Exploit
/ɪkˈsplɔɪt/ · Noun · Verb · Security & Infosec
Definitions
Exploit in cybersecurity is a piece of code, software, data sequence, or technique that takes advantage of a vulnerability in a computer system, application, or network to cause unintended behavior, typically to gain unauthorized access, escalate privileges, or execute arbitrary code. Exploits target specific weaknesses: a buffer overflow exploit might overwrite memory to redirect execution flow, a SQL injection exploit manipulates database queries, and a privilege escalation exploit leverages a flaw to gain administrator access from a normal user account. Exploits are categorized by their target (local vs. remote), their reliability (how consistently they work), and their sophistication. Exploit frameworks like Metasploit provide modular tools for developing and executing exploits during penetration testing. The lifecycle of an exploit typically progresses from discovery (finding the vulnerability), weaponization (creating a working exploit), potential disclosure (to the vendor or publicly), and patching (the vendor releases a fix). Exploits for unpatched vulnerabilities (zero-days) command the highest prices in vulnerability markets.
In plain English: A specific technique or piece of code that uses a software flaw to do something the software wasn't meant to allow, like breaking a lock with a bobby pin.
Exploits are categorized by their attack vector: remote code execution (RCE), privilege escalation, denial of service (DoS), and information disclosure. Zero-day exploits — those used before a patch exists — are the most valuable, traded on black markets for millions of dollars.
Example: 'The zero-day exploit for the router firmware sold for $500K on the grey market. The manufacturer was notified through the bug bounty program and patched it in 48 hours.'
Source: classification / zero-day market
Etymology
- 1960s
- From Latin 'explicitum' via Old French, the word originally meant a notable deed or achievement
- 1980s
- Hackers adopt 'exploit' as both noun and verb to describe techniques that take advantage of software vulnerabilities
- 1990s
- Exploit development becomes a discipline; Bugtraq mailing list becomes the primary venue for sharing exploits
- 2013
- Zerodium and other brokers create a commercial exploit market, with prices reaching seven figures for mobile zero-days
Origin Story
The weaponized version of a software bug
An **exploit** is a piece of code or technique that takes advantage of a software vulnerability to produce unintended behavior -- typically gaining unauthorized access. The term emerged from the hacker community in the 1980s and 1990s, distinguishing the act of 'exploiting' a bug from merely discovering it.
Exploits range from simple (SQL injection via a web form) to extraordinarily sophisticated (Stuxnet used four zero-day exploits to destroy Iranian centrifuges). The exploit lifecycle goes: discovery, development, deployment, detection, patch, and eventually public disclosure.
The economics of exploits created a grey market. Zero-day exploits (unknown to the vendor) sell for $100,000 to $2 million depending on the target. Companies like Zerodium openly buy them. Bug bounty programs (HackerOne, Bugcrowd) try to redirect this talent toward responsible disclosure.
Coined by: Hacker/security community
Context: 1980s-1990s hacker culture
Fun fact: The Stuxnet worm (discovered 2010) is considered the first true cyber weapon. It used four zero-day exploits simultaneously -- an unprecedented expenditure of valuable vulnerabilities. Attributed to the US and Israel, it physically destroyed about 1,000 Iranian uranium enrichment centrifuges.