Definition: An exploit is a technique or a piece of code that takes advantage of specific vulnerabilities in software, hardware or network infrastructure. These vulnerabilities can open the door to unauthorized access and harmful activity that cyber criminals use to reach their goals. Exploits come in many forms: scripts, programs or just a series of commands entered into a system to compromise it.
Exploit: What the Word Means
"Exploit" comes from the English verb "to exploit", meaning to take advantage of something. It refers to the targeted use of a security flaw. German speakers also use the English term.
A picture helps: the vulnerability is a window that does not close properly. The exploit is the guide or the tool to climb through exactly this window.
Gamers know the word too. In video games, an exploit means using a bug to gain an advantage.
Vulnerability, Exploit, Payload and Malware
- Vulnerability: a flaw in software, hardware or configuration. Known flaws get a CVE number and a CVSS rating.
- Exploit: the code or method that uses the vulnerability.
- Payload: what runs after the break-in, such as a back door or ransomware.
- Malware: malicious software in general. It often uses exploits to spread.
A public exploit changes the picture a lot. Then even less skilled attackers can use the flaw. That is why the US agency CISA keeps a catalog of vulnerabilities that are known to be exploited in the wild (Known Exploited Vulnerabilities).
How an Exploit Works
- Find a flaw: attackers look for systems with a known or newly found vulnerability, often with automated scans of the internet.
- Run the exploit: they send crafted data, such as a tampered request to a web server or a rigged document by email.
- Take control: if the exploit works, the system runs foreign code or gives away data.
- Load the payload: now the real damage follows, such as data theft or ransomware.
Types of Exploits
Zero-Day Exploits
They use flaws for which there is no patch yet. Often not even the vendor knows about them. They are very dangerous and worth a lot on the black market. Read more under zero-day exploit.
Known Exploits (N-Day)
They target flaws for which an update already exists. They hit everyone who has not installed the update yet. In practice, they cause a large share of the damage.
Remote Exploits
They work over the network, without access to the device. Remote code execution (RCE) is especially critical: the attacker can run any command from afar.
Local Exploits
They require the attacker to already have access to the system. They are often used to raise one's own rights, for example from a normal user to an administrator.
Web Exploits
They target web applications, for example through SQL injection or cross-site scripting (XSS). The OWASP Top 10 give an overview.
Exploit Kits
These are ready-made toolkits that bundle several exploits. When someone visits a website, they check which flaw the browser has and use the right one.
Well-Known Examples
- EternalBlue (2017): an exploit for a flaw in the Windows file sharing service SMB. It came from the NSA, was leaked and was then used by the WannaCry ransomware.
- Heartbleed (2014): a flaw in the OpenSSL encryption library. Attackers could use it to read server memory, including passwords and keys.
- Log4Shell (2021): a flaw in the widely used Java library Log4j. A single crafted text in a log entry was enough to run foreign code.
- Stuxnet (discovered in 2010): a worm that used several zero-day flaws in Windows to sabotage industrial control systems.
Exploits in Penetration Tests
Exploits are not only used by attackers. In a penetration test, experts check on behalf of the client whether the flaws they found can really be exploited. This turns a theoretical weakness into a proven risk. Well-known tools for this are exploit collections and frameworks such as Metasploit.
In Germany, the law says: anyone who creates or spreads exploits to commit computer crimes can be liable under section 202c of the Criminal Code. For commissioned tests and security research, using them is generally allowed.
Protection Against Exploits
- Patch quickly: install security updates fast. Flaws that are already being exploited come first. See patch management.
- Replace outdated systems: software without vendor support gets no more patches. See EOL (end of life).
- Shrink the attack surface: remove services and programs you do not need and close unused ports.
- Limit rights: users and services only get the rights they need. See least privilege.
- Segment the network: a successful exploit should not be able to spread freely. See network segmentation.
- Use built-in protection: turn on the exploit protection of the operating system and use endpoint detection and response (EDR).
- Test on a regular basis: vulnerability scans and penetration tests show flaws before attackers find them.
Find Vulnerabilities Before Attackers Do
The SnapScan vulnerability scan checks your systems for known vulnerabilities of all severity levels. It does not actively attack them. The report includes CVE and CWE references and tips on fixing the issues. Systematic vulnerability management makes sure the findings are actually fixed.
Conclusion
An exploit turns a vulnerability into an attack. Most damage comes from known flaws for which an update has long been available. If you patch quickly, replace outdated systems, limit rights and test on a regular basis, you take away most of the attackers' chances.
FAQ about Exploit
What is an exploit in simple terms?
An exploit is a program, a piece of code or a sequence of commands that takes advantage of a vulnerability on purpose. The vulnerability is the open window, the exploit is the way to climb through it.
Where does the word exploit come from?
The English verb "to exploit" means to take advantage of something. An exploit takes advantage of a security flaw. German speakers use the English term as well.
What is the difference between a vulnerability and an exploit?
A vulnerability is a flaw in software, hardware or configuration. An exploit is the tool that uses this flaw. Not every vulnerability can be exploited. But once a public exploit exists, the risk rises sharply.
What is a zero-day exploit?
A zero-day exploit uses a flaw for which there is no patch yet. Often not even the vendor knows about it. The name comes from the fact that the vendor has had zero days to fix the flaw.
What does exploit mean in video games?
In games, an exploit means using a bug to gain an advantage, such as endless money or shortcuts through walls. The principle is the same as in IT security: a flaw is used on purpose.
Are exploits legal?
It depends on the purpose. In Germany, anyone who creates or spreads exploits to commit computer crimes can be liable under section 202c of the Criminal Code (StGB). For commissioned penetration tests and security research, using them is generally allowed.