severity suggests?
- How do you build an attack graph from your vulnerability list?

**Exploitation Complexity**
- How do you assess the reliability of a public exploit before using it?
- What is the difference between a PoC that demonstrates the bug vs a weaponized exploit ready for use?
- How do you estimate the time cost of developing a custom exploit vs moving to another target?

**Business Logic**
- How does the business context of a target change which vulnerabilities you pursue?
- Why might a data exposure vulnerability with no CVE be more impactful than a remote code execution in a test environment?

Output:
- Prioritization matrix template (impact × exploitability × position × business context)
- Decision flowchart for "exploit now / research / skip"
- 5 examples of finding chains that compound impact


Exploitation Strategy

CVE Analysis & Weaponization

Multi-Step Exploit Chain Planning

Stack Buffer Overflow Exploitation

Vulnerability Prioritization for Exploitation