Exploit (computer security)

An exploit is a method or piece of code that takes advantage of vulnerabilities in software,

applications, networks, operating systems, or hardware, typically for malicious purposes. The term
"exploit" derives from the English verb "to exploit," meaning "to use something to one’s own
advantage." Exploits are designed to identify flaws, bypass security measures, gain unauthorized
access to systems, take control of systems, install malware, or steal sensitive data. While an exploit
by itself may not be a malware, it serves as a vehicle for delivering malicious software by breaching
security controls.[1][2][3][4]

Researchers estimate that malicious exploits cost the global economy over US$450 billion annually.
In response to this threat, organizations are increasingly utilizing cyber threat intelligence to identify
vulnerabilities and prevent hacks before they occur.[5]

Description
Exploits target vulnerabilities, which are essentially flaws or weaknesses in a system's defenses.
Common targets for exploits include operating systems, web browsers, and various applications,
where hidden vulnerabilities can compromise the integrity and security of computer systems.
Exploits can cause unintended or unanticipated behavior in systems, potentially leading to severe
security breaches.[6][7]

Many exploits are designed to provide superuser-level access to a computer system. Attackers may
use multiple exploits in succession to first gain low-level access and then escalate privileges
repeatedly until they reach the highest administrative level, often referred to as "root." This technique
of chaining several exploits together to perform a single attack is known as an exploit chain.

Exploits that remain unknown to everyone except the individuals who discovered and developed
them are referred to as zero-day or "0day" exploits. After an exploit is disclosed to the authors of the
affected software, the associated vulnerability is often fixed through a patch, rendering the exploit
unusable. This is why some black hat hackers, as well as military or intelligence agency hackers, do
not publish their exploits but keep them private. One scheme that offers zero-day exploits is known
as exploit as a service.[8]
Classification

There are several methods of classifying exploits. Examples are by the component targeted, or by
vulnerability type. The most common is by how the exploit communicates to the vulnerable software.
Another classification is by the action against the vulnerable system, such as: unauthorized data
access; arbitrary code execution; and denial of service.

By method of communication
These include:[9]

Remote exploits – Works over a network and exploits the security vulnerability without any prior
access to the vulnerable system.

Local exploits – Requires prior access or physical access to the vulnerable system, and usually
increases the privileges of the person running the exploit past those granted by the system
administrator.

By targeted component
For example:[9]

Server-side exploits – Target vulnerabilities in server applications, such as web servers or

database servers, often by sending maliciously crafted requests to exploit security flaws.

Client-side exploits – Target vulnerabilities in client applications, such as web browsers (browser
exploits) or media players. These exploits often require user interaction, like visiting a malicious
website or opening a compromised file. Exploits against client applications may also require some
interaction with the user and thus may be used in combination with the social engineering method.

By type of vulnerability
The classification of exploits based[10][11] on the type of vulnerability they exploit and the result of
running the exploit (e.g., elevation of privilege (EoP), denial of service (DoS), spoofing) is a common
practice in cybersecurity. This approach helps in systematically identifying and addressing security
threats. For instance, the STRIDE threat model categorizes threats into six types, including Spoofing,
Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.[12]
Similarly, the National Vulnerability Database (NVD) categorizes vulnerabilities by types such as
Authentication Bypass by Spoofing and Authorization Bypass.[13]

Vulnerabilities exploited include:

 Code execution exploits – Allow attackers to execute arbitrary code on the target system,
potentially leading to full system compromise.

Denial-of-service (DoS) exploits – Aim to disrupt the normal functioning of a system or service,
making it unavailable to legitimate users.

Privilege escalation exploits – Enable attackers to gain higher privileges on a system than initially
granted, potentially leading to unauthorized actions.

Information disclosure exploits – Lead to unauthorized access to sensitive information due to

vulnerabilities in the system.

Techniques
Attackers employ various techniques to exploit vulnerabilities and achieve their objectives. Some
common methods include:[9]

Buffer overflow – Attackers send more data to a buffer than it can handle, causing it to overflow
and overwrite adjacent memory, potentially allowing arbitrary code execution.

SQL injection – Malicious SQL code is inserted into input fields of web applications, enabling
attackers to access or manipulate databases.

Cross-site scripting (XSS) – Attackers inject malicious scripts into web pages viewed by other
users, potentially leading to session hijacking or data theft.

Cross-site request forgery (CSRF) – Attackers trick users into performing actions they did not
intend, such as changing account settings, by exploiting the user's authenticated session.

Zero-click
A zero-click attack is an exploit that requires no user interaction to operate – that is to say, no key-
presses or mouse clicks.[14] These exploits are commonly the most sought after exploits (specifically
on the underground exploit market) because the target typically has no way of knowing they have
been compromised at the time of exploitation.

