exploit-development

Develops proof-of-concept exploits for verified vulnerabilities in authorized security testing.

1|Updated Mar 12, 2026
One-click install
npx skills add https://github.com/kaminocorp/hermes-alpha-hunter --skill exploit-development-kaminocorp
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: exploit-development
Source: https://github.com/kaminocorp/hermes-alpha-hunter/tree/main/hunter/skills/security/exploit-development
Command: npx skills add https://github.com/kaminocorp/hermes-alpha-hunter --skill exploit-development-kaminocorp

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests.

What problem does it solve? Security researchers and bug bounty hunters need to demonstrate the real-world impact of discovered vulnerabilities with reproducible proof-of-concept exploits, but building reliable, well-documented PoCs from scratch is time-consuming and error-prone. ## Core Features & Use Cases - Vulnerability Analysis Workflow: Structured process for tracing data flow from input entry points to vulnerable sinks before writing any exploit code. - Exploit Templates: Ready-to-adapt Python templates for SQL injection, IDOR, and command injection, plus payload generators and chained-exploit patterns (e.g., XSS-to-CSRF). - Testing Framework & Reporting: A bash-based exploit testing harness with result logging, plus a documentation template covering impact analysis, CVSS-style severity, and mitigation guidance. - Use Case: After confirming a SQL injection in a bounty target's search endpoint, use the SQL injection template to verify exploitability, extract schema information to demonstrate impact, and produce a reproducible report for the bounty submission. ## Quick Start Ask the agent to develop a proof-of-concept exploit for a verified SQL injection vulnerability in your authorized test target and document the impact for a bounty report.

Frequently Asked Questions about exploit-development

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a proof-of-concept exploit for a SQL injection vulnerability?▼

Start by analyzing the data flow from user input to the vulnerable query, then use the SQL injection template to test payloads like UNION SELECT and time-based probes. Confirm exploitability, extract minimal data to demonstrate impact, and document every step for reproducibility.

How to test for IDOR vulnerabilities in a web application?▼

Authenticate as a regular user, then iterate through resource IDs on endpoints like profile or document viewers and check whether unauthorized objects return valid data. The IDOR template automates this enumeration and summarizes accessible resources to demonstrate impact.

What should a bug bounty exploit report include?▼

Include the target and vulnerability type, prerequisites like authentication, step-by-step exploitation commands with expected results, impact analysis across confidentiality, integrity, and availability, and mitigation recommendations. Reproducibility is essential for triage teams.

Is it legal to develop exploits for security testing?▼

Exploit development is legal only within authorized scopes such as bug bounty programs, penetration testing engagements, or your own systems. This skill enforces proof-of-concept-only principles: no real data extraction, no persistence, and no actions beyond program scope.

Why does my command injection payload not execute?▼

Common causes include input sanitization, context-specific filtering of shell metacharacters, or the parameter not reaching a system shell. Try alternate separators like pipes, backticks, or $() substitution, and check responses for indicators such as uid= output or directory listings.