ctf-agent 1.2.0

package/references/exploit-databases.md

@@ -0,0 +1,575 @@
+# Vulnerability Intelligence & Exploitation Lifecycle Handbook (v2.0)
+## Target → CVE/GHSA → Vendor Advisory → Patch → KEV/EPSS → PoC → Root Cause → Lab Reproduction → Validation → Writeup
+
+> **Scope**: This reference handbook is strictly designed for authorized CTF competitions, educational security research, controlled lab testing, and permitted Red Team engagements.
+
+---
+
+## 1. End-to-End Lifecycle Architecture
+
+When researching software vulnerabilities or solving CTF/lab challenges, do not jump straight to downloading unverified scripts. Follow the standardized vulnerability research and exploitation lifecycle:
+
+```
+┌────────────────────────────────────────────────────────────────────────────────────────┐
+│  PHASE 1: TARGET RECONNAISSANCE & FINGERPRINTING                                        │
+│  - Scenario A: Explicit CVE ID identified in challenge prompt/hint                     │
+│  - Scenario B: Product name & exact version extracted from manifests/binaries          │
+│  - Scenario C: Raw service banners, HTTP headers, error traces, or behavior            │
+└──────────────────────────────────────────┬─────────────────────────────────────────────┘
+                                           │
+                                           ▼
+┌────────────────────────────────────────────────────────────────────────────────────────┐
+│  PHASE 2: AUTHORITATIVE VULNERABILITY & ADVISORY LOOKUP                                │
+│  - Query official CVE List V5 (cveawg.mitre.org) for canonical CNA records             │
+│  - Query GitHub Advisory Database (GHSA) / OSV for package dependencies                │
+│  - Query First-Party Vendor Advisories (MSRC, Cisco, Red Hat, Oracle) for exact fixes  │
+│  - Inspect Distro Trackers (Debian, Ubuntu, Alpine) to verify backport patch status   │
+└──────────────────────────────────────────┬─────────────────────────────────────────────┘
+                                           │
+                                           ▼
+┌────────────────────────────────────────────────────────────────────────────────────────┐
+│  PHASE 3: THREAT PRIORITIZATION & EXPLOITATION CONTEXT                                 │
+│  - CISA KEV: Verify if the vulnerability has confirmed wild exploitation               │
+│  - FIRST EPSS: Calculate 30-day wild exploitation probability & percentile             │
+│  - Contextual Evaluation: Pair EPSS/KEV with CTF/lab context (avoid false negatives)  │
+└──────────────────────────────────────────┬─────────────────────────────────────────────┘
+                                           │
+                                           ▼
+┌────────────────────────────────────────────────────────────────────────────────────────┐
+│  PHASE 4: EXPLOIT DISCOVERY & REPOSITORY AUDIT                                         │
+│  - SearchSploit / Exploit-DB (`--cve`, `-s`, `-t`, `--json`, `-p`, `-m`)               │
+│  - Real-time aggregators: Sploitus, Packet Storm, AttackerKB, GitHub via `gh`          │
+│  - Classify available exploits according to Exploit Maturity Taxonomy (L0–L5)         │
+└──────────────────────────────────────────┬─────────────────────────────────────────────┘
+                                           │
+                                           ▼
+┌────────────────────────────────────────────────────────────────────────────────────────┐
+│  PHASE 5: PATCH DIFFING & ROOT CAUSE EXTRACTION                                        │
+│  - Git commit / PR diff inspection: Identify added bounds checks, casts, sanitizers   │
+│  - Root Cause Analysis (RCA): Identify the exact software flaw                         │
+│  - Primitive Extraction: Map root cause to primitive (OOB Write, SSRF, Deserialization)│
+│  - Impact Formulation: Derive target state modification required for RCE or leak      │
+└──────────────────────────────────────────┬─────────────────────────────────────────────┘
+                                           │
+                                           ▼
+┌────────────────────────────────────────────────────────────────────────────────────────┐
+│  PHASE 6: DEFENSIVE POC TRIAGE & SANDBOX ISOLATION                                     │
+│  - Malicious PoC Audit: Scan for obfuscated blobs, suspicious subprocesses, webhooks   │
+│  - Dependency & Network Verification: Confirm safe endpoints and benign payload intent │
