Proof-of-Concept (PoC) Research Papers
Recent papers related to Proof-of-Concept (PoC) including exploit generation, empirical analysis, and applications. Feel free to make contributions to this repository (e.g., adding new papers) by creating pull requests.
Contents
| 2026 | 2025 | 2024 | 2023 | 2022 | 2021 | 2020 | 2019 | 2018 | 2017 | 2016 and Before |
| PoC Analysis and Empirical Studies | PoC Generation | PoC Applications | Preprints |
All Papers
2026
S&P
- Contextualizing Sink Knowledge for Java Vulnerability Discovery pdf
- PUFFERDOS: Efficient and Effective Attack String Generation for Regular Expression Denial of Service Vulnerabilities pdf
NDSS
- Bullseye: Detecting Prototype Pollution in NPM Packages with Proof of Concept Exploits pdf
- ropbot: Reimaging Code Reuse Attack Synthesis pdf
USENIX Security
- “Oh, what people would do with my knife?” Navigating the Dual-Use Dilemma in PoC Exploit Development, Disclosure, and Community Dynamics pdf
- Meerkat: Pushing the Practical Limits of Dynamic Bisection with PoC Mutation pdf
- Discovering, Characterizing and Exploiting Controllable-Copy Objects for Kernel Data-Only Attacks with CopyKat pdf
ICSE
- Diffploit: Facilitating Cross-Version Exploit Migration for Open Source Library Vulnerabilities pdf
- SymRadar: PoC-Centered Bounded Verification for Vulnerability Repair
- Do Automated Fixes Truly Mitigate Smart Contract Exploits? (Journal-first) pdf
- Towards Understanding and Characterizing Vulnerabilities in Intelligent Connected Vehicles through Real-World Exploits (Distinguished Paper Award)
FSE
- PoCGen: Generating Proof-of-Concept Exploits for Vulnerabilities in NPM Packages pdf
- V2E: Validating Smart Contract Vulnerabilities through Profit-driven Exploit Generation and Execution pdf
- ChainDelta: Automatic Patch-based Exploit Generation for Ethereum with Fuzzing Agents
- It Takes Two: Option-Aware Directed Greybox Fuzzing for Vulnerability PoC Generation
ISSTA
- PAGENT: Program Analysis Guided LLM Agent for Proof-of-Concept Generation pdf
- PoCE: Automated Proof-of-Concept Synthesis using Large Language Models for Robust Validation
- Exploiting Ethereum Rollback Semantics: Profit-Driven Attack Synthesis and Off-Chain Misinterpretation Testing
ASE
- Trace-Driven Automated PoC Synthesis for On-Chain Attacks pdf
- SmartPoC: Validating Smart Contract Vulnerability Findings through PoC Generation and Execution pdf
- IntOAgent: A Practical Framework for Automated Detection and Triggering of Integer Overflow Vulnerabilities
- Assessing the Cross-Version Applicability of Java Library Vulnerability Exploits pdf
TOSEM
- PoCo: Agentic Proof-of-Concept Exploit Generation for Smart Contracts doi
2025
NDSS
- NodeMedic-FINE: Automatic Detection and Exploit Synthesis for Node.js Vulnerabilities pdf
PLDI
- Automated Exploit Generation for Node.js Packages pdf
ASE
- Learning from the Past: Real-World Exploit Migration for Smart Contract PoC Generation pdf
- DeepExploitor: LLM-Enhanced Automated Exploitation of DeepLink Attack in Hybrid Apps
USENIX Security
- Pig in a Poke: Automatically Detecting and Exploiting Link Following Vulnerabilities in Windows File Operations pdf
- Towards Automatic Detection and Exploitation of Java Web Application Vulnerabilities via Concolic Execution guided by Cross-thread Object Manipulation pdf
- ChainFuzz: Exploiting Upstream Vulnerabilities in Open-Source Supply Chains pdf
2024
S&P
- Efficient Detection of Java Deserialization Gadget Chains via Bottom-up Gadget Search and Dataflow-aided Payload Construction pdf
NDSS
- SyzBridge: Bridging the Gap in Exploitability Assessment of Linux Kernel Bugs in the Linux Ecosystem pdf
USENIX Security
- Practical Data-Only Attack Generation pdf
ICSE
- Exploiting Library Vulnerability via Migration Based Automating Test Generation pdf
2023
S&P
- ODDFUZZ: Discovering Java Deserialization Vulnerabilities via Structure-Aware Directed Greybox Fuzzing pdf
ISSTA
- 1dFuzz: Reproduce 1-Day Vulnerabilities with Directed Differential Fuzzing doi
NDSS
- BAGUA: Towards Automatic and Precise Heap Layout Manipulation for General-Purpose Programs pdf
2022
CCS
- Evocatio: Conjuring Bug Capabilities from a Single PoC pdf
USENIX Security
- Expected Exploitability: Predicting the Development of Functional Vulnerability Exploits pdf
