Exploitation¶

Exploitation should prove impact with the least disruptive action that still answers the security question.

Goals¶

• Demonstrate that the issue is real.
• Show the practical security boundary that fails.
• Preserve service stability and reversibility wherever possible.

Rules of engagement¶

• Re-read scope before using any destructive or state-changing action.
• Prefer read-only proof over write access when both show the same boundary failure.
• Avoid persistence unless it is explicitly authorized.
• Stop once you have enough evidence for a credible report.

Proof quality¶

• Use deterministic commands or requests.
• Keep payloads minimal and understandable.
• Separate one issue from chained follow-on issues.
• Document prerequisites so another reviewer can replay the path.

Hand-off to reporting¶

Every successful proof should end with:

• the exact trigger condition
• the affected asset and privilege boundary
• the observed impact
• any cleanup or rollback performed