Research

Research: CVE Discovery Loop

Find and prove one novel vulnerability in a target (binary, library, web app/API, firmware, protocol, or source repo). The loop is persistent, resumable, and anti-loop: findings deepen it, dead-ends pivot it, and every step is driven by the knowledge base.

This skill is the research analog of the engagement framework: raw/research/<project>/ is to research what targets/<eng>/ is to an engagement.

---

0. Setup (once per target)

1. Identify target type + version + source. Get the code/binary: repos via WSL clone (wsl -d kali-linux -u kali -- git clone <url> /home/kali/<name>), releases by download.
2. Scaffold: bash setup/new-research.sh <project_name> -> raw/research/<project>/{target,surface,findings,deadends,loop}.md + poc/ (also sets it active in raw/research/active.md, so SessionStart surfaces its status).
3. Build/run it where possible - a runnable target unlocks dynamic testing + fuzzing.
4. Fill target.md: what it is, version, language, build/run commands, trust boundaries.

1. State-first (EVERY iteration, MANDATORY)

Read raw/research/<project>/{loop.md, deadends.md, findings.md} before acting. Never re-run a logged dead-end without new input. Resume from the last iteration. This is the anti-loop rule - the same discipline engagements use. Run python3 scripts/research_status.py for the current phase + ranked next move (also auto-surfaced at SessionStart from raw/research/active.md).

2. Attack-surface map (surface.md)

qmd_query the target's tech/language/framework first, then map by type:

Record in surface.md: entry points (attacker-controlled input), parsers/deserializers, dangerous sinks, privileged ops, dependencies with CVE history.

3. Hypothesize (ranked, in loop.md)

From the surface + knowledge base, write hypotheses as <input/location> + <bug class> = <expected primitive>. Rank by: reachable from an attacker boundary, attacker-controlled, lands in a dangerous sink, historically buggy area, weak/old dependency. Pick the highest-value untested hypothesis (skip anything in deadends.md).

4. Investigate (loop body)

Apply the matching technique + hunt skill + tool to the chosen hypothesis. Bound the effort up front (e.g. fuzz N hours / M execs; audit this component once; sweep this payload class once).

• memory-safety: audit sinks with [[memory-safety-bugs]], then build/point a fuzzer at the parser ([[aflplusplus]] / [[libfuzzer]], always with a sanitizer), triage crashes ([[crash-analysis]]), RE the root cause in [[ghidra]].
• web/logic (source available): work the [[source-audit-checklist]] (sources -> sinks), then invoke the matching hunt-* skill (auth/idor/injection/deser/ssrf/upload/bizlogic/smuggling) to confirm with the payload arsenal.
• injection/parse: malformed/oversized/encoded inputs at each parser; the relevant payload page.
• dependency: [[trivy]] for known-CVE deps -> prove reachability from input.