Definition and Overview

Exploitation is the phase of penetration testing and adversarial security assessment where discovered vulnerabilities are actively leveraged to achieve unauthorized access, privilege escalation, data exfiltration, or other objectives that demonstrate the real-world impact of security weaknesses. Unlike vulnerability scanning, which identifies potential weaknesses, exploitation proves that a weakness is actually exploitable under realistic conditions, providing concrete evidence of risk that drives remediation prioritization.

The exploitation phase follows reconnaissance and vulnerability identification in the standard penetration testing methodology. It precedes post-exploitation (establishing persistence, lateral movement, data collection) and reporting. Ethical exploitation is always conducted under explicit authorization, within defined scope boundaries, and with safeguards to prevent unintended damage to production systems. The goal is not to cause harm but to demonstrate what an actual attacker could achieve, enabling defenders to close gaps before they are exploited maliciously.

The ethics and legality of exploitation activities are governed by strict boundaries. Authorized penetration testing operates under a Rules of Engagement (RoE) document that specifies scope (which systems can be tested), timing (when testing can occur), techniques (what methods are permitted), and escalation procedures (what to do if critical vulnerabilities are found or unintended access is gained). Testing without authorization -- regardless of intent -- is illegal in most jurisdictions under computer fraud laws such as the CFAA (US), Computer Misuse Act (UK), and similar statutes.

Technical Deep Dive

Exploitation Methodology (PTES Framework)

Phase	Activities	Deliverable
Pre-exploitation	Vulnerability validation, exploit selection, environment prep	Exploit plan
Exploitation	Payload delivery, vulnerability trigger, initial access	Proof of concept
Post-exploitation	Privilege escalation, persistence, lateral movement	Impact assessment
Cleanup	Artifact removal, backdoor removal, state restoration	Clean system
Reporting	Finding documentation, risk rating, remediation guidance	Assessment report

Vulnerability Classes and Exploitation Patterns

Class	Example Vulnerabilities	Exploitation Technique
Injection	SQL injection, command injection, LDAP injection	Crafted input triggering unintended execution
Authentication	Default credentials, weak passwords, token flaws	Credential stuffing, brute force, token forging
Authorization	IDOR, privilege escalation, path traversal	Direct object reference manipulation
Configuration	Exposed admin panels, debug endpoints, default configs	Direct access to misconfigured services
Memory	Buffer overflow, use-after-free, format string	Shellcode injection, ROP chains
Logic	Race conditions, business logic flaws, state manipulation	Timing attacks, workflow bypass
Cryptographic	Weak algorithms, key reuse, padding oracle	Decryption, signature forgery

Risk Rating Matrix

Exploitability	Impact	Risk Level	Action
Easy (public exploit)	Critical (data breach)	Critical	Immediate remediation
Easy	High (system access)	High	Remediate within 24h
Moderate	Critical	High	Remediate within 72h
Moderate	Moderate	Medium	Remediate within 30d
Difficult	Low	Low	Remediate within 90d
Theoretical only	Any	Informational	Document and monitor

Architecture and Implementation

Exploitation activities in a structured security program operate within a controlled environment that separates testing from production. The architecture includes an authorized scope boundary (defining which systems can be tested), monitoring infrastructure (capturing all exploitation activity for audit), communication channels (for immediate escalation of critical findings), and rollback capabilities (to restore systems affected by exploitation attempts).

Modern exploitation workflows increasingly use automation for common vulnerability classes. Automated exploitation tools validate known CVEs, test for default credentials, and verify common misconfigurations at scale. However, complex exploitation chains -- where multiple low-severity vulnerabilities are combined to achieve high-impact outcomes -- still require human creativity and deep system understanding.

The Prismatic Platform's Red Team operates exclusively within a sandboxed simulation environment. No exploitation code is executed against real systems. Instead, the Red Team generates theoretical attack scenarios based on the platform's vulnerability taxonomy, which are then reviewed by the Purple Team for defensive coverage and by the Blue Team for detection capability.

