pentest-exploit-execution-payload-control
Exploit Execution & Payload Control
Activation Triggers (Positive)
build exploitweaponizepayloadchain findingsprove impactpost exploitation
Exclusion Triggers (Negative)
reconenumerationhypothesis onlyformat report
Output Schema
- Exploit plan:
preconditions,primitive,payload strategy,safety guardrails - Execution log:
step,result,evidence - Final capability statement: what attacker can do after exploitation
Instructions
- Require at least one validated security primitive before exploit implementation.
- Choose deterministic payloads with clear rollback or containment strategy.
- Execute in smallest viable sequence to prove impact with minimal disruption.
- Record exact preconditions and environmental dependencies.
- Separate exploit reliability issues from vulnerability existence.
- Produce reproducible commands and evidence suitable for independent verification.
Should Do
- Prefer deterministic, low-noise payloads over broad spray strategies.
- Preserve proof artifacts that map directly to attacker capability.
- Stop when impact is proven; avoid unnecessary escalation.
Should Not Do
- Do not claim successful exploitation from partial side effects.
- Do not run destructive payloads unless explicitly authorized.
- Do not rely on environment-specific hardcoded tooling paths in reusable instructions.
More from crtvrffnrt/skills
pentest-xss
Security assessment skill for Cross-Site Scripting (XSS) vulnerabilities. Use when investigating input sanitization, reflected, stored, DOM, or blind XSS. Focuses on discovery, exploitation, and payload optimization. Do not use for generic network recon or non-web injection types.
36pentest-recon-surface-analysis
Security assessment skill for reconnaissance, endpoint/service enumeration, and attack-surface mapping. Use when prompts include recon, enumerate, map endpoints, discover assets, inventory interfaces, fingerprint technologies, or identify control-plane surfaces. Do not use when the request is exploit development, payload execution, or final report writing only.
29pentest-business-logic-abuse
Security assessment skill for business workflow abuse, state-machine manipulation, and control-plane logic flaws. Use when prompts include workflow bypass, race condition, replay, quota abuse, order-of-operations flaws, delegated execution abuse, or unauthorized state transitions. Do not use for pure input injection fuzzing, broad recon, or standalone report formatting tasks.
27pentest-gemini-az
Use when users need an Azure, Microsoft 365, or Entra ID companion that reads, lists, changes, and manages resources using the current Azure CLI session, with `az rest` as the default execution path.
26pentest-outbound-interaction-oob-detection
Security assessment skill for outbound interaction and out-of-band (OOB) validation. Use when prompts include SSRF callback confirmation, blind XSS beacons, webhook abuse, XXE/OOB behavior, DNS/HTTP callback correlation, or asynchronous server-side interaction proof. Do not use when vulnerabilities are fully in-band and require no external callback correlation.
25pentest-evidence-structuring-report-synthesis
Security assessment skill for structuring evidence, deduplicating findings, and producing decision-ready security reports. Use when prompts include write report, consolidate findings, severity ranking, remediation guidance, executive summary, or technical appendix generation. Do not use for live exploit execution, reconnaissance, or payload experimentation tasks.
25