FORCEDENTRY, discovered in 2021, is an example of a zero-click attack.[15][16]

In 2022, NSO Group was reportedly selling zero-click exploits to governments for breaking into
individuals' phones.[17]

For mobile devices, the National Security Agency (NSA) points out that timely updating of software
and applications, avoiding public network connections, and turning the device Off and On at least
once a week can mitigate the threat of zero-click attacks.[18][19][20] Experts say that protection
practices for traditional endpoints are also applicable to mobile devices. Many exploits exist only in
memory, not in files. Theoretically, restarting the device can wipe malware payloads from memory,
forcing attackers back to the beginning of the exploit chain.[21][22]

Pivoting
Pivoting is a follow-on technique: After an exploit has compromised a system, access to other
devices on the network can be gained, so the process repeats; i.e., additional vulnerabilities can be
sought and attempts made to exploit those in turn. Pivoting is employed by both hackers and
penetration testers to expand their access within a target network. By compromising a system,
attackers can leverage it as a platform to target other systems that are typically shielded from direct
external access by firewalls. Internal networks often contain a broader range of accessible machines
compared to those exposed to the internet. For example, an attacker might compromise a web
server on a corporate network and then utilize it to target other systems within the same network.
This approach is often referred to as a multi-layered attack. Pivoting is also known as island hopping.

Pivoting can further be distinguished into proxy pivoting and VPN pivoting:

Proxy pivoting is the practice of channeling traffic through a compromised target using a proxy
payload on the machine and launching attacks from the computer.[23] This type of pivoting is
restricted to certain TCP and UDP ports that are supported by the proxy.
VPN pivoting enables the attacker to create an encrypted layer to tunnel into the compromised
machine to route any network traffic through that target machine, for example, to run a vulnerability
scan on the internal network through the compromised machine, effectively giving the attacker full
network access as if they were behind the firewall.

Typically, the proxy or VPN applications enabling pivoting are executed on the target computer as the
payload of an exploit.

Pivoting is usually done by infiltrating a part of a network infrastructure (as an example, a vulnerable
printer or thermostat) and using a scanner to find other devices connected to attack them. By
attacking a vulnerable piece of networking, an attacker could infect most or all of a network and gain
complete control.

See also
Computer security

Computer virus

Crimeware
 Exploit kit

Hacking: The Art of Exploitation (second edition)

IT risk

Metasploit

Shellcode

w3af

References
1. Latto, Nica (2020-09-29). "Exploits: What You Need to Know" ([Link]
s) . Exploits: What You Need to Know. Archived ([Link]
8/[Link] from the original on 2024-05-15. Retrieved 2024-08-12.
"An exploit is any attack that takes advantage of vulnerabilities in applications, networks,
operating systems, or hardware. Exploits usually take the form of software or code that aims to
take control of computers or steal network data."

2. "What Is an Exploit?" ([Link]

otection/[Link]) . Cisco. 2023-10-06. Archived ([Link]
40531021442/[Link]
n/[Link]) from the original on 2024-05-31. Retrieved 2024-08-12. "An exploit is a
program, or piece of code, designed to find and take advantage of a security flaw or vulnerability
in an application or computer system, typically for malicious purposes such as installing
malware. An exploit is not malware itself, but rather it is a method used by cybercriminals to
deliver malware."

3. Gonzalez, Joaquin Jay III; Kemp, Roger L. (2019-01-25). Cybersecurity: Current Writings on
Threats and Protection ([Link]
que+to+breach+the+security+of+a+network+or+information+system+in+violation+of+security+
policy%22&pg=PA241) . Jefferson, North Carolina, United States: McFarland & Company.
p. 241. ISBN 978-1-4766-3541-5. "A technique to breach the security of a network or information
system in violation of security policy."
 4. "OWASP Secure Coding Practices" ([Link]
ck-reference-guide/stable-en/03-appendices/05-glossary) . OWASP Foundation. Archived (http
s://[Link]/web/20240106035619/[Link]
ices-quick-reference-guide/stable-en/03-appendices/05-glossary) from the original on 2024-
01-06. Retrieved 2024-08-12. "To take advantage of a vulnerability. Typically this is an intentional
action designed to compromise the software's security controls by leveraging a vulnerability."

