WEAREOne10BILLION

.github/workflows/validate.yml

@@ -0,0 +1,33 @@
+name: Validate
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    name: Unit tests and PoC validation
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Run unit tests
+        run: python -m unittest discover -s tests -v
+
+      - name: Validate repository integrations
+        run: python validate_pocs.py

.gitignore

@@ -1,5 +1,18 @@
 .DS_Store
 Thumbs.db
+__pycache__/
+*.py[cod]
+*$py.class
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.venv/
+venv/
+node_modules/
+target/
+*.egg-info/
+.coverage
+htmlcov/
 libssh2-publickey-list-calc-poc/build/
 libssh2-publickey-list-calc-poc/x86_calc_payload_reached.txt
 libssh2-publickey-list-calc-poc/x64_calc_payload_reached.txt

CHANGELOG.md

@@ -0,0 +1,15 @@
+# Changelog
+
+All notable repository-level documentation/validation changes are tracked here.
+
+## Unreleased
+
+### Added
+
+- Added `docs/architecture.md` documenting repository components, validation pipeline, and a code-derived dependency graph.
+- Added `CONTRIBUTING.md` with contribution workflow and validation requirements.
+
+### Changed
+
+- Expanded root `README.md` with architecture overview, repository-level dependency documentation, and links to key docs/changelog.
+- Added a repository-level component dependency graph to `README.md`.

CONTRIBUTING.md

@@ -0,0 +1,53 @@
+# Contributing
+
+Thanks for helping improve Exploitarium.
+
+## Repository contribution scope
+
+This repository primarily accepts:
+
+- New self-contained PoC/research folders
+- Updates to existing PoC folders
+- Repository-level validation and documentation improvements
+
+## Required structure for new top-level entries
+
+For a new top-level PoC/research folder:
+
+1. Add a folder at repository root (non-hidden).
+2. Include a `README.md` in that folder.
+3. Add/update any supporting files (scripts, manifests, evidence, payloads).
+4. Add the folder to the root catalog table in `/README.md`.
+
+## Validation requirements
+
+Before opening a PR, run:
+
+```bash
+python -m unittest discover -s tests -v
+python validate_pocs.py
+```
+
+`validate_pocs.py` checks:
+
+- Python syntax for tracked `*.py`
+- `package.json` and generic `*.json` parse validity
+- `Cargo.toml` shape for package metadata
+- `requirements*.txt` has meaningful dependency entries
+- JavaScript syntax via `node --check`
+- Per-entry `README.md` presence
+- Root catalog consistency in `/README.md`
+
+## Dependency notes
+
+- Python 3.11+ is required for repository validation.
+- Node.js is required for JavaScript syntax checks.
+- PoC-specific dependencies should be documented in each entry's `README.md`.
+
+## Pull request checklist
+
+- [ ] Entry folder(s) include `README.md`
+- [ ] Root `README.md` catalog updated (if top-level entries changed)
+- [ ] `python -m unittest discover -s tests -v` passes
+- [ ] `python validate_pocs.py` passes
+- [ ] Documentation updated where applicable (`README.md`, `docs/architecture.md`, `CHANGELOG.md`)

README.md

@@ -1,6 +1,6 @@
-# Statement
+# 🕴️Statement
 
-This repo was incomplete when published. 
+This repo was incomplete when published.
 
 In regard to AI usage, my fuzzing workflow was automated by AI with a strict workflow. I used GPT-5.3 for ALL the fuzzing, as barely any "thought" is necessary when provided with an efficient workflow. Contrary to the growing narrative that I'm just some random child burning tokens, I DO actually have a degree in the subject and have published multiple papers on fuzzing methodology. I spent years researching and developing new tools and ideas for how to fuzz. You do NOT need a SOTA model to help you identify these issues, I promise! While being able to afford a better model is helpful, my data seems to show that it is only marginal when paired with decent human oversight and a good workflow. None of the actual PoCs themselves were vibe-coded; I did, in fact, hand-type them. I did use AI assistance for RustDesk, however, as I'm not as familiar with the language. The README files are very clearly entirely AI, however, as AI can format a pretty mean Markdown file. I reviewed them to make sure they were accurate.
 
@@ -13,15 +13,57 @@ I've also noticed a surprising amount of "security researchers" aren't able to a
 
 If you wish to collaborate/discuss with me, contact me on telegram @ashdfrkl
 
-Sharing this repo keeps me motivated to continue dropping my findings for you all. 
-
+Sharing this repo keeps me motivated to continue dropping my findings for you all.
 
 # Exploitarium
 
 A consolidated archive of my public proof-of-concept and vulnerability research writeups.
 
 Most folders contain one of my former standalone PoC repos, preserved with its original README and tracked files. New research entries are added directly here as self-contained folders.
 
