pentest-exploit-validation

name	pentest-exploit-validation
description	Proof-driven exploitation with 4-level evidence system, bypass exhaustion protocol, mandatory evidence checklists, and strict EXPLOITED/POTENTIAL/FALSE_POSITIVE classification.

Pentest Exploit Validation

Purpose

Validate vulnerability findings through proof-driven exploitation using Shannon's 4-level evidence system. Consumes the exploitation queue from white-box code review, attempts structured exploitation with bypass exhaustion, collects mandatory evidence per vulnerability type, and classifies each finding as EXPLOITED, POTENTIAL, or FALSE_POSITIVE.

Prerequisites

Authorization Requirements

• Written authorization with explicit scope for active exploitation testing
• Exploitation queue JSON from pentest-whitebox-code-review output
• Test accounts at multiple privilege levels for authz testing
• Data exfiltration approval — confirm acceptable proof-of-concept scope
• Rollback plan for any data-mutating exploits

Environment Setup

• sqlmap for automated SQL injection exploitation
• Burp Suite Professional with Repeater, Intruder, and Turbo Intruder
• curl for manual HTTP request crafting
• Playwright for browser-based exploitation (XSS, CSRF)
• nuclei with custom templates for automated validation
• Isolated testing environment or explicit production testing approval

Core Workflow

1. Queue Intake: Parse exploitation queue JSON, validate schema, prioritize by confidence score and impact severity. Group findings by vulnerability type for parallel exploitation.
2. Injection Exploitation: Confirm injectable parameter → fingerprint backend (DB type, OS) → enumerate databases/tables → demonstrate data exfiltration with minimal footprint.