What is exploitation?¶
Exploitation is the use of a vulnerability or weakness to cause a system to behave in an unintended way.
Avoid the dangerous assumption¶
The dangerous assumption is that exploitation always means complex custom code.
It may involve a simple request, malformed input, reused public code, manipulated authentication flow or abuse of insecure configuration.
Exploitation may allow an offender to:
- execute code
- bypass authentication
- read data
- alter data
- gain privileges
- cause disruption
- upload files
- create a foothold.
Investigators should separate:
- the vulnerability
- the exploit method
- the exploit attempt
- successful exploitation
- the resulting effect.
A suspicious request may show an attempt.
A server error may show unexpected behaviour.
A new process or file may support successful code execution.
An unauthorised account action may show that access followed.
One stage does not automatically prove the next.
Relevant evidence may include application logs, web-server logs, process creation, crash records, network data, endpoint telemetry, file changes and vendor analysis.
Do not assume that a known exploit was used merely because the system was vulnerable to it.
Likewise, do not assume exploitation failed because no malware file was found. The effect may have been memory-only, account-based or limited to data access.
Where exploitation affects several systems, do not assume each was attacked directly. One successful exploit may create access that is then reused elsewhere. Preserve the first affected host and any movement that followed.
That sequence may alter both preservation priorities and attribution.
Operational takeaway¶
Prove the attempt, success and resulting effect of exploitation separately from the existence of the underlying vulnerability.