An exploit is code that demonstrates how a vulnerability can be used for malicious activity. The practical risk is not merely that a flaw exists: an attacker can use it to turn that flaw into unauthorized action. section 1.1
Proof-of-concept exploits often appear when a vulnerability is published, and sometimes earlier. They make the impact of a flaw concrete, which is why a patch alone is not the whole security story: teams need to know which exposed software and access points an attacker could target. section 1.1
Exploits appear in several security roles:
- Black hat attackers use tools and scripts to find vulnerabilities they can exploit for malicious or illegal aims. section 1.1
- White hat hackers use comparable tools during penetration testing to locate vulnerable access points before attackers do. section 1.1
- Security researchers document vulnerabilities and may demonstrate them before a patch leads to a CVE record. section 1.1