Usage in Prismatic Platform

The Prismatic Platform models exploitation scenarios through its Color Team security architecture, using the Red Team's scenario generation capabilities to test defensive readiness without executing actual exploits.

defmodule Prismatic.Security.ExploitationScenario do
  @moduledoc """
  Models exploitation scenarios for Red Team exercises.
  Operates in SIMULATION ONLY mode -- no actual exploitation
  code is generated or executed. Scenarios describe theoretical
  attack paths for defensive assessment.

  Authorization: CTF challenges, defensive research, authorized
  penetration testing planning ONLY.
  """

  @type technique :: :injection | :authentication | :authorization | :configuration | :logic
  @type severity :: :critical | :high | :medium | :low | :informational

  @type scenario :: %{
    id: String.t(),
    name: String.t(),
    technique: technique(),
    vulnerability_class: String.t(),
    attack_vector: String.t(),
    preconditions: list(String.t()),
    expected_impact: String.t(),
    severity: severity(),
    detection_signatures: list(String.t()),
    mitigations: list(String.t()),
    simulation_only: true
  }

  @spec generate_scenario(technique(), map()) :: {:ok, scenario()}
  def generate_scenario(technique, context) do
    scenario = %{
      id: "RS-#{Ecto.UUID.generate() |> String.slice(0..7)}",
      name: build_scenario_name(technique, context),
      technique: technique,
      vulnerability_class: classify_vulnerability(technique),
      attack_vector: describe_attack_vector(technique, context),
      preconditions: list_preconditions(technique),
      expected_impact: assess_impact(technique, context),
      severity: calculate_severity(technique, context),
      detection_signatures: generate_detection_rules(technique),
      mitigations: recommend_mitigations(technique),
      simulation_only: true
    }

    {:ok, scenario}
  end

  @spec assess_exploitability(map()) :: %{score: float(), factors: list(String.t())}
  def assess_exploitability(vulnerability) do
    factors = [
      {"Public exploit available", Map.get(vulnerability, :public_exploit, false), 0.3},
      {"No authentication required", Map.get(vulnerability, :no_auth, false), 0.2},
      {"Network accessible", Map.get(vulnerability, :network, true), 0.2},
      {"Low complexity", Map.get(vulnerability, :low_complexity, false), 0.15},
      {"No user interaction", Map.get(vulnerability, :no_interaction, false), 0.15}
    ]

    score =
      Enum.reduce(factors, 0.0, fn {_name, present, weight}, acc ->
        if present, do: acc + weight, else: acc
      end)

    active_factors =
      factors
      |> Enum.filter(fn {_name, present, _weight} -> present end)
      |> Enum.map(fn {name, _present, _weight} -> name end)

    %{score: score, factors: active_factors}
  end

  defp build_scenario_name(technique, _ctx), do: "#{technique}_scenario"
  defp classify_vulnerability(technique), do: to_string(technique)
  defp describe_attack_vector(_technique, _ctx), do: "Simulated attack vector"
  defp list_preconditions(_technique), do: ["Network access to target"]
  defp assess_impact(_technique, _ctx), do: "Theoretical impact assessment"
  defp calculate_severity(_technique, _ctx), do: :medium
  defp generate_detection_rules(_technique), do: ["Anomalous request pattern"]
  defp recommend_mitigations(_technique), do: ["Input validation", "Access control"]
end

Cross-References

Vulnerability -- Security weaknesses targeted by exploitation
Red Team -- Adversarial simulation team
Penetration Testing -- Authorized security testing methodology
CVE -- Common vulnerability identifiers
CSIRT -- Incident response to exploitation attempts
Livebooks: security_compliance/ notebooks model exploitation scenarios
Academy: AdvancedThreatHunting topic covers exploitation detection

Connect & Contribute

Created by Tomas Korcak (korczis) | Open Source under GHL

GitHub | GitLab | LinkedIn | Contact
Developer Portal | Architecture | Meet the Creator

Exploitation