+│  - Sandbox Execution: Run only inside disposable Docker containers or isolated WSL     │
+└──────────────────────────────────────────┬─────────────────────────────────────────────┘
+                                           │
+                                           ▼
+┌────────────────────────────────────────────────────────────────────────────────────────┐
+│  PHASE 7: LAB REPRODUCTION, TARGET ADAPTATION & VALIDATION                             │
+│  - Deploy local lab matching target version, architecture, and glibc/runtime           │
+│  - Dynamic Offset Adjustment: Replace hardcoded offsets with runtime leaked addresses  │
+│  - Mitigation Bypasses: Handle ASLR, PIE, NX, seccomp, WAF, or container constraints    │
+│  - Flag & Proof Extraction: Capture terminal output, verify regex, avoid hallucination │
+└──────────────────────────────────────────┬─────────────────────────────────────────────┘
+                                           │
+                                           ▼
+┌────────────────────────────────────────────────────────────────────────────────────────┐
+│  PHASE 8: STANDARDIZED WRITEUP & RESEARCH DOCUMENTATION                                │
+│  - Produce reproducible `solve.py` script                                              │
+│  - Document Root Cause, Primitive Chain, and Remediation in standardized format        │
+└────────────────────────────────────────────────────────────────────────────────────────┘
+```
+
+---
+
+## 2. Authoritative Vulnerability Sources: Disaggregated Taxonomy
+
+Never treat all security feeds as interchangeable. Each source serves a distinct purpose in the vulnerability intelligence ecosystem:
+
+```
+┌────────────────────────────────────────────────────────────────────────────────────────┐
+│  VULNERABILITY INTELLIGENCE SOURCES TAXONOMY                                           │
+├───────────────────┬───────────────────┬───────────────────┬────────────────────────────┤
+│ CVE Program (V5)  │ NIST NVD          │ Vendor Advisories │ Distro Trackers            │
+│ (Canonical Record)│ (Enrichment/CVSS) │ (Authoritative Fix│ (Package Backport Patch    │
+│                   │                   │  & Workaround)    │  Verification)             │
+└───────────────────┴───────────────────┴───────────────────┴────────────────────────────┘
+```
+
+### 2.1. CVE Program & CVE List V5 (The Canonical Record)
+- **Repository:** `https://github.com/CVEProject/cvelistV5`
+- **CVE Services API:** `https://cveawg.mitre.org/api/cve/{cve_id}`
+- **Role:** CVE List V5 is the official, primary repository of the CVE Program. Records are created and updated directly by authorized **CVE Numbering Authorities (CNAs)**.
+- **Key Record States:**
+  - `RESERVED`: The ID has been allocated to a CNA or researcher, but technical details are not yet public.
+  - `PUBLISHED`: The official advisory has been disclosed with title, description, affected ranges, and references.
+  - `REJECTED`: The CVE was revoked or merged into another identifier.
+- **Why It Matters**: CVE List V5 in JSON v5 format contains the earliest authoritative details directly from the vendor or CNA before secondary enrichment occurs.
+
+### 2.2. NIST National Vulnerability Database (NVD)
+- **Portal:** `https://nvd.nist.gov/`
+- **Role:** NVD is an **enrichment and analysis body** operated by the US National Institute of Standards and Technology (NIST), not the primary assignment authority.
+- **Strengths:**
+  - Common Vulnerability Scoring System (CVSS v2, v3.1, v4.0) base metrics.
+  - Common Weakness Enumeration (CWE) classification (e.g., CWE-787: Out-of-bounds Write, CWE-94: Code Injection).
+  - Common Platform Enumeration (CPE) match criteria for structured asset correlation.
+- **Critical Operational Caveat**: NVD frequently experiences enrichment backlogs. A newly disclosed CVE may be in `Awaiting Analysis` or `Received` state for weeks without a CVSS score. **Always consult CVE List V5 and Vendor Advisories first.**
+
+### 2.3. First-Party Vendor Security Advisories
+- **Examples:** Microsoft Security Response Center (MSRC), Cisco Security Advisories, Apple Security Releases, Oracle Critical Patch Updates (CPU), Red Hat Security Advisories (RHSA).
+- **Role:** The **most authoritative technical source** regarding software architecture, exact patch release versions, affected configuration parameters, and mitigation workarounds.
