Home / Knowledge hub / Proof of exploit
Knowledge hub
Proof of exploit
Evidence that a flaw can be used to cause real impact, not just that it exists.
What it means
Proof of exploit is evidence that a vulnerability was actually used to do something harmful: read another customer's record, run a command, change a price. It is the recorded result of the attempt, not a warning that the attempt might work.
The difference is between a claim and a demonstration. A scanner can say a parameter looks injectable. Proof is the request that went in, the response that came back, and the data or behaviour that should never have appeared. Anyone can replay it and see the same thing.
Why it matters
Proof ends arguments. Without it, a finding becomes a debate: is this real, is it reachable, does it matter? Engineers lose days on issues that turn out to be unreachable, and real ones get pushed down the queue because nobody can show harm.
It also helps the people who sign off on risk. A manager can read a screenshot of one customer's invoice appearing in another customer's account and understand the stakes at once. Compare that with a line saying the endpoint may lack an ownership check.
How it shows up
You meet proof in a good pentest report as the request, the response, a screenshot where a person can see the outcome, and numbered reproduction steps. It is the opposite of a bare tool alert. It gives a developer something to run, not something to interpret.
Weak proof repeats. A screenshot of a scanner banner. A version number taken as evidence. An exploit run against a staging copy that behaves differently from production. Good proof is safe, minimal and repeatable: it shows the impact with the least change to real data, and the same steps work again after the fix.
Questions people ask
Proof of exploit, answered
Is proof of exploit the same as a proof of concept?
Close, but not identical. A proof of concept shows that something can work in principle, sometimes in a lab. Proof of exploit shows it working against your actual application, with the evidence attached.
In practice, a good report uses the second meaning.
Does proof of exploit mean the tester damaged our system?
It should not. The aim is to show impact with the least possible change: read one record, not dump a table, or create a harmless marker, not delete data.
Agree the limits in the rules of engagement before testing starts, including what is off limits in production.
What should proof of exploit include?
The exact request, the response, the account or role used, the time, and a clear statement of what the result means. A screenshot helps where a person can see the outcome.
It should also name the affected endpoint or code location so a developer knows where to look.
Can a scanner provide proof of exploit?
Sometimes, for simple cases such as a reflected script that visibly runs. Most scanner output is a signal based on patterns or version numbers, which still needs a person to confirm.
The test is whether the report shows the flaw being used, or only suggests it could be.
Why do some findings lack proof?
Some issues are hard to demonstrate safely, such as a flaw that would need a destructive action. Others are reported on suspicion to save time.
Treat unproven findings as leads. They may be real, but they deserve a lower place in the queue until someone confirms them.
Sources
Where this comes from
Related
Terms that sit next to this one
Exploited finding
A finding confirmed by actually using it, not one that only looks likely.
Evidence of exploitation
The request, response and screenshot showing a flaw was truly used.
Proof of concept
The smallest demonstration that a vulnerability is genuinely real.
Reproduction steps
The exact steps another person can follow to see a vulnerability for themselves.
False positive
A reported issue that turns out not to be real.
Would your findings survive an argument?
Every finding we report carries the request, the response, a screenshot where a person can see it, and the line of code. If we did not break it, we do not report it. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.