Editing Vulnerability Analysis (section)

== Manual Verification ==

Manual techniques validate scanner findings, uncover logic flaws, and craft reliable proof-of-concept exploits.

=== Common Techniques ===

* Fuzzing input parameters to trigger crashes or unexpected responses
* Reviewing source code or binaries for unsafe functions and insecure patterns
* Replaying network flows in intercepting proxies to manipulate hidden fields
* Debugging binaries with breakpoints to observe memory handling
* Static disassembly to trace vulnerable instruction sequences
* Patch diffing to spot silently fixed weaknesses
* Proof-of-concept compilation to confirm exploitability and impact
=== Tools ===

* [[Burp Suite]] (intercepting proxy for web application testing)
* [[ZAP]] (OWASP Zed Attack Proxy with active and passive scanners)
* [[Metasploit]] (framework that aligns exploits, payloads, and post modules)
* [[Ghidra]] (static disassembler and decompiler)
* [[IDA Pro]] (interactive disassembler with scripting)
* [[pwntools]] (Python framework for exploit development)
* [[radare2]] (reverse-engineering toolkit with extensive analysis capabilities)
* [[AFL]] / [[libFuzzer]] (coverage-guided fuzzers for binaries and libraries)
* [[gdb]] with [[gef]] or [[pwndbg]] (enhanced debugging for binary exploitation)