+## Project architecture
+
+At repository level, architecture is intentionally simple:
+
+- **PoC directories** (top-level `*-poc` folders and similar research folders) contain exploit writeups, scripts, payloads, and per-entry `README.md` files.
+- **`validate_pocs.py`** is the integration gate that discovers tracked artifacts and validates syntax/manifests/catalog integrity.
+- **`tests/test_validate_pocs.py`** unit-tests the validator behavior and discovery rules.
+- **`.github/workflows/validate.yml`** runs unit tests plus `validate_pocs.py` on every push/PR.
+- **Root docs** (`README.md`, `cves.md`, `docs/architecture.md`, `CONTRIBUTING.md`, `CHANGELOG.md`) document usage, architecture, and repository history.
+
+### Dependency graph (from current code)
+
+```mermaid
+flowchart TD
+  A[.github/workflows/validate.yml] --> B[python -m unittest discover -s tests -v]
+  A --> C[python validate_pocs.py]
+  B --> D[tests/test_validate_pocs.py]
+  D --> C
+  C --> E[README.md catalog rows]
+  C --> F[PoC directories]
+  F --> G[README.md per PoC]
+  F --> H[*.py, *.js, *.mjs, *.cjs, *.sh, package.json, Cargo.toml, requirements*.txt, *.json, SHA256SUMS.txt]
+```
+
+## Dependencies
+
+### Repository validation dependencies
+
+- **Python 3.11+** (CI uses 3.12): required for `validate_pocs.py` and unit tests (`tomllib` is used from the standard library).
+- **Node.js** (`node --check`): required by `validate_pocs.py` to syntax-check JavaScript PoC files.
+- **No third-party Python package is required** for repository-level validation.
+
+### PoC-specific dependencies
+
+Individual PoC folders may require their own stacks (for example Rust/Cargo, C/C++ toolchains, Java/JDK, browser runtimes, Docker/QEMU, or Python packages listed in per-entry `requirements*.txt`). Treat each entry README as the source of truth for runtime/build prerequisites.
+
+## Documentation
+
+- [Architecture details](docs/architecture.md)
+- [Contributing guide](CONTRIBUTING.md)
+- [Changelog](CHANGELOG.md)
+- [CVE list from this repository](cves.md)
+
 ## Contents
 
 | Folder | Source | Tracked entries |
@@ -66,6 +108,26 @@ Most folders contain one of my former standalone PoC repos, preserved with its o
 | `systeminformer-phsvc-trusted-host-lpe-poc` | direct entry, June 24, 2026 | 3 |
 | `vlc-vp9-reschange-crash-poc` | `fae72b82f24d03cf2fb9cb55fbb2e7774f684ff3` | 3 |
 
+## Validation
+
+Repository integrity checks live in `validate_pocs.py` and cover:
+
+- Python syntax (`py_compile`) for tracked PoC scripts
+- `package.json`, `Cargo.toml`, `requirements*.txt`, and JSON manifest structure
+- JavaScript/module syntax via `node --check` for `*.js`, `*.mjs`, and `*.cjs`
+- Shell syntax via `bash -n` for tracked `*.sh` scripts
+- `SHA256SUMS.txt` manifest structure, safe repo-local path resolution, referenced-file existence, and checksum integrity
+- Per-entry `README.md` presence and root catalog consistency
+
+Run locally:
+
+```bash
+python -m unittest discover -s tests -v
+python validate_pocs.py
+```
+
+CI runs the same suite on every push and pull request (`.github/workflows/validate.yml`).
+
 ## Consolidation Check
 
 This section applies to the former standalone repositories listed above by commit hash.
@@ -87,6 +149,6 @@ Direct entries, including `c-ares-tcp-uaf-calc-poc`, `curl-smtp-expn-recipient-c
 
 ## ABUSE
 
-Do NOT, under any circumstances, use any material in this repository maliciously. This is good-faith, open-disclosure vulnerability research intended to get more people interested in exploring this area of cybersecurity. 
+Do NOT, under any circumstances, use any material in this repository maliciously. This is good-faith, open-disclosure vulnerability research intended to get more people interested in exploring this area of cybersecurity.
 
