1-day / N-day rapid workflow

1-day / N-day rapid workflow

TL;DR: Subscribe to PoC feeds, keep a pre-built tech inventory across your programs, and within hours of a public PoC drop, sweep every matching host before patches roll out.

What it is

N-day exploitation is the race window between a vulnerability becoming public (PoC, advisory, or active in-the-wild reports) and defenders deploying the patch. Bounty hunters who win this race do not start fingerprinting at disclosure — they already know which of their targets run the affected product. The workflow is feed-watching + a queryable tech inventory + a vetted PoC runner.

Preconditions / where it applies

  • A pre-built per-target tech inventory (asset-graphing, tech-stack-fingerprinting) you can query by product+version
  • Fast notification feeds — Twitter/X infosec lists, AttackerKB, CISA KEV, vendor advisory mailing lists, Patch Tuesday digests
  • Program scope that permits active PoC verification (most do for disclosed CVEs; confirm in program-scope-reading)

Technique

  1. Watch the right feeds. Curate, do not firehose. A useful baseline:
    • Vendor advisories for the top 20 products in your inventory
    • CISA KEV catalogue (high-quality signal — these are actively exploited)
    • AttackerKB, Project Discovery nuclei-templates commits
    • A small Twitter/Mastodon list of trusted researchers
  2. Pre-build the inventory. Every recon run tags hosts with product+version. Storage shape: 
    1
2

    host, product, version, last_seen, program
api.target.tld, gitlab, 16.3.2, 2026-05-30, target-public
  3. On PoC drop:
    • Confirm authenticity (vendor advisory, GHSA, or a researcher with track record). Avoid running “PoC” code from anonymous gists — they sometimes ship malware.
    • Identify affected version range precisely.
    • Query the inventory: SELECT host FROM assets WHERE product='X' AND version IN (vulnerable_range).
  4. Probe non-destructively first. A version check, a read-only primitive, or a benign DNS-callback payload (interactsh) is enough to prove exposure. Save the request/response.
  5. Race the report. Once exposure is confirmed, submit immediately — title with CVE ID and a one-sentence impact. Programs reward speed on N-days; duplicates pile up within hours.
  6. Document the slot for next time. Add the CVE’s detection logic (favicon, response signature) to your fingerprinting templates so the next disclosure of the same product is instant.

Detection and defence

  • Defenders watch the same feeds; teams with patching SLAs measured in hours win this race
  • WAF vendors push virtual-patches within hours — your N-day window is narrow even on slow patchers
  • For the hunter: respect the program’s anti-DoS clauses. A 60-target sweep using a destructive PoC is the fastest way to a permanent ban

References