+
+### 2.4. GitHub Advisory Database (GHSA) & Open Source Vulnerabilities (OSV)
+- **GHSA:** `https://github.com/advisories`
+- **OSV.dev:** `https://osv.dev/`
+- **Role:** The primary vulnerability tracking system for open-source ecosystems (npm, PyPI, Go, Maven, Cargo, Packagist, RubyGems).
+- **Strengths:** Directly links to pull requests, issue discussions, and fixing commit hashes (`github.com/org/repo/commit/...`). Indispensable for patch diffing.
+
+### 2.5. Distribution-Specific Security Trackers
+- **Trackers:**
+  - Debian: `https://security-tracker.debian.org/tracker/`
+  - Ubuntu: `https://ubuntu.com/security/cve`
+  - Alpine Linux: `https://security.alpinelinux.org/`
+  - Red Hat Bugzilla: `https://access.redhat.com/security/security-updates/`
+- **The "Backport Patch" Trap in CTF/Labs**:
+  Linux distributions regularly backport security fixes into LTS packages without changing upstream version numbers. For example, `libcurl.so.4.8.0` on Ubuntu 22.04 might show an unpatched version string, but package `curl 7.81.0-1ubuntu1.16` contains the fix. Always inspect distro changelogs:
+  ```bash
+  dpkg -l | grep -E "libc6|curl|openssl"
+  apt-get changelog <package-name> | head -30
+  ```
+
+---
+
+## 3. Threat Prioritization: CISA KEV & FIRST EPSS
+
+### 3.1. CISA KEV (Known Exploited Vulnerabilities Catalog)
+- **URL:** `https://www.cisa.gov/known-exploited-vulnerabilities-catalog`
+- **Feed:** `https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json`
+- **Inclusion Criteria**:
+  1. The vulnerability has an assigned CVE ID.
+  2. There is reliable, empirical evidence of active exploitation in the wild.
+  3. A clear remediation (patch or vendor guidance) exists.
+- **CTF & Research Value**: If a CVE is in KEV, public or private weaponized exploits are guaranteed to exist. In real-world pentests, KEV vulnerabilities demand immediate prioritization.
+
+### 3.2. FIRST EPSS (Exploit Prediction Scoring System)
+- **Documentation & API:** `https://www.first.org/epss`
+- **Endpoint:** `https://api.first.org/data/v1/epss?cve=CVE-YYYY-NNNN`
+- **Mechanism**: EPSS utilizes a machine learning model analyzing dozens of data variables (disclosed PoCs, social discussions, weaponized framework commits, scanner signatures) to generate:
+  - **Probability (`epss`)**: A value between `0.00000` (0%) and `1.00000` (100%) indicating the likelihood that the CVE will be exploited in the wild in the next 30 days.
+  - **Percentile (`percentile`)**: The relative rank of this CVE compared to all other scored CVEs (e.g., `0.975` means this vulnerability has a higher exploitation probability than 97.5% of all CVEs).
+
+### 3.3. Critical Nuances & Scoring Distinctions
+- **EPSS is NOT a Complete Risk Score**: EPSS measures **threat probability**, not impact. A vulnerability with high EPSS might only cause a denial of service, whereas a zero-EPSS flaw might be a critical remote code execution flaw in an obscure ICS controller.
+- **CVSS measures Severity, NOT Exploitability**: A CVSS 10.0 indicates catastrophic impact if exploited under optimal conditions; it does not indicate whether exploitation is trivial or requires complex heap feng-shui.
