PoE: A Domain-Specific Language for Exploitation

Writing exploits requires writing code that interacts with the target system. However, current exploit development is largely ad-hoc, making it difficult to analyze, maintain, or reuse exploits. Existing frameworks simply provide tools and libraries to ease the exploit development, but they do not consider the reusability of code snippets nor the understandability of the exploits. Thus, we present PoE, a novel domain-specific language for writing exploits, and discuss its design, features, and the rationale behind them. We also demonstrate with real-world examples of how PoE enables security researchers to share and reuse exploit code snippets more effectively.