Exploit Analysis
Framework for analysing public exploits and proof-of-concept code. Exploitability assessment, root cause classification, detection opportunities, and MITRE ATT&CK mapping.
Exploitability Scale
Theoretical
No public PoC. Vulnerability description only. Academic/theoretical feasibility.
Proof of Concept
Public PoC exists. Requires significant modification and expertise to weaponise.
Functional
Working exploit. Requires some complexity — understanding of target environment.
Reliable
Reliable exploit. Limited skill required. Near-push-button exploitation.
Weaponised
Fully automated. Used in active campaigns. Metasploit module or crimeware kit.
Root Cause Classification
Memory Corruption
Buffer overflow, heap spray, use-after-free, format string. Common in C/C++ codebases.
Injection Flaws
SQL, command, LDAP, XPath, template injection. Attacker-controlled data reaches interpreter.
Logic / Auth Bypass
Authentication bypass, privilege escalation, insecure direct object references.
Deserialization
Unsafe object deserialization leads to RCE. Java, PHP, Python pickle, .NET BinaryFormatter.
SSRF / Path Traversal
Server-side request forgery enabling internal network access or credential theft.
Detection Opportunities
Network Layer
Protocol anomalies, exploit payloads in traffic, unusual connection patterns to target services.
Process Behaviour
Unexpected child process creation, unusual parent-child relationships, process hollowing.
Memory Forensics
Shellcode patterns, ROP chains, unusual memory allocations in process space.
File System
Dropped payloads, staged files, persistence mechanisms (registry, cron, services).
Authentication Logs
Token manipulation, privilege escalation events, unusual access patterns post-exploitation.
Notable High-Impact Exploits
JNDI injection via user-controlled log data. CVSS 10.0. Weaponised within 12 hours. Millions of internet-facing apps affected.
SQL injection in MOVEit Transfer web app. Cl0p exploited as zero-day before patch. 2600+ organisations, 95M+ individuals.
Pre-auth SSRF, chained with CVE-2021-26857 (deserialization) and CVE-2021-27065 (post-auth file write) for full RCE on Exchange. Exploited by HAFNIUM and 10+ groups.
Buffer over-read leaks authentication session tokens. LockBit and others exploited post-patch against unpatched NetScaler instances.
Zero-day command injection in GlobalProtect VPN. Exploited before patch by UTA0218. CVSS 10.0.
Type confusion in the V8 JavaScript engine allows a remote attacker to execute arbitrary code inside the Chromium sandbox via a crafted HTML page. Added to CISA KEV Sep 4, 2026. Affects all Chromium-based browsers; apply browser updates immediately across all endpoints.
Server-side request forgery allows a remote unauthenticated attacker to access sensitive internal functionality on SonicWall SMA1000 appliances. Added to CISA KEV Sep 2, 2026. SonicWall SSL VPN appliances are a primary initial-access vector in ransomware campaigns targeting India.
Authentication bypass allows unauthenticated attackers with network access to obtain full administrative privileges under default configuration. Added to CISA KEV September 2026. High supply-chain risk — Artifactory manages build artefacts and embedded secrets for CI/CD pipelines.
Incorrect use of privileged APIs allows an attacker to bypass web management interface access restrictions. Added to CISA KEV Sep 16, 2026 with a Sep 19 federal remediation deadline — confirmed active exploitation against identity/NAC infrastructure.
MITRE ATT&CK Exploit Techniques
Exploit Intelligence Sources
Exploit-DB
Archive of exploits and vulnerable software maintained by Offensive Security
Packet Storm
Security exploits, advisories and tools archive since 1998
NVD (NIST)
National Vulnerability Database with CVSS scoring and reference links
CISA KEV
Confirmed in-the-wild exploited vulnerabilities requiring immediate action
EPSS
Exploit Prediction Scoring System — probability a CVE will be exploited in 30 days
GitHub PoC-in-GitHub
Aggregated list of PoC exploits from GitHub repositories by CVE
Related Vulnerability Research
Search 250,000+ CVEs from the NIST National Vulnerability Database. Live CVSS scores, CWE mappings and vendor references.
CVSS 3.1 base score calculator. Compute scores from attack vector, complexity, privileges, scope and impact metrics.
Security advisory schedules and patch cadence for Cisco, Fortinet, Microsoft, Palo Alto, Juniper and 20+ vendors.
Layered mitigation playbooks for RCE, SQLi, SSRF, Deserialization, Auth Bypass and XXE. WAF rules and compensating controls when patches can't deploy immediately.
Patch prioritisation framework: CVSS score, CISA KEV status, exploit availability and environmental context scoring.
Frequently Asked Questions
What is exploit weaponisation?
The process of turning a proof-of-concept (PoC) into a reliable, repeatable exploit — potentially automated or packaged into a tool like a Metasploit module — that requires little skill to use.
What is the difference between a PoC and a working exploit?
A PoC demonstrates a vulnerability is real, often unreliably and requiring modification; a working exploit reliably achieves the intended effect, such as code execution, against a defined target configuration.
What is EPSS?
The Exploit Prediction Scoring System, maintained by FIRST.org, estimates the probability (0 to 1) that a given CVE will be exploited in the wild within the next 30 days, based on real-world exploitation data.
Why do defenders track exploit analysis instead of just patching?
Patch windows aren't always immediate — testing, legacy systems, vendor delay — so understanding how a vulnerability is actually exploited lets defenders build detections and compensating controls in the meantime.