Vulnerability

A vulnerability is a design flaw or defect that lets someone do more — or see more — than their granted privilege allows. The word can cover software, hardware, process, and operations. The focus here is technical software defects.

Exploit

Once a vulnerability is known, people often publish (or privately keep) code that triggers it to run chosen logic or reach a chosen goal. That attack code is an exploit; the term also covers the act of using it.

How exploits circulate

• Paid / commercial exploit feeds
• Free public archives
• Malicious private stock (never published)

Offensive Security's Exploit Database Archive

Discovery and patching

Most researched vulnerabilities are disclosed alongside vendor patches. Actors who want to keep an edge may withhold disclosure and use the bug privately — including state and criminal groups. Attacking a still-unpatched release is a zero-day scenario: the exploit lands before a fix exists for that version.

Vulnerability classes

Memory corruption

Unexpected memory writes or references from buggy code. Root cause is usually unsafe or misused APIs and other programming mistakes. Buffer overflows are the classic example.

Stack buffer overflow

A function that does not check bounds overwrites past a stack buffer.

char buf[20];
strcpy(buf, argv[1]);  // 임계값 검사를 하지 않는다.

Risky helpers

strcpy, gets, scanf, strcat, getwd, sprintf

Length-aware APIs are the first defense — and they still fail if you pass the wrong length:

char buf[20];
len = strlen(argv[1]);
strncpy(buf, argv[1], len); // 문자열 길이가 20을 넘을시 BOF 발생

Validate sizes before any memory or string copy.

Heap buffer overflow

Same idea as a stack overflow, but the overrun sits in heap memory. Different layout means different impact patterns.

int *buf = (int *)malloc(20);
strcpy(buf, argv[1]);  // 경계값 검사하지 않는다.

Integer overflow

Storing a value larger than the type allows. That often flips a branch so a later copy runs without the intended size check.

unsigned char maxlen = 0;
char len = 0;
char buf[30] = {0, };
 
len = strlen(argv[1]); // 128 바이트 이상 입력시 음수로 인식된다.
if (len > 30) {
	printf("Error!! MAX Size:30\n");
} else {
	printf("Vuln!!");
	strcpy(buf, argv[1]);
}

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA -> Error!! MAX Size:30
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA..128byte 이상 -> Vuln!!

A signed char treats values ≥ 128 as negative, so the len > 30 guard misses.

Format string bug

Calling a formatted print without a format string lets attackers feed format directives (%n, %hn, …) that rewrite memory.

strcpy(buf, argv[1]);
printf(buf)   // FSB

Use-after-free

Using a pointer after free. Common in browsers and other long-lived heaps where script or file loading can reshape allocations.

free(object);
object->method();   // free 되어진 포인터 사용

Double free

Freeing the same allocation twice — usually a logic bug, sometimes chained from another flaw such as an integer overflow.

int *ptr;
{
	free(ptr);
}
 
free(ptr);  // Double Free 취약점 발생

Null pointer dereference

Writing through an uninitialized or null pointer.

char *ptr = null;
...
*ptr = '1234'

Exploit taxonomy

Exploits are the code that drives a vulnerability. A common split is remote versus local.

Local exploit

Runs on a machine where the attacker already has some foothold. Typical goals are privilege escalation or local code execution — for example via argv, or via a file the process already has rights to open. Compressors, media players, document viewers, and other input-heavy apps show up often. Any program that accepts untrusted input can carry a bug.

Remote exploit

Triggered over the network. Targets are usually services listening on a port. An open port alone is not a vulnerability, but it is the exposure surface remote bugs need. Remote exploits are often the first step to a shell; a follow-on local exploit may raise privileges afterward.

References

Offensive Security's Exploit Database Archive

Packet Storm