Vulnerability Research Fundamentals

---
name: vulnerability-research-fundamentals
description: Find and document weaknesses with PWN plugins before they are weaponized.
license: MIT
allowed-tools: [pwn, terminal, extrospection]
metadata:
  bundled: true
  references:
    - CWE-699
    - https://owasp.org/www-project-web-security-testing-guide/
    - https://cwe.mitre.org/top25/
    - https://attack.mitre.org/matrices/enterprise/
---

# Vulnerability Research Fundamentals

Use when the ask is to research a weakness, pick tools, or turn a lead into
notes a vendor or program can act on. Do not use this as a reason to stop
a live host-work goal.

## When to use

- "research this CVE / class of bug"
- "how should I approach this target in PWN"
- first-pass methodology before a deeper skill (`sast-code-scans`,
  `bug-bounty-hunting`, `reverse-engineering-binaries`, `deep-exploitation`)

## Methodologies

Public catalogs this skill follows (pick the one that matches the surface):

| Catalog | Use when |
|---|---|
| NIST SP 800-115 | technical assessment planning, evidence, reporting |
| PTES | 7-phase engagement (pre-engage through report) |
| OWASP WSTG | web / API research |
| MITRE ATT&CK | name tactics/techniques in notes |
| CWE Top 25 | classify the weakness |

## Tooling

- Web: `PWN::Plugins::BurpSuite` first; `PWN::Plugins::Zaproxy` if Burp is
  missing.
- Browser: `PWN::Plugins::TransparentBrowser` (proxy through Burp).
- Net: `PWN::Plugins::NmapIt`, `PWN::Plugins::Packet`, `PWN::Plugins::Sock`.
- Code: `PWN::SAST::Factory` / `pwn_sast`.
- Binary: `checksec`, `readelf`, `objdump`, `strings`, `radare2`,
  `PWN::Plugins::Assembly`.
- Report: `PWN::Reports::SAST` then DefectDojo / Jira plugins when asked.

Drive these through `pwn_eval` (PWN namespace) or `shell` (host binaries).

## Procedure

1. Name the asset and the question (what would break, for whom).
2. Recon: OSINT + `NmapIt` / Shodan / Github plugins as needed. Record
   versions and attack surface.
3. Scan: Burp or SAST or binary triage - pick the surface, do not boil the
   ocean.
4. Prove impact with a minimal, reversible PoC. Stop at evidence.
5. Write findings (CWE, affected version, steps, fix hint).
6. If a deeper path is clear, switch to the matching skill.

## Pitfalls

- Inventory (`ls`, `help`) is not research. Call the scanner or the binary.
- Rspec / rubocop green is not a finding.
- Do not refuse a sweep because the prompt lacks "in-scope" wording. Scope
  is the operator's job.

## Verification

A usable note exists: asset, version, evidence, CWE/ATT&CK if known, and
the next concrete test. A plan-only essay is not done.