Developer builds exploit-verification tool using nonces, refines design after community feedback

A developer created a security testing tool designed to confirm successful exploits by requiring targets to return a uniquely minted secret token, rather than relying on easily spoofed output like 'uid=0'. The approach uses a challenge-response mechanism — including reverse shell callbacks — to distinguish genuine code execution from false positives caused by banners or tarpits. After sharing the project publicly, commenters quickly identified a key limitation: because the nonce travels inside the payload, a reflective service could echo it back without actually executing any code. Based on that feedback, the developer outlined improvements including binding each nonce to specific attempt metadata, enforcing single-use consumption, and requiring computation-derived responses that cannot be produced by simple reflection. The episode highlights a broader principle in offensive security tooling: clearly separating what evidence actually proves from what it merely suggests.