5. Indiana University, Bloomington; Samtani, Sagar; Chai, Yidong; Hefei University of Technology;
Chen, Hsinchun; University of Arizona (2022-05-24). "Linking Exploits from the Dark Web to
Known Vulnerabilities for Proactive Cyber Threat Intelligence: An Attention-Based Deep
Structured Semantic Model" ([Link]
-vulnerabilities-for-proactive-cyber-threat-intelligence-an-attention-based-deep-structured-seman
[Link]) . MIS Quarterly. 46 (2): 911–946. doi:10.25300/MISQ/2022/15392 ([Link]
org/10.25300%2FMISQ%2F2022%2F15392) .

6. "Exploit Definition" ([Link] . Malwarebytes. 2024-04-15.

Archived ([Link]
oits) from the original on 2024-05-16. Retrieved 2024-08-12. "A computer exploit is a type of
malware that takes advantage of bugs or vulnerabilities, which cybercriminals use to gain illicit
access to a system. These vulnerabilities are hidden in the code of the operating system and its
applications just waiting to be discovered and put to use by cybercriminals. Commonly
exploited software includes the operating system itself, browsers, Microsoft Office, and third-
party applications."

7. "Obtain Capabilities: Exploits, Sub-technique T1588.005" ([Link]

588/005/) . MITRE ATT&CK®. 2020-10-15. Archived ([Link]
10426/[Link] from the original on 2024-05-24.
Retrieved 2024-08-12. "Adversaries may buy, steal, or download exploits that can be used during
targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended or
unanticipated behavior to occur on computer hardware or software."

8. Leyden, J. (16 November 2021). "Exploit-as-a-service: Cybercriminals exploring potential of

leasing out zero-day vulnerabilities" ([Link]
rcriminals-exploring-potential-of-leasing-out-zero-day-vulnerabilities) . The Daily Swig:
Cybersecurity news and views. PortSwigger Ltd. Retrieved 18 December 2023.

9. "What Is An Exploit?" ([Link] . ITU

Online. 2024-06-18. Retrieved 2025-03-15.

10. "Exploits Database by Offensive Security" ([Link] . [Link].

11. "Exploit Database" ([Link] . Rapid7.

12. "What Is the STRIDE Threat Model?" ([Link]

[Link]) . [Link]. Retrieved 2025-03-15.

13. "National Vulnerability Database - Vulnerabilities" ([Link] .

[Link]. Retrieved 2025-03-15.

14. "Sneaky Zero-Click Attacks Are a Hidden Menace" ([Link]

ck-attacks-hidden-menace/) . Wired. ISSN 1059-1028 ([Link]
028) . Retrieved 2021-09-14.

15. "The Stealthy iPhone Hacks That Apple Still Can't Stop" ([Link]
ssage-zero-click-hacks/) . Wired. ISSN 1059-1028 ([Link]
8) . Retrieved 2021-09-14.

16. Whittaker, Zack (24 August 2021). "A new NSO zero-click attack evades Apple's iPhone security
protections, says Citizen Lab" ([Link]
e-security/) . TechCrunch. Archived ([Link]
[Link]/2021/08/24/nso-pegasus-bahrain-iphone-security/) from the original on 2021-
08-24. Retrieved 2025-05-25.

17. Ryan Gallagher (February 18, 2022). "Beware of 'Zero-Click' Hacks That Exploit Security Flaws in
Phones' Operating Systems" ([Link]
8/[Link]) . Insurance Journal.

18. "Why you should power off your phone once a week - according to the NSA" ([Link]
com/article/why-you-should-power-off-your-phone-once-a-week-according-to-the-nsa/) .
ZDNET. Retrieved 2025-03-01.

19. "Telework and Mobile Security Guidance" ([Link]

ile-Security-Guidance/) . [Link]. Retrieved 2025-03-01.

20. Winder, Davey. "NSA Warns iPhone And Android Users To Turn It Off And On Again" ([Link]
[Link]/sites/daveywinder/2024/06/01/nsa-warns-iphone--android-users-to-turn-it-off-an
d-on-again/) . Forbes. Retrieved 2025-03-01.

21. "Why rebooting your phone daily is your best defense against zero-click attacks" ([Link]
[Link]/article/why-rebooting-your-phone-daily-is-your-best-defense-against-zero-click-attack
s/) . ZDNET. Retrieved 2025-03-01.
22. Taylor, Craig (2020-01-10). "Exploit Chain - CyberHoot Cyber Library" ([Link]
b/20260318093337/[Link] . CyberHoot. Archived from
the original ([Link] on 2026-03-18. Retrieved
2025-03-01.

23. "Metasploit Basics – Part 3: Pivoting and Interfaces" ([Link]

010/07/12/metasploit-basics-part-3-pivoting-and-interfaces/) . Digital Bond.

External links
Media related to Computer security exploits at Wikimedia Commons