Exploitation Techniques
Exploitation techniques
This domain tests controlled exploitation to prove impact without causing harm. Expect web, network service, and credential attacks; proof-of-concept discipline; rules of engagement; and evidence capture.
Core rules
- Exploit only in scope, with a stop condition and a rollback plan. Prefer the least invasive proof: a benign file read, a unique marker, or a screenshot over a destructive shell.
- Verify manually. Automated exploits often report success falsely; confirm with a second channel, such as an out-of-band interaction or a controlled command.
- Preserve evidence: request/response, payload, timestamp, target, and result. Redact secrets.
- Stop at the agreed objective; do not pivot, persist, or exfiltrate unless authorized.
Worked example
A search page reflects the q parameter unencoded. You submit <script>alert(document.domain)</script> using a test account and receive the payload in the response. Reasoning: reflection alone is not proof of exploitability; you check the response context and confirm the browser executes it. You capture the request, response, and a screenshot showing the domain, then stop. You do not target real users or use a payload that steals cookies. Remediation: context-aware output encoding, CSP, and input validation.
Traps
- Using
' OR 1=1--on production and calling it proof without checking data changes. - Running exploits that alter records, create users, or delete files.
- Treating a Metasploit “session opened” message as sufficient evidence.
- Ignoring WAF behavior and claiming a vulnerability is absent.
- Failing to clean up uploaded files, test accounts, or shells.
- Testing outside the authorized window or against third-party shared infrastructure.