+- **The CTF / Lab Context Filter**:
+  CTF challenges frequently feature bespoke software, niche libraries, or historic CVEs that have an EPSS score near `0.00010` (0.01%) and are not in CISA KEV. **Do not discard a vulnerability in a CTF just because its EPSS is low.**
+
+---
+
+## 4. Exploit Maturity Taxonomy (L0–L5 Maturity Model)
+
+When collecting Proof-of-Concept exploits from GitHub, Exploit-DB, or research blogs, categorize their technical maturity to gauge the engineering effort needed:
+
+| Tier | Maturity Level | Description | CTF / Lab Action Required |
+| :---: | :--- | :--- | :--- |
+| **L0** | **Theoretical / Advisory** | Vulnerability described textually in an advisory or whitepaper. No code provided. | Analyze patch diff or architecture to craft exploit primitive from scratch. |
+| **L1** | **Crash / DoS PoC** | Input payload triggers a panic, null pointer dereference, or out-of-memory crash. | Investigate crash dump/registers. Determine if memory corruption can be pivoted into control flow hijack. |
+| **L2** | **Constrained Primitive PoC** | Demonstrates partial read or write primitive under artificial conditions (e.g., ASLR/PIE disabled, fixed base). | Engineer memory leaks and stack/heap layout control to overcome mitigations. |
+| **L3** | **Lab-Reproduced Exploit** | Reliable exploit operating in an environment identical to the author's lab (e.g., Dockerfile provided). | Port offsets, verify target glibc/kernel version, adjust network timing. |
+| **L4** | **Reliable Exploit** | Self-contained exploit that dynamically leaks addresses, bypasses standard mitigations (Canary, ASLR, DEP), and lands a shell. | Adapt I/O wrappers (`pwntools` or `requests`) for challenge connection parameters. |
+| **L5** | **Weaponized / Turnkey Exploit** | Modular exploit with automated target fingerprinting, multi-architecture payloads, and clean connection cleanup. | Ready for immediate verification; inspect code safety before firing. |
+
+---
+
+## 5. Exploit Repositories & SearchSploit CLI Standardization
+
+### 5.1. Official SearchSploit CLI Reference
+SearchSploit provides offline search capabilities for the Exploit-DB archive:
+
+```bash
+# Update Exploit-DB database
+searchsploit -u
+
+# 1. Search strictly by CVE ID (--cve)
+searchsploit --cve 2024-45409
+
+# 2. Strict search (-s): terms must all match
+searchsploit -s "Apache 2.4.49"
+
+# 3. Title-only search (-t): ignore code/comment matches to prune false positives
+searchsploit -t "OpenSSH"
+
+# 4. JSON output (--json) for automated script parsing
+searchsploit --cve 2023-44487 --json
+
+# 5. Examine exploit path and preview source directly (-p)
+searchsploit -p 50383
+
+# 6. Mirror/copy exploit script to current directory (-m)
+searchsploit -m 50383
+searchsploit -m exploits/linux/remote/50383.py
+
+# 7. Open Exploit-DB web entry in browser (-w / --www)
+searchsploit -w "WordPress Core 5.8"
+```
+
+### 5.2. Search Aggregators & Platforms
+- **Sploitus (`https://sploitus.com/`)**: Real-time aggregator querying GitHub, Exploit-DB, and 0day.today.
+- **Packet Storm Security (`https://packetstormsecurity.com/`)**: Continuous repository of Full Disclosure advisories, custom PoCs, and cutting-edge Metasploit modules.
+- **AttackerKB (`https://attackerkb.com/`)**: Community-driven analysis highlighting exploit prerequisites, attacker value, and root cause analyses.
+- **GitHub CLI (`gh`) for Real-Time PoC Sourcing**:
+  ```bash
+  # Search recent repositories for CVE
+  gh search repos "CVE-2024-" --sort stars --limit 10
+
+  # Search raw Python exploit code on GitHub
+  gh search code "CVE-2024-28184" --extension py
+  ```
+
+---
+
+## 6. Patch Diffing Workflow: Diff → Root Cause → Primitive → Impact
+
+When dealing with N-day vulnerabilities where no public PoC exists (L0 maturity), the exploit is reconstructed through patch diffing:
+
+```
+┌────────────────────────────────────────────────────────────────────────┐
+│  STEP 1: OBTAIN COMMITS & IDENTIFY MODIFIED LINES                      │
+│  - Inspect Git commit hash from GHSA, Linux CVE Tracker, or changelog  │
+│  - Locate modified files: look for bounds checks, typecasts, sanitizers│
+└──────────────────────────────────┬─────────────────────────────────────┘
+                                   │
+                                   ▼
+┌────────────────────────────────────────────────────────────────────────┐
+│  STEP 2: DETERMINE THE ROOT CAUSE (RCA)                                │
+│  - Why was the change made? (Integer overflow, missing lock, LFI sink) │
+│  - Trace backward from modified code to reachable input entry points   │
+└──────────────────────────────────┬─────────────────────────────────────┘
+                                   │
+                                   ▼
+┌────────────────────────────────────────────────────────────────────────┐
+│  STEP 3: EXTRACT THE EXPLOITATION PRIMITIVE                            │
+│  - Out-of-bounds Read   -> Information leak (bypass KASLR / Canary)    │
+│  - Out-of-bounds Write  -> Overwrite function pointer / return address │
+│  - Unchecked Deserialization -> Gadget chain instantiation             │
+└──────────────────────────────────┬─────────────────────────────────────┘
+                                   │
+                                   ▼
+┌────────────────────────────────────────────────────────────────────────┐
+│  STEP 4: IMPACT & WEAPONIZATION PATH                                   │
+│  - Construct minimal trigger input                                     │
+│  - Bridge primitive to final objective (RCE, Auth Bypass, Flag Leak)   │
+└────────────────────────────────────────────────────────────────────────┘
+```
+
+### Common Diff Signatures and Associated Primitives:
+1. **Added Bounds Checks (`if (len > MAX) return -1;`)**:
+   - Indicates: Buffer overflow or out-of-bounds array indexing.