 Cybercrime is cringe.

discord-activity-stock-client-rce-poc/SHA256SUMS.txt

@@ -1,7 +1,7 @@
 c4ed9cfca96fcb747567322e7beb4f8926526245c72e22d4a190ccf061e72588  .gitignore
 05d0c62b200ce9737efb64322941f2685c7537295f1691b1ca47222d09a181c3  README.md
 e64e9b78f3a7fafeb0534a5bcdfbf170cf1c175393c284db4df8e3901b7c4a51  evidence/verified-stock-run.json
-a37a875423978b80d9b1c7545df96769624a37572fd5804b69c10070dfbdb458  exploit.html
+5e5403e68f836f579919884696e489666d2d5f71f58bc8b1048375328794ac29  exploit.html
 34f53fe856128d9441638755508da6b07a5563e80d894d79b7d67a704abcc47b  run.ps1
 61a084421bcb96e2c92d19e54a420f8df8e93ae204d184f4e7e095cbf29bdea4  server.js
 3d259aea18f6d72ed50a5d574ed10ab08e2db333be801515feceff2469344f88  wasm-module-builder.js

docs/architecture.md

@@ -0,0 +1,71 @@
+# Repository Architecture
+
+This document describes repository-level architecture from the current source code (`validate_pocs.py`, `tests/test_validate_pocs.py`, and `.github/workflows/validate.yml`).
+
+## Components
+
+- **PoC entries (top-level folders)**
+  - Self-contained exploit research folders.
+  - Each folder is expected to include a local `README.md`.
+  - Files may include Python, JavaScript, JSON manifests, Cargo manifests, requirements files, payloads, and evidence.
+
+- **Catalog (`README.md`)**
+  - Source of truth for listed top-level PoC directories.
+  - Parsed by `validate_pocs.parse_readme_catalog()`.
+
+- **Validator (`validate_pocs.py`)**
+  - Discovers target files with repository-relative exclude rules.
+  - Validates Python syntax (`py_compile`), `package.json`, generic JSON, Cargo TOML, `requirements*.txt`, JavaScript/module syntax (`node --check` for `*.js`, `*.mjs`, `*.cjs`), shell syntax (`bash -n` for `*.sh`), and `SHA256SUMS.txt` integrity manifests.
+  - Validates per-entry README presence and catalog ↔ directory consistency.
+
+- **Unit tests (`tests/test_validate_pocs.py`)**
+  - Verifies discovery behavior and validation behavior for repository and fixture repos.
+  - Imports and exercises validator internals and CLI return behavior.
+
+- **CI (`.github/workflows/validate.yml`)**
+  - Runs tests and validator on push/pull_request/workflow_dispatch.
+  - Installs Python and Node in CI to satisfy validator requirements.
+
+## Dependency graph (code-derived)
+
+```mermaid
+flowchart LR
+  subgraph CI[GitHub Actions]
+    WF[validate.yml]
+  end
+
+  subgraph Validation[Validation pipeline]
+    UT[tests/test_validate_pocs.py]
+    VP[validate_pocs.py]
+  end
+
+  subgraph Data[Repository data]
+    ROOTREADME[README.md catalog]
+    POCDIRS[top-level PoC directories]
+    POCREADME[per-entry README.md]
+    POCFILES[*.py / *.js / *.mjs / *.cjs / *.sh / package.json / Cargo.toml / requirements*.txt / *.json / SHA256SUMS.txt]
+  end
+
+  WF --> UT
+  WF --> VP
+  UT --> VP
+  VP --> ROOTREADME
+  VP --> POCDIRS
+  POCDIRS --> POCREADME
+  POCDIRS --> POCFILES
+```
+
+## Runtime/tooling dependencies
+
+- Python 3.11+ (uses `tomllib` from stdlib; CI pins 3.12)
+- Node.js for JavaScript syntax checks (`node --check`)
+- No third-party Python dependencies for repository validation
+
+## Validation contract
+
+A repository pass requires all of the following:
+
+1. Discoverable files exist and parse/compile correctly per file type.
+2. Checksum manifests have valid lines, resolve to tracked files beneath the repository root (whether written as local or repo-relative paths), and match current file bytes.
+3. Every top-level PoC directory has a `README.md`.
+4. Root catalog rows in `README.md` match top-level PoC directories exactly (no missing/extra/duplicate names).

ffmpeg-rasc-dlta-calc-poc/SHA256SUMS.txt

@@ -1,4 +1,4 @@
-673708db6c4a4688b0dd2e997f903820ad49d0a22fe32f016738df31207df405  ffmpeg-rasc-dlta-calc-poc/README.md
+15f7f742b2a95ae291edcaee5ec5d77762400a36e9e34fc2cf8b2d6721e58009  ffmpeg-rasc-dlta-calc-poc/README.md
 1c2871104b11b13ef03872113466beb7984dc8a6d49cd8150f33ccbb93a3a35a  ffmpeg-rasc-dlta-calc-poc/poc/ffmpeg_rasc_dlta_calc_poc.c
 6964fcd5c70bd71ac3a15e8e54968d1aaca24490a458c7d954511351c5ae5a11  ffmpeg-rasc-dlta-calc-poc/scripts/build_from_checkout.sh
 8e432e3d82695fe9b18c9f6f35ae420778811c5b43e894b0f817cc0bf76d0cae  ffmpeg-rasc-dlta-calc-poc/scripts/run_calc_pop.sh