Proof-of-Concept (PoC) Research Papers

Recent papers related to Proof-of-Concept (PoC) including exploit generation, empirical analysis, and applications. Feel free to make contributions to this repository (e.g., adding new papers) by creating pull requests.

Contents

2025 | 2024 | 2023 | 2022 | 2021 | 2020 | 2019 | 2018 | 2017 | 2016 and Before

PoC Analysis and Empirical Studies | PoC Generation | PoC Applications| Preprints

---

All Papers

2025

NDSS

• NodeMedic-FINE: Automatic Detection and Exploit Synthesis for Node.js Vulnerabilities pdf

PLDI

• Automated Exploit Generation for Node.js Packages pdf

ASE

• Learning from the Past: Real-World Exploit Migration for Smart Contract PoC Generation pdf
• DeepExploitor: LLM-Enhanced Automated Exploitation of DeepLink Attack in Hybrid Apps

USENIX Security

• Pig in a Poke: Automatically Detecting and Exploiting Link Following Vulnerabilities in Windows File Operations pdf
• Towards Automatic Detection and Exploitation of Java Web Application Vulnerabilities via Concolic Execution guided by Cross-thread Object Manipulation pdf
• ChainFuzz: Exploiting Upstream Vulnerabilities in Open-Source Supply Chains pdf

2024

S&P

• Efficient Detection of Java Deserialization Gadget Chains via Bottom-up Gadget Search and Dataflow-aided Payload Construction pdf

NDSS

• SyzBridge: Bridging the Gap in Exploitability Assessment of Linux Kernel Bugs in the Linux Ecosystem pdf

USENIX Security

• Practical Data-Only Attack Generation pdf

ICSE

• Exploiting Library Vulnerability via Migration Based Automating Test Generation pdf

2023

S&P

• ODDFUZZ: Discovering Java Deserialization Vulnerabilities via Structure-Aware Directed Greybox Fuzzing pdf

ISSTA

• 1dFuzz: Reproduce 1-Day Vulnerabilities with Directed Differential Fuzzing pdf

NDSS

• BAGUA: Towards Automatic and Precise Heap Layout Manipulation for General-Purpose Programs pdf

2022

CCS

• Evocatio: Conjuring Bug Capabilities from a Single PoC pdf

USENIX Security

• Expected Exploitability: Predicting the Development of Functional Vulnerability Exploits pdf
• SyzScope: Revealing High-Risk Security Impacts of Fuzzer-Exposed Bugs in Linux Kernel pdf

2021

CCS

• Facilitating Vulnerability Assessment through PoC Migration doi

USENIX Security

• MAZE: Towards Automated Heap Feng Shui pdf

TDSC

• OCTOPOCS: Automatic Verification of Propagated Vulnerable Code Using Reformed Proofs of Concept pdf

ICSE

• RAProducer: Efficiently Diagnose and Reproduce Data Race Bugs for Binaries via Trace Analysis pdf

ICPC

• Toward Automated Exploit Generation for Known Vulnerabilities in Open-Source Libraries pdf

2020

USENIX Security

• KOOBE: Towards Facilitating Exploit Generation of Kernel Out-Of-Bounds Write Vulnerabilities pdf

2019

USENIX Security

• KEPLER: Facilitating Control-Flow Hijacking Primitive Evaluation for Linux Kernel Vulnerabilities pdf

CCS

• Gollum: Modular and Greybox Exploit Generation for Heap Overflows in Interpreters pdf
• SLAKE: Facilitating Slab Manipulation for Exploiting Vulnerabilities in the Linux Kernel pdf

2018

CCS

• Revery: From Proof-of-Concept to Exploitable pdf

USENIX Security

• Understanding the Reproducibility of Crowd-Reported Security Vulnerabilities pdf
• NAVEX: Precise and Scalable Exploit Generation for Dynamic Web Applications pdf
• FUZE: Towards Facilitating Exploit Generation for Kernel Use-After-Free Vulnerabilities pdf

2017

CCS

• SemFuzz: Semantics-Based Automatic Generation of Proof-of-Concept Exploits pdf

2016 and Before

SIGKDD '10

• Beyond Heuristics: Learning to Classify Vulnerabilities and Predict Exploits pdf

NDSS '11

• AEG: Automatic Exploit Generation pdf

S&P '08

• Automatic Patch-Based Exploit Generation is Possible: Techniques and Implications pdf

---

Papers by Topic

PoC Analysis and Empirical Studies

Empirical studies, surveys, and measurements analyzing PoC exploits, bug reports, and vulnerability characteristics.