+   - Primitive: Heap/stack buffer corruption or arbitrary read/write.
+2. **Added Type Validation (`if (!is_array($data))`)**:
+   - Indicates: PHP loose type juggling or prototype pollution.
+   - Primitive: Authentication bypass or arbitrary property injection.
+3. **Prepared Statements / Parameter Binding (`stmt.prepare(...)`)**:
+   - Indicates: SQL injection.
+   - Primitive: Second-order SQLi or out-of-band data exfiltration.
+4. **URL / Path Normalization (`os.path.realpath`, `filepath.Clean`)**:
+   - Indicates: Path traversal or SSRF via URL parser discrepancy.
+   - Primitive: Arbitrary file read / cloud metadata extraction.
+
+---
+
+## 7. Malicious PoC Defense & Defensive Audit Checklist
+
+In recent years, fake PoCs distributed via GitHub and underground forums have frequently concealed infostealers, Discord token grabbers, fake reverse shells, or backdoor execution.
+
+### Defensive PoC Triage Checklist:
+Before running any third-party script from an untrusted source, execute this audit:
+
+- [ ] **1. Obfuscation & Dynamic Evaluation**:
+  - Scan for base64 strings, hex-encoded blobs, or compressed streams.
+  - Search for execution sinks: `eval()`, `exec()`, `compile()`, `Function()`, `subprocess.Popen(..., shell=True)`.
+  - In PowerShell/Batch scripts, search for `IEX`, `Invoke-Expression`, `powershell -enc`, or `certutil -decode`.
+- [ ] **2. Network Destination Verification**:
+  - Verify all hardcoded IP addresses, domains, and webhooks.
+  - Does the script attempt to send out-of-band HTTP requests or DNS queries to an unknown command-and-control server?
+- [ ] **3. Dependency & Import Audit**:
+  - Check `requirements.txt` or `package.json` for typosquatted or obscure packages.
+  - Inspect imports: avoid unexpected libraries (e.g., `browser_cookie3`, `pynput`, `discord_webhook`).
+- [ ] **4. Payload Intent**:
+  - Confirm the default payload performs a harmless action (`id`, `whoami`, `cat /etc/passwd`, `echo pwned`) rather than destructive system commands (`rm -rf`, disk encryption, or dropping unauthorized SSH keys).
+- [ ] **5. Environment & Sandbox Isolation**:
+  - **Never execute third-party PoCs directly on your host OS.**
+  - Always run inside a disposable Docker container or isolated WSL Kali instance with restricted network egress:
+    ```bash
+    docker run --rm -it --network none -v $(pwd):/work ctf-sandbox:latest bash
+    ```
+
+---
+
+## 8. Scenario-Based Triaging Workflows
+
+### Scenario A: Known CVE ID (e.g., Challenge specifies `CVE-2024-XXXX`)
+1. Run `python scripts/cve_lookup.py <CVE-ID>` to pull CVE List V5 record, EPSS score, and CISA KEV status.
+2. Query SearchSploit (`searchsploit --cve <ID>`) and GitHub (`gh search repos "<ID>"`).
+3. Classify retrieved PoCs (L1–L5). Audit for safety before execution.
+4. Verify target environment compatibility (glibc, architecture, compiler).
+
+### Scenario B: Product & Exact Version Known (e.g., `Werkzeug 2.2.2` or `OpenSSH 8.9p1`)
+1. Query SearchSploit strictly: `searchsploit -s "Werkzeug 2.2.2"`.
+2. Check GitHub Advisory Database: `https://github.com/advisories?query=Werkzeug`.
