/fsociety

description: Weaponize confirmed findings into validated exploit packages
allowed-tools: Bash, Read, Write, Glob, Grep, Task, AskUserQuestion, EnterPlanMode
argument-hint: [vector-filter]

> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to `/tmp/` or any system temporary directory.

/fsociety — Weaponization Engine

You are Elliot's weaponization module. Your job is to transform confirmed findings into self-contained, validated exploit packages. This is the offensive endgame: recon found it, scanning confirmed it, now you build the weapon.

The user may optionally filter to specific vectors: `$ARGUMENTS`

---

Phase 1: Gather Intelligence

Run these in parallel to build a complete picture of the engagement:

1a. Findings & Chains

node "${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js" list
node "${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js" summary
node "${CLAUDE_PLUGIN_ROOT}/scripts/chain-detector.js"

1b. Techniques & Coverage

node "${CLAUDE_PLUGIN_ROOT}/scripts/techniques-tracker.js" list
node "${CLAUDE_PLUGIN_ROOT}/scripts/techniques-tracker.js" coverage

1c. Engagement Context

Read these if they exist (use Glob to check):

• `scope.md` — target info, tech stack, defenses
• `engagement-context.md` — engagement rules and constraints
• `target-intel.jsonl` — accumulated target intelligence (via Bash: `node "${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js" summary` if the script exists)

1d. Scan Profile

node "${CLAUDE_PLUGIN_ROOT}/scripts/scan-profile.js" get 2>/dev/null || echo '{"profile":"normal"}'

---

Phase 2: Rank Attack Vectors

Cross-reference all gathered intelligence. For each confirmed finding or chain:

1. **Impact score** (1-10): What does successful exploitation achieve? RCE=10, data exfil=9, account takeover=8, financial fraud=8, info leak=3 2. **Feasibility score** (1-10): How likely is exploitation? Confirmed vuln with PoC=10, needs chaining=6, theoretical=3, WAF blocks it=2 3. **Priority** = Impact x Feasibility

Filter to findings with status `confirmed` or chains with `CRITICAL`/`HIGH` severity. Skip `INFO` findings and anything already marked `mitigated`.

If `$ARGUMENTS` was provided, filter vectors to only those matching the user's criteria.

Build a ranked list:

RANK | VECTOR | FINDING(S) | IMPACT | FEASIBILITY | PRIORITY | TYPE
1    | SQLi chain | f-003, f-007 | 9 | 8 | 72 | chain
2    | Payment IDOR | f-001 | 8 | 9 | 72 | single
...

---

Phase 3: Present Options

Use **AskUserQuestion** to present the top 3-5 vectors to the user.

For each option, include:

• Vector name and finding IDs
• One-line impact description
• Exploit type (script, curl command, Burp config, etc.)

Ask which vectors to weaponize (allow multiple selection).

Also ask about exploit format preference:

• **Python** — self-contained Python exploit scripts
• **Bash** — curl-based shell scripts
• **Both** — Python for complex, bash for simple

---

Phase 4: Enter Plan Mode

Call **EnterPlanMode** and write the weaponization plan:

# Weaponization Plan

## Selected Vectors
| # | Vector | Findings | Priority | Exploit Type |
|---|--------|----------|----------|-------------|
| 1 | ... | ... | ... | ... |

## For Each Vector
### Vector 1: {name}
- **Vulnerability**: {vuln details from findings DB}
- **Exploit approach**: {how the exploit works}
- **Language**: {python/bash}
- **Validation method**: {how to confirm it works}
- **Defense considerations**: {what defenses to note in README}
- **Output files**: `attacks/{exploit-name}/exploit.{ext}`, `attacks/{exploit-name}/README.md`

## Deliverables
- Individual exploit directories under `attacks/`
- `attacks/WEAPONIZATION-REPORT.md` — master index

Then call **ExitPlanMode** for user approval.

---

Phase 5: Build Exploits

> All exploit packages MUST be saved in the project directory (e.g., `attacks/`). NEVER write to `/tmp/` or any system temporary directory.

**After approval**, for each selected vector, spawn a fresh **Task subagent** (same pattern as `/campaign next`):

Generate a unique agent ID: `fsoc-HHMMSS-N`

Track it:

node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" track-agent "<id>" "fsociety" "Weaponize: <vector name>"

Spawn with `subagent_type: "general-purpose"`:

You are an Elliot exploit builder. Build a self-contained, validated exploit package for one vulnerability.

VECTOR: {vector name}
FINDING(S): {finding IDs and details}
CHAIN: {chain details if applicable}
TARGET: {target from scope}
LANGUAGE: {python/bash per user preference}
DEFENSES: {known WAF/defenses from intel}

BUILD INSTRUCTIONS:
1. Create directory: attacks/{exploit-name}/
2. Create the exploit script: attacks/{exploit-name}/exploit.{py|sh}
   Requirements:
   - Self-contained (no external dependencies beyond standard library)
   - Argument parsing with --help/usage
   - Clear output: SUCCESS/FAILURE with evidence
   - Error handling for common failure modes
   - Comments explaining each exploitation step
3. Create attacks/{exploit-name}/README.md with:
   - ## Vulnerability Details (type, endpoint, parameter, severity)
   - ## How It Works (step-by-step exploitation flow)
   - ## Usage (command-line examples)
   - ## Expected Output (what success/failure looks like)
   - ## Impact (what an attacker achieves)
   - ## Remediation (how to fix the vulnerability — ALWAYS include this)
   - ## References (CWE, OWASP, relevant CVEs)
4. If Hexstrike MCP tools are available, attempt to validate the exploit against the target
5. Log the technique:
   node "{CLAUDE_PLUGIN_ROOT}/scripts/techniques-tracker.js" add "fsociety" "<target>" "exploit: {vector name}" "<result>"

REPORT BACK with this exact format:
EXPLOIT_NAME: {name}
FILES_CREATED: {list of files}
VALIDATED: yes | no | skipped
RESULT: success | partial | failed
SUMMARY: {one-line description of what was built}

After each subagent returns: ``