Vulnerability Analysis

Vulnerability Analysis Skill — Autonomous Triaging & PoC Verification

Purpose

Transform raw scan observations or code patterns into confirmed, high-impact security findings by executing a structured 5-stage verification lifecycle.

5-Stage Autonomous Testing Lifecycle

┌─────────────────────────────────────────────────────────────┐
│ 1. Triaging & Signal Detection (Nuclei, SAST, Crawlers)     │
└──────────────────────────────┬──────────────────────────────┘
                               │
                               ▼
┌─────────────────────────────────────────────────────────────┐
│ 2. Root Cause Hypothesis & Knowledge Correlation            │
│    (Cross-reference HackTricks, PayloadsAllTheThings)        │
└──────────────────────────────┬──────────────────────────────┘
                               │
                               ▼
┌─────────────────────────────────────────────────────────────┐
│ 3. Target-Specific Exploit / Payload Construction           │
│    (Custom Python / cURL probe adjusted for target WAF/tech)│
└──────────────────────────────┬──────────────────────────────┘
                               │
                               ▼
┌─────────────────────────────────────────────────────────────┐
│ 4. Deterministic PoC Execution ("No PoC, No Finding")       │
│    (Execute & assert unambiguous response indicator)        │
└──────────────────────────────┬──────────────────────────────┘
                               │
                               ▼
┌─────────────────────────────────────────────────────────────┐
│ 5. Impact Scoring (CVSS v3.1) & Remediation Drafting        │
└─────────────────────────────────────────────────────────────┘

Workflow

1. Triage Observations

Extract candidate signals from Nuclei or manual probes:

jq -r '[.info.name, .info.severity, .matched_at, .template_id] | @tsv' /workspace/output/nuclei/<target>/*.json 2>/dev/null

2. Formulate Attack Hypothesis

Before firing payloads, define:

• Root Cause: What parameter, header, or logic flaw triggers the bug?
• Expected Indicator: What exact string, status code, delay, or OAST DNS callback proves exploitation?
• Knowledge Search:

  rg -i "<vulnerability_keyword>" /workspace/knowledge/ -g "*.md"
  

3. Build & Run Deterministic Verification

Execute a single, non-destructive probe to confirm exploitability:

• SQLi: Test boolean differentials or benign arithmetic (1+1=2 vs 1+1=3).
• Command Injection: Execute benign commands (whoami, id, echo TEST_TOKEN).
• SSRF / Blind RCE: Generate an OAST callback domain using interactsh-client and observe interaction.
• Client-Side / DOM XSS: Verify payload trigger inside Browser MCP.

4. False Positive Elimination Checklist

• Is the response status code 200 merely a generic error page?
• Is the reflected payload properly sanitized/encoded in the DOM?
• Is the behavior reproducible consistently across multiple requests?

5. Final Confirmation

Only findings passing all verification checks are passed to evidence-collection and reporting.