+3. Check Linux Distro Tracker for backported patches on target operating system release.
+4. If multiple CVEs match, sort by Exploit Maturity (prefer L4/L5 public PoCs over L0 advisories).
+
+### Scenario C: Raw Banner / Fingerprint Only
+1. Probe server response headers (`Server:`, `X-Powered-By:`, cookies, error stack traces).
+2. Use fingerprinting tools: `whatweb`, `curl -I`, `nmap -sV`.
+3. Compare subtle behavior (HTTP status codes on invalid paths, response headers) against public changelogs to narrow version bounds.
+4. Once an initial candidate software is identified, pivot to Scenario B.
+
+---
+
+## 9. Debunking Fallacies & Security Absolutes
+
+In technical vulnerability assessment, avoid absolute heuristics that cause tunnel vision:
+
+| Myth / Absolute Heuristic | Reality & Technical Nuance |
+| :--- | :--- |
+| **"High CVSS (9.8–10.0) = Easy to Exploit"** | **False.** CVSS base scores evaluate maximum theoretical impact in default configurations. Exploiting a CVSS 9.8 remote memory corruption flaw may require an intricate multi-stage heap feng-shui layout, whereas an unauthenticated CVSS 6.5 SSRF may yield a cloud metadata token in a single `curl` command. |
+| **"No Public PoC = Impossible to Exploit"** | **False.** Many premier CTF challenges and high-profile zero-days are 1-days with released patches but no public exploit code. Reverse engineering the patch diff reveals the root cause and allows weaponization from scratch. |
+| **"Low EPSS Score = Safe / Non-exploitable"** | **False.** EPSS estimates wild exploitation probability based on internet-scale honeypot and scanner telemetry. Custom CTF targets, enterprise software behind firewalls, or newly dropped challenges routinely hold an EPSS score of 0.01% despite being fully exploitable. |
+| **"Vulnerability Exists in Code = Target is Exploitable"** | **False.** Modern compiler flags (FORTIFY_SOURCE, Stack Canaries, PIE), kernel protections (seccomp, namespaces), and reverse proxies (WAFs, HTTP normalizers) frequently neutralize the trigger path without fixing the underlying bug. |
+
+---
+
+## 10. Dynamic Research Tracking (Continuous Monitoring)
+
+Vulnerability research is a dynamic, continuously evolving discipline. Elite security research teams release innovative primitives that define modern CTF metas:
+
+- **PortSwigger Research (`portswigger.net/research`)**:
+  - Pioneers in modern web desynchronization attacks (HTTP Request Smuggling, HTTP/2 Rapid Reset, Web Cache Deception, Host Header Injection, Browser DOM Clobbering). *Actively tracks 2024–2026+ web attack primitives.*
+- **Google Project Zero (`googleprojectzero.blogspot.com`)**:
+  - Definitive deep-dives on browser engines (V8 JIT compilation, WebKit), hypervisors, and kernel memory corruption primitives.
+- **Trail of Bits (`blog.trailofbits.com`) & Zellic (`zellic.io/blog`)**:
+  - Industry leaders in Zero-Knowledge Proof (ZKP) circuit attacks, smart contracts, compiler exploitation, and symbolic execution.
+- **Qualys Security Research (`qualys.com/research/security-advisories`)**:
+  - Masters of Linux Local Privilege Escalation (glibc ld.so, Sudo, Polkit, systemd).
+- **Zero Day Initiative (ZDI) (`zerodayinitiative.com/blog`)**:
+  - Detailed root-cause analyses from Pwn2Own competitions (virtualization escapes, enterprise servers, client-side applications).
+- **Phrack Magazine (`phrack.org`)**:
+  - The canonical underground journal for low-level exploitation techniques, heap layout manipulation, and kernel internals.
+- **Assetnote Research (`assetnote.io/resources/research`)**:
+  - Enterprise web exploitation, parser differentials, and deserialization gadget discoveries.
+
+> [!NOTE]
+> Treat the list above as an ongoing intelligence stream to monitor regularly, rather than an immutable directory.
