Validation

GATE: Either source rules it out? DISCARD. Both clear? Proceed to Layer 1. LOW confidence? Test last, not first.

Layer 1 - Reproduction

Execute the exploit and capture evidence. Method depends on vuln class:

Before advancing: Identify root cause vs symptom. Where does the error manifest? Where does the root cause live? If fixing the symptom wouldn't fix the vuln, the root cause is upstream - find it.

Validation decay: 2 failed attempts with same method? STOP that approach. Change method or surface as [NEEDS-PROOF].

Blind/OOB troubleshooting (in order)

1. OOB server alive? curl your own URL.
2. DNS resolves? nslookup your domain.
3. Target can reach internet? Try timing canary first.
4. Payload injected? Check response code (400 = rejected, 200/500 = processed).
5. Payload format correct? XXE needs XML wrapping, SSRF needs full URL.
6. WAF blocking outbound? Try DNS-only, IP address, URL encoding, standard ports.
7. Wrong protocol? Try HTTPS instead of HTTP.
8. Async execution? Wait 5-10 minutes, re-check.

Time-based methodology

1. Baseline: 3 normal requests, record times
2. Inject: 3 requests with SLEEP(5), record times
3. Pass: injected_avg - baseline_avg > 4000ms
4. Fail: delta < 3000ms
5. Ambiguous (3000-4000ms): increase to SLEEP(10), retry
6. Jitter > 2000ms baseline variance: switch to OOB testing
7. Confirm controllability: SLEEP(5) vs SLEEP(10) should differ by ~5s

GATE: Layer 1 evidence captured (browser, proxy, OOB, or timing)? Proceed to Layer 0B. No evidence via ANY channel? STOP. Finding is dead. Do not proceed.

Layer 0B - Deep By-Design Check (after Layer 1 confirms)

Now it's worth researching. Check all of these:

1. Public documentation
2. GitHub issues (check if "by design" closure was later re-opened)
3. GitHub PRs/commits
4. Changelog/release notes
5. Source code comments (// intentional, // by spec)
6. RFC or protocol spec

GATE: Any source confirms by-design? DISCARD with quote. None found? State what you checked. Proceed to Layer 2.

Layer 2 - Reproducible Evidence Chain

Create minimal reproduction a triager can follow.

Multi-artifact strength check:

• What the vuln is (description)
• Where it fails (endpoint, parameter, stack trace)
• Why it behaves incorrectly (variable values, response fields)

One artifact = weak. All three = strong.

GATE: Evidence chain reproducible? Proceed to Layer 3. Cannot create working reproduction? Tag [NEEDS-PROOF], surface to user. STOP.

Layer 3 - Impact Analysis

Answer with evidence, not speculation. "I did X and observed Y" not "an attacker could..."

Impact questions

1. What data/functionality exposed or modified? Show the response.
2. How many users affected? (one / some / all)
3. Exploitable without special access?
4. Measurable business impact?
5. What proof? (claimed resource / extracted data / state change / OOB callback / working PoC)
6. CVSS 3.1 score.

Alternative hypothesis check

Before finalizing impact, enumerate:

1. Primary hypothesis (your belief)
2. Alternative A (could this be by-design?)
3. Alternative B (could this be a different, less severe class?)

Score each by evidence. If an alternative scores higher, revise.

Confidence statement (required)

Evidence type: [claimed resource | extracted data | state change | bypass | OOB callback | PoC | timing]
Verified by: [what you executed and observed]
Confidence: HIGH (demonstrated) | MEDIUM (strong indicators) | LOW (inferred)

LOW confidence = surface as [NEEDS-PROOF], not [PROVEN].

Victim-interaction classes

XSS, CSRF, clickjacking, open redirect are VALID if injection is demonstrated and working PoC exists. Do not fail for "requires user interaction."

CVSS 3.1 quick reference

GATE: Impact demonstrated with evidence? PROVEN. Partial impact at lower severity? PROVEN (adjust severity). Impact theoretical only? PARTIAL. No demonstrable impact? DISCARD or [INFORMATIONAL].

Final Status Assignment

Challenge Protocol

One challenge from user = fresh re-evaluation of the disputed layer only.

Do not defend. Re-evaluate with fresh eyes. If any doubt: discard.