Exploit

/ɪkˈsplɔɪt/ · Noun · Verb · Security & Infosec

Definitions

  1. Exploit in cybersecurity is a piece of code, software, data sequence, or technique that takes advantage of a vulnerability in a computer system, application, or network to cause unintended behavior, typically to gain unauthorized access, escalate privileges, or execute arbitrary code. Exploits target specific weaknesses: a buffer overflow exploit might overwrite memory to redirect execution flow, a SQL injection exploit manipulates database queries, and a privilege escalation exploit leverages a flaw to gain administrator access from a normal user account. Exploits are categorized by their target (local vs. remote), their reliability (how consistently they work), and their sophistication. Exploit frameworks like Metasploit provide modular tools for developing and executing exploits during penetration testing. The lifecycle of an exploit typically progresses from discovery (finding the vulnerability), weaponization (creating a working exploit), potential disclosure (to the vendor or publicly), and patching (the vendor releases a fix). Exploits for unpatched vulnerabilities (zero-days) command the highest prices in vulnerability markets.

    In plain English: A specific technique or piece of code that uses a software flaw to do something the software wasn't meant to allow, like breaking a lock with a bobby pin.

  2. Exploits are categorized by their attack vector: remote code execution (RCE), privilege escalation, denial of service (DoS), and information disclosure. Zero-day exploits — those used before a patch exists — are the most valuable, traded on black markets for millions of dollars.

    Example: 'The zero-day exploit for the router firmware sold for $500K on the grey market. The manufacturer was notified through the bug bounty program and patched it in 48 hours.'

    Source: classification / zero-day market

Etymology

1960s
From Latin 'explicitum' via Old French, the word originally meant a notable deed or achievement
1980s
Hackers adopt 'exploit' as both noun and verb to describe techniques that take advantage of software vulnerabilities
1990s
Exploit development becomes a discipline; Bugtraq mailing list becomes the primary venue for sharing exploits
2013
Zerodium and other brokers create a commercial exploit market, with prices reaching seven figures for mobile zero-days

Origin Story

The weaponized version of a software bug

An **exploit** is a piece of code or technique that takes advantage of a software vulnerability to produce unintended behavior -- typically gaining unauthorized access. The term emerged from the hacker community in the 1980s and 1990s, distinguishing the act of 'exploiting' a bug from merely discovering it.

Exploits range from simple (SQL injection via a web form) to extraordinarily sophisticated (Stuxnet used four zero-day exploits to destroy Iranian centrifuges). The exploit lifecycle goes: discovery, development, deployment, detection, patch, and eventually public disclosure.

The economics of exploits created a grey market. Zero-day exploits (unknown to the vendor) sell for $100,000 to $2 million depending on the target. Companies like Zerodium openly buy them. Bug bounty programs (HackerOne, Bugcrowd) try to redirect this talent toward responsible disclosure.

Coined by: Hacker/security community

Context: 1980s-1990s hacker culture

Fun fact: The Stuxnet worm (discovered 2010) is considered the first true cyber weapon. It used four zero-day exploits simultaneously -- an unprecedented expenditure of valuable vulnerabilities. Attributed to the US and Israel, it physically destroyed about 1,000 Iranian uranium enrichment centrifuges.

Related Terms