What is an exploit?¶
An exploit is code, a command, request or technique designed to take advantage of a vulnerability.
Avoid the dangerous assumption¶
The dangerous assumption is that the presence of exploit code proves it was used successfully.
It does not.
An exploit may be:
- public proof-of-concept code
- a commercial or criminal tool
- a modified script
- a crafted network request
- a malicious document
- a sequence of commands
- a feature of a wider framework.
Investigators should identify:
- which vulnerability it targets
- what version or configuration it expects
- what access it attempts to gain
- what evidence of execution exists
- what result followed.
Exploit code may be present on a researcher’s, administrator’s or offender’s system without ever being used against the victim.
Likewise, the target system may record only the request and resulting behaviour, not the exploit code itself.
Do not assume that identical exploit code identifies the offender. Public and shared code may be used by many people.
The important evidence is whether the exploit reached the target, whether the vulnerable condition existed and whether the intended effect occurred.
Relevant records may include web or application logs, process activity, crash data, network captures, endpoint telemetry and newly created files or accounts.
Where exploit behaviour is product-specific, current vendor guidance should be checked.
If exploit code is recovered from a suspect device, compare creation, download and execution evidence. Possession may support capability or preparation, but it does not by itself prove deployment against the victim.
Operational takeaway¶
Treat exploit code as a method or capability, and establish separately whether it reached the target, matched the vulnerable condition and succeeded.