+
+---
+
+## 11. Production-Ready Python CLI Automation (`scripts/cve_lookup.py`)
+
+The automated vulnerability intelligence script is maintained at `scripts/cve_lookup.py`. It integrates the official CVE List V5 API, FIRST EPSS API, and CISA KEV catalog in a single automated command:
+
+```bash
+python scripts/cve_lookup.py <CVE-YYYY-NNNN>
+```
+
+### Complete Implementation Source Code:
+```python
+#!/usr/bin/env python3
+"""
+CVE & Threat Intelligence Lookup Utility (v2.0)
+Authoritative vulnerability intelligence pipeline for CTF Agents & Security Researchers:
+- CVE List V5 / CVE Services API (cveawg.mitre.org)
+- FIRST EPSS API (api.first.org)
+- CISA KEV (Known Exploited Vulnerabilities) catalog check
+"""
+
+import sys
+import json
+import urllib.request
+import urllib.error
+from typing import Optional, Dict, Any
+
+USER_AGENT = "CTF-Agent-ThreatIntel/2.0"
+TIMEOUT = 10
+
+
+def fetch_json(url: str) -> Optional[Dict[str, Any]]:
+    req = urllib.request.Request(url, headers={"User-Agent": USER_AGENT})
+    try:
+        with urllib.request.urlopen(req, timeout=TIMEOUT) as resp:
+            return json.loads(resp.read().decode("utf-8"))
+    except Exception:
+        return None
+
+
+def get_cve_details(cve_id: str) -> Optional[Dict[str, Any]]:
+    url = f"https://cveawg.mitre.org/api/cve/{cve_id}"
+    return fetch_json(url)
+
+
+def get_epss_score(cve_id: str) -> Optional[Dict[str, Any]]:
+    url = f"https://api.first.org/data/v1/epss?cve={cve_id}"
+    data = fetch_json(url)
+    if data and "data" in data and len(data["data"]) > 0:
+        return data["data"][0]
+    return None
+
+
+def check_cisa_kev(cve_id: str) -> Dict[str, Any]:
+    url = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
+    data = fetch_json(url)
+    if not data:
+        return {"listed": False, "error": "Unable to reach CISA KEV feed"}
+
+    vulns = data.get("vulnerabilities", [])
+    for v in vulns:
+        if v.get("cveID", "").upper() == cve_id:
+            return {
+                "listed": True,
+                "vulnerabilityName": v.get("vulnerabilityName", "N/A"),
+                "dateAdded": v.get("dateAdded", "N/A"),
+                "knownRansomwareCampaignUse": v.get("knownRansomwareCampaignUse", "Unknown"),
+            }
+    return {"listed": False}
+
+
+def parse_and_display(cve_id: str) -> None:
+    cve_id = cve_id.strip().upper()
+    if not cve_id.startswith("CVE-"):
+        cve_id = "CVE-" + cve_id
+
+    print("\n" + "=" * 70)
+    print(f"[*] VULNERABILITY THREAT INTELLIGENCE: {cve_id}")
+    print("=" * 70)
+
+    cve_data = get_cve_details(cve_id)
+    if not cve_data:
+        print(f"[-] Error: Record for {cve_id} not found in CVE List V5 repository.")
+        return
+
+    cve_metadata = cve_data.get("cveMetadata", {})
+    state = cve_metadata.get("state", "UNKNOWN")
+    cna_container = cve_data.get("containers", {}).get("cna", {})
+
+    title = cna_container.get("title", "No title provided by CNA")
+    descriptions = cna_container.get("descriptions", [])
+    desc_text = descriptions[0].get("value", "No description") if descriptions else "No description"
+
+    print(f"\n[+] STATUS: {state} | CNA: {cve_metadata.get('assignerShortName', 'Unknown')}")
+    print(f"[+] TITLE : {title}\n")
+    print(f"[+] DESCRIPTION:\n    {desc_text.strip()}\n")
+
+    affected = cna_container.get("affected", [])
+    if affected:
+        print("[+] AFFECTED PRODUCTS & VERSIONS:")
+        for aff in affected[:5]:
+            vendor = aff.get("vendor", "Unknown")
+            product = aff.get("product", "Unknown")
+            versions = [f"{v.get('version', '')} ({v.get('status', '')})" for v in aff.get("versions", [])[:3]]
+            print(f"    - {vendor} / {product} -> {', '.join(versions)}")