- SyzScope: Revealing High-Risk Security Impacts of Fuzzer-Exposed Bugs in Linux Kernel pdf
2021
CCS
- Facilitating Vulnerability Assessment through PoC Migration doi
USENIX Security
- MAZE: Towards Automated Heap Feng Shui pdf
TDSC
- OCTOPOCS: Automatic Verification of Propagated Vulnerable Code Using Reformed Proofs of Concept pdf
ISSTA
- RAProducer: Efficiently Diagnose and Reproduce Data Race Bugs for Binaries via Trace Analysis pdf
ICPC
- Toward Automated Exploit Generation for Known Vulnerabilities in Open-Source Libraries pdf
2020
USENIX Security
- KOOBE: Towards Facilitating Exploit Generation of Kernel Out-Of-Bounds Write Vulnerabilities pdf
2019
USENIX Security
- KEPLER: Facilitating Control-Flow Hijacking Primitive Evaluation for Linux Kernel Vulnerabilities pdf
CCS
- Gollum: Modular and Greybox Exploit Generation for Heap Overflows in Interpreters pdf
- SLAKE: Facilitating Slab Manipulation for Exploiting Vulnerabilities in the Linux Kernel pdf
2018
CCS
- Revery: From Proof-of-Concept to Exploitable pdf
USENIX Security
- Understanding the Reproducibility of Crowd-Reported Security Vulnerabilities pdf
- NAVEX: Precise and Scalable Exploit Generation for Dynamic Web Applications pdf
- FUZE: Towards Facilitating Exploit Generation for Kernel Use-After-Free Vulnerabilities pdf
2017
CCS
- SemFuzz: Semantics-Based Automatic Generation of Proof-of-Concept Exploits pdf
2016 and Before
SIGKDD ‘10
- Beyond Heuristics: Learning to Classify Vulnerabilities and Predict Exploits pdf
NDSS ‘11
- AEG: Automatic Exploit Generation pdf
S&P ‘08
- Automatic Patch-Based Exploit Generation is Possible: Techniques and Implications pdf
Papers by Topic
PoC Analysis and Empirical Studies
Empirical studies, surveys, and measurements analyzing PoC exploits, bug reports, and vulnerability characteristics.
Exploit Reproducibility
- Understanding the Reproducibility of Crowd-Reported Security Vulnerabilities (USENIX Security ‘18) pdf
- Assessing the Cross-Version Applicability of Java Library Vulnerability Exploits (ASE ‘26) pdf
Community Practices and Exploit Landscape
- “Oh, what people would do with my knife?” Navigating the Dual-Use Dilemma in PoC Exploit Development, Disclosure, and Community Dynamics (USENIX Security ‘26) pdf
- Towards Understanding and Characterizing Vulnerabilities in Intelligent Connected Vehicles through Real-World Exploits (ICSE ‘26)
PoC Generation
Automated techniques for generating proof-of-concept exploits using fuzzing, symbolic execution, and program analysis.
Fuzzing-Based Generation
- SemFuzz: Semantics-Based Automatic Generation of Proof-of-Concept Exploits (CCS ‘17) pdf
- ODDFUZZ: Discovering Java Deserialization Vulnerabilities via Structure-Aware Directed Greybox Fuzzing (S&P ‘23) pdf
- 1dFuzz: Reproduce 1-Day Vulnerabilities with Directed Differential Fuzzing (ISSTA ‘23) doi
- Efficient Detection of Java Deserialization Gadget Chains via Bottom-up Gadget Search (S&P ‘24) pdf
- It Takes Two: Option-Aware Directed Greybox Fuzzing for Vulnerability PoC Generation (FSE ‘26)
- PUFFERDOS: Efficient and Effective Attack String Generation for Regular Expression Denial of Service Vulnerabilities (S&P ‘26) pdf
- ChainDelta: Automatic Patch-based Exploit Generation for Ethereum with Fuzzing Agents (FSE ‘26)
- Contextualizing Sink Knowledge for Java Vulnerability Discovery (S&P ‘26) pdf
Symbolic Execution and Constraint Solving
- Automatic Patch-Based Exploit Generation is Possible: Techniques and Implications (S&P ‘08) pdf
- FUZE: Towards Facilitating Exploit Generation for Kernel Use-After-Free Vulnerabilities (USENIX Security ‘18) pdf
- NAVEX: Precise and Scalable Exploit Generation for Dynamic Web Applications (USENIX Security ‘18) pdf
- MAZE: Towards Automated Heap Feng Shui (USENIX Security ‘21) pdf
- KOOBE: Towards Facilitating Exploit Generation of Kernel Out-Of-Bounds Write Vulnerabilities (USENIX Security ‘20) pdf
- Gollum: Modular and Greybox Exploit Generation for Heap Overflows in Interpreters (CCS ‘19) pdf
- SLAKE: Facilitating Slab Manipulation for Exploiting Vulnerabilities in the Linux Kernel (CCS ‘19) pdf
- Toward Automated Exploit Generation for Known Vulnerabilities in Open-Source Libraries (ICPC ‘21) pdf
LLM and Agent-Based Generation
