{
  "slug": "poc-development",
  "title": "Proof of Concept Development",
  "phase": "Reporting",
  "description": "Develop reliable, safe, and convincing proof-of-concept exploits that demonstrate vulnerability impact without causing damage to the target.",
  "difficulty": "medium",
  "tags": [
    "reporting",
    "proof-of-concept",
    "exploit-development",
    "safe-exploitation",
    "documentation"
  ],
  "tools": [
    "curl",
    "Python",
    "Burp Suite",
    "screen recording tools"
  ],
  "steps": [
    {
      "id": "poc-01",
      "title": "Create minimal reproduction script",
      "description": "Write the shortest possible script (curl one-liner or Python) that reproduces the vulnerability from a clean state.",
      "commands": [
        "curl -sk -X POST https://target.com/api/vulnerable -H 'Content-Type: application/json' -d '{\"payload\":\"<script>alert(document.domain)</script>\"}' | grep '<script>'",
        "python3 -c \"import requests; r = requests.post('https://target.com/api/vulnerable', json={'payload': '<script>alert(1)</script>'}); print('Vulnerable!' if '<script>' in r.text else 'Not vulnerable')\""
      ],
      "notes": "The PoC should work with a single copy-paste command. Avoid dependencies beyond standard libraries. Include expected output in comments."
    },
    {
      "id": "poc-02",
      "title": "Ensure safe exploitation",
      "description": "Verify that your PoC does not modify data, delete records, access real user information, or cause denial of service on the target.",
      "commands": [
        "curl -sk https://target.com/api/users/1 -H 'Authorization: Bearer <token>' | python3 -c \"import sys,json; d=json.load(sys.stdin); print(f'Access confirmed: user {d.get(\\\"id\\\",\\\"?\\\")}, email domain: {d.get(\\\"email\\\",\\\"?\\\").split(\\\"@\\\")[1] if \\\"@\\\" in d.get(\\\"email\\\",\\\"\\\") else \\\"?\\\"}')\" "
      ],
      "notes": "Use read-only methods where possible. If the vulnerability requires a state change (e.g., CSRF), use your own test account as the victim. Never demonstrate impact on real user accounts."
    },
    {
      "id": "poc-03",
      "title": "Create automated PoC with clear variable placeholders",
      "description": "Write a self-contained script with clearly marked placeholders (TARGET_URL, SESSION_TOKEN, USER_ID) that a triager can customise and run.",
      "commands": [
        "python3 -c \"\nTARGET = 'https://target.com'\nTOKEN = '<your-session-token>'\nUSER_ID = '<victim-user-id>'\nimport requests\nr = requests.get(f'{TARGET}/api/users/{USER_ID}', headers={'Authorization': f'Bearer {TOKEN}'})\nprint(f'Status: {r.status_code}')\nprint(f'Response: {r.text[:200]}')\n\""
      ],
      "notes": "Use ALL_CAPS for placeholders. Add a comment block at the top explaining what the script does, what it expects, and what output indicates success."
    },
    {
      "id": "poc-04",
      "title": "Record video walkthrough with narration",
      "description": "Create a screen recording that shows the entire exploitation process from start to finish, with text or voice narration explaining each step.",
      "notes": "Keep the video under 3 minutes. Start from a clean browser session. Show the network tab or Burp proxy to demonstrate what happens at the HTTP level. Highlight the moment where the vulnerability triggers."
    },
    {
      "id": "poc-05",
      "title": "Document environment and prerequisites",
      "description": "List all prerequisites, tools, environment details, and accounts needed to reproduce the vulnerability.",
      "commands": [
        "echo 'Browser: Chrome 126.0 | OS: Ubuntu 24.04 | Burp Suite 2024.x | Python 3.12'"
      ],
      "notes": "Include browser version, operating system, any extensions or proxy settings, and whether special network conditions are required. Some vulnerabilities are browser-specific or require particular TLS settings."
    },
    {
      "id": "poc-06",
      "title": "Handle edge cases and failure modes",
      "description": "Document known limitations, race-condition timing requirements, and conditions under which the PoC may fail.",
      "notes": "If the exploit has a success rate below 100%, document it (e.g., \"Race condition succeeds in approximately 3 out of 10 attempts\"). List conditions that prevent exploitation (e.g., \"Requires victim to be logged in within the last 30 minutes\")."
    }
  ],
  "references": [
    "https://docs.hackerone.com/hackers/quality-reports/",
    "https://portswigger.net/web-security",
    "https://cheatsheetseries.owasp.org/cheatsheets/Vulnerability_Disclosure_Cheat_Sheet.html",
    "https://owasp.org/www-project-web-security-testing-guide/",
    "https://github.com/projectdiscovery/nuclei"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-06-17"
}