Exploit Reproducibility

• Understanding the Reproducibility of Crowd-Reported Security Vulnerabilities pdf

---

PoC Generation

Automated techniques for generating proof-of-concept exploits using fuzzing, symbolic execution, and program analysis.

Fuzzing-Based Generation

• SemFuzz: Semantics-Based Automatic Generation of Proof-of-Concept Exploits pdf
• ODDFUZZ: Discovering Java Deserialization Vulnerabilities via Structure-Aware Directed Greybox Fuzzing (S&P '23) pdf
• 1dFuzz: Reproduce 1-Day Vulnerabilities with Directed Differential Fuzzing (ISSTA '23) pdf
• Efficient Detection of Java Deserialization Gadget Chains via Bottom-up Gadget Search (S&P '24) pdf

Symbolic Execution and Constraint Solving

• Automatic Patch-Based Exploit Generation is Possible: Techniques and Implications (SP '08) pdf

• FUZE: Towards Facilitating Exploit Generation for Kernel Use-After-Free Vulnerabilities (USENIX Security '18) pdf

• NAVEX: Precise and Scalable Exploit Generation for Dynamic Web Applications (USENIX Security '18) pdf

• MAZE: Towards Automated Heap Feng Shui (USENIX Security '21) pdf KOOBE: Towards Facilitating Exploit Generation of Kernel Out-Of-Bounds Write Vulnerabilities (USENIX Security '20) pdf

• Gollum: Modular and Greybox Exploit Generation for Heap Overflows in Interpreters (CCS '19) pdf

• SLAKE: Facilitating Slab Manipulation for Exploiting Vulnerabilities in the Linux Kernel (CCS '19) pdf

• Toward Automated Exploit Generation for Known Vulnerabilities in Open-Source Libraries (ICPC '21) pdf

Program Analysis and Automation

• NodeMedic-FINE: Automatic Detection and Exploit Synthesis for Node.js Vulnerabilities (NDSS '25) pdf
• Automated Exploit Generation for Node.js Packages (PLDI '25) pdf
• Practical Data-Only Attack Generation (USENIX Security '24) pdf

---

PoC Applications

Applications of PoC exploits in vulnerability assessment, exploit prediction, migration, and bug reproduction.

Vulnerability Assessment and Exploitability Prediction

• Beyond Heuristics: Learning to Classify Vulnerabilities and Predict Exploits (SIGKDD '10) pdf

• Revery: From Proof-of-Concept to Exploitable (CCS '18) pdf

• Expected Exploitability: Predicting the Development of Functional Vulnerability Exploits (USENIX Security '22) pdf

• SyzBridge: Bridging the Gap in Exploitability Assessment of Linux Kernel Bugs in the Linux Ecosystem (S&P/NDSS '24) pdf

• SyzScope: Revealing High-Risk Security Impacts of Fuzzer-Exposed Bugs in Linux Kernel (USENIX Security '22) pdf

• KEPLER: Facilitating Control-Flow Hijacking Primitive Evaluation for Linux Kernel Vulnerabilities (USENIX Security '19) pdf

PoC Migration and Transformation

• Exploiting Library Vulnerability via Migration Based Automating Test Generation (ICSE '24) pdf
• Facilitating Vulnerability Assessment through PoC Migration (CCS '21) doi
• OCTOPOCS: Automatic Verification of Propagated Vulnerable Code Using Reformed Proofs of Concept (TDSC '21) pdf
• Evocatio: Conjuring Bug Capabilities from a Single PoC (CCS '22) pdf

Bug Reproduction

• RAProducer: Efficiently Diagnose and Reproduce Data Race Bugs for Binaries via Trace Analysis (ISSTA '21) pdf

---

Preprints

• PoCo: Agentic Proof-of-Concept Exploit Generation for Smart Contracts pdf
• A Systematic Study on Generating Web Vulnerability Proof-of-Concepts Using Large Language Models pdf
• Real-World Usability of Vulnerability Proof-of-Concepts: A Comprehensive Study pdf
• PoCGen: Generating Proof-of-Concept Exploits for Vulnerabilities in NPM Packages pdf
• Diffploit: Facilitating Cross-Version Exploit Migration for Open Source Library Vulnerabilities pdf

---

Contributing

Contributions are welcome:

• Adding new papers
• Suggesting improvements

License

This documentation is licensed under CC BY 4.0. Individual papers retain their original copyrights.