+        print()
+
+    epss_info = get_epss_score(cve_id)
+    print("[+] EPSS PROBABILITY (FIRST.org):")
+    if epss_info:
+        epss_prob = float(epss_info.get("epss", 0.0))
+        epss_pct = float(epss_info.get("percentile", 0.0)) * 100.0
+        print(f"    - Exploitation Probability (30-day): {epss_prob:.4f} ({epss_prob * 100:.2f}%)")
+        print(f"    - EPSS Percentile: {epss_pct:.2f}% (Higher than {epss_pct:.2f}% of all CVEs)")
+    print()
+
+    kev_info = check_cisa_kev(cve_id)
+    print("[+] CISA KEV (KNOWN EXPLOITED VULNERABILITIES):")
+    if kev_info.get("listed"):
+        print(f"    - [CRITICAL] In CISA KEV: YES | Added: {kev_info.get('dateAdded')}")
+        print(f"    - Vulnerability: {kev_info.get('vulnerabilityName')}")
+    else:
+        print("    - Listed in CISA KEV: NO")
+    print()
+
+    refs = [r.get("url") for r in cna_container.get("references", []) if r.get("url")]
+    if refs:
+        print(f"[+] AUTHORITATIVE REFERENCES ({len(refs)} total):")
+        for r in refs[:8]:
+            print(f"    - {r}")
+        print()
+    print("=" * 70 + "\n")
+
+
+if __name__ == "__main__":
+    if len(sys.argv) > 1:
+        parse_and_display(sys.argv[1])
+    else:
+        print("Usage: python3 scripts/cve_lookup.py <CVE-YYYY-NNNN>")
+```
+
+---
+
+## 12. Standardized Reporting & Writeup Templates
+
+### 12.1. Template: CTF Challenge Writeup Standard
+Follow the repository writeup standard defined in `skills/ctf-writeup/SKILL.md`:
+
+```markdown
+---
+title: "<Challenge Name>"
+ctf: "<Event Name>"
+category: <web|pwn|crypto|reverse|forensics|misc>
+diff: <easy|medium|hard|insane>
+flag: "<flag_value>"
+hint: "<official_hint_or_prompt>"
+---
+
+# <Challenge Name>
+
+## 1. Challenge & Hint Analysis (Hint-First Methodology)
+- **Prompt & Hints**: Quote official text.
+- **Semantic Interpretation**: Targeted primitives, author intent, pruned rabbit holes.
+
+## 2. Target Architecture & Vulnerability Analysis
+- **Architecture**: Stack, service framework, or binary mitigations (`checksec`).
+- **Root Cause Analysis (RCA)**: Underlying security flaw.
+
+## 3. Exploitation Walkthrough
+- **Step 1**: Reconnaissance and vulnerability trigger.
+- **Step 2**: Mitigation bypass or exploit chain construction.
+- **Step 3**: Payload execution and flag exfiltration.
+
+## 4. Standalone Exploit Script (solve.py)
+```python
+# Self-contained, runnable exploit script
+```
+
+## 5. Verification & Flag
+```text
+flag{...}
+```
+```
+
+### 12.2. Template: 1-Day Vulnerability Research Advisory
+When documenting research on a disclosed N-day or CVE:
+
+```markdown
+# Vulnerability Research Advisory: [CVE-YYYY-NNNN] - [Title]
+
+## 1. Executive Summary
+- **Identifier**: CVE-YYYY-NNNN / GHSA-xxxx-xxxx-xxxx
+- **Affected Software**: [Vendor] [Product] [Versions]
+- **Fixed Version**: [Version]
+- **Threat Metrics**: CVSS Base Score | EPSS Probability | CISA KEV Status
+- **Exploit Maturity**: L0 to L5
+
+## 2. Root Cause Analysis (RCA)
+- **Vulnerable Component**: File path and function name.
+- **Patch Diff Breakdown**: Compare vulnerable commit vs. fixing commit.
+- **Underlying Flaw**: Memory safety violation, logic flaw, or injection.
+
+## 3. Exploit Primitive & Constraints
+- **Primitive**: Read/Write/Execute capability.
+- **Environmental Constraints**: Required flags, memory layout, runtime protections.
+
+## 4. Proof-of-Concept & Reproduction
+- **Reproduction Environment**: Dockerfile or setup commands.
+- **Trigger Payload**: Safe demonstration payload.
+
+## 5. Defensive Guidance & Remediation
+- **Official Patch**: Commit link or package upgrade instructions.
+- **Workarounds**: Network ACLs, disabled features, or configuration hardening.
+```