CVE Analysis & Weaponization

You have identified a known CVE affecting a target service during an authorized penetration test. Reason through the process of understanding and weaponizing it responsibly.

**CVE Triage**
- What information do you extract from the NVD entry, vendor advisory, and PoC code before touching anything?
- How do you verify the target is actually running the vulnerable version (not just the version string)?
- What are the conditions required for exploitation? (authentication, network position, specific configuration)

**PoC Evaluation**
- Given a public PoC, how do you assess whether it is safe to run in a real engagement?
- What modifications might a raw PoC need to work reliably in a pentest context?
- How do you sandbox-test a PoC before running it against a production system?

**Exploitation in Context**
- How do you adapt an exploit that was written for one OS version to a slightly different target?
- What does "authentication bypass" mean differently across: web apps, VPNs, network devices, databases?
- How do you handle a CVE that requires a specific race condition?

**Weaponization Ethics & Scope**
- What additional authorization do you need before running a potentially destructive exploit?
- How do you document your exploitation attempts and their impact on the target system?
- When do you stop mid-exploitation if something unexpected happens?

**Post-Exploitation From CVE**
- Once you have code execution via a CVE, what are your next three actions?
- How do you establish persistence without using the same CVE path twice?

Output:
- CVE evaluation framework (triage → test → adapt → execute)
- Risk decision tree: proceed / modify / skip
- Post-exploitation immediate actions checklist