- PoCGen: Generating Proof-of-Concept Exploits for Vulnerabilities in NPM Packages (FSE ‘26) pdf
- PAGENT: Program Analysis Guided LLM Agent for Proof-of-Concept Generation (ISSTA ‘26) pdf
- PoCE: Automated Proof-of-Concept Synthesis using Large Language Models for Robust Validation (ISSTA ‘26)
- SmartPoC: Validating Smart Contract Vulnerability Findings through PoC Generation and Execution (ASE ‘26) pdf
- Trace-Driven Automated PoC Synthesis for On-Chain Attacks (ASE ‘26) pdf
- IntOAgent: A Practical Framework for Automated Detection and Triggering of Integer Overflow Vulnerabilities (ASE ‘26)
- V2E: Validating Smart Contract Vulnerabilities through Profit-driven Exploit Generation and Execution (FSE ‘26) pdf
- PoCo: Agentic Proof-of-Concept Exploit Generation for Smart Contracts (TOSEM ‘26) doi
Program Analysis and Automation
- NodeMedic-FINE: Automatic Detection and Exploit Synthesis for Node.js Vulnerabilities (NDSS ‘25) pdf
- Automated Exploit Generation for Node.js Packages (PLDI ‘25) pdf
- Practical Data-Only Attack Generation (USENIX Security ‘24) pdf
- Bullseye: Detecting Prototype Pollution in NPM Packages with Proof of Concept Exploits (NDSS ‘26) pdf
- ropbot: Reimaging Code Reuse Attack Synthesis (NDSS ‘26) pdf
Heap Layout and Exploit Primitive Discovery
- BAGUA: Towards Automatic and Precise Heap Layout Manipulation for General-Purpose Programs (NDSS ‘23) pdf
- Discovering, Characterizing and Exploiting Controllable-Copy Objects for Kernel Data-Only Attacks with CopyKat (USENIX Security ‘26) pdf
PoC Applications
Applications of PoC exploits in vulnerability assessment, exploit prediction, migration, and bug reproduction.
Vulnerability Assessment and Exploitability Prediction
- Beyond Heuristics: Learning to Classify Vulnerabilities and Predict Exploits (SIGKDD ‘10) pdf
- Revery: From Proof-of-Concept to Exploitable (CCS ‘18) pdf
- Expected Exploitability: Predicting the Development of Functional Vulnerability Exploits (USENIX Security ‘22) pdf
- SyzBridge: Bridging the Gap in Exploitability Assessment of Linux Kernel Bugs in the Linux Ecosystem (NDSS ‘24) pdf
- SyzScope: Revealing High-Risk Security Impacts of Fuzzer-Exposed Bugs in Linux Kernel (USENIX Security ‘22) pdf
- KEPLER: Facilitating Control-Flow Hijacking Primitive Evaluation for Linux Kernel Vulnerabilities (USENIX Security ‘19) pdf
PoC-Guided Patch Validation and Repair
- SymRadar: PoC-Centered Bounded Verification for Vulnerability Repair (ICSE ‘26)
- Do Automated Fixes Truly Mitigate Smart Contract Exploits? (ICSE ‘26, Journal-first) pdf
PoC Migration and Transformation
- Exploiting Library Vulnerability via Migration Based Automating Test Generation (ICSE ‘24) pdf
- Facilitating Vulnerability Assessment through PoC Migration (CCS ‘21) doi
- OCTOPOCS: Automatic Verification of Propagated Vulnerable Code Using Reformed Proofs of Concept (TDSC ‘21) pdf
- Evocatio: Conjuring Bug Capabilities from a Single PoC (CCS ‘22) pdf
- Learning from the Past: Real-World Exploit Migration for Smart Contract PoC Generation (ASE ‘25) pdf
- Diffploit: Facilitating Cross-Version Exploit Migration for Open Source Library Vulnerabilities (ICSE ‘26) pdf
- Meerkat: Pushing the Practical Limits of Dynamic Bisection with PoC Mutation (USENIX Security ‘26) pdf
Bug Reproduction
- RAProducer: Efficiently Diagnose and Reproduce Data Race Bugs for Binaries via Trace Analysis (ISSTA ‘21) pdf
Preprints
- A Systematic Study on Generating Web Vulnerability Proof-of-Concepts Using Large Language Models pdf
- Real-World Usability of Vulnerability Proof-of-Concepts: A Comprehensive Study pdf
- Aligning Core Aspects: Improving Vulnerability Proof-of-Concepts via Cross-Source Insights pdf
- PoC-Gym: Towards More Reliable LLM-Assisted Proof-of-Concept Exploit Generation pdf
- A Dual-Loop Agent Framework for Automated Vulnerability Reproduction pdf
- EvoPoC: Automated Exploit Synthesis for DeFi Smart Contracts via Hierarchical Knowledge Graphs pdf
- Data-Centric Benchmarking of Exploit Generation in LLMs: Understanding the Impact of Fine-Tuning pdf
Contributing
Contributions are welcome:
- Adding new papers
- Suggesting improvements
License
This documentation is licensed under CC BY 4.0. Individual papers retain their original copyrights.