full-disclosure - Publishing exploit code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu Jun 30 18:47:05 2005
From: emechler at techometer.net (Erick Mechler)
Subject: Publishing exploit code - what is it good for

:: Blackhats may get along with only a handful of exploits, if they're 
:: willing to try to find targets to match their collection, but a 
:: pentester should have the collection to match the target.
:: 
:: This is doubly true if we're not talking about a dedicated pentester, 
:: but about a sysadmin with a networking/security background who likes to 
:: verify that the patches did, indeed, work.

To that I say let the people producing the patches deliver the exploit code
as a POC that the patches did, indeed, work.  Releasing exploit code before
the patch is released helps nobody except the blackhats.

:: Also, exploits will be distributed, publicly or otherwise - doing it in 
:: the open means we know what happens when.

You should, as an admin, assume that once a vulnerability is released, the 
exploit has been too, whether you see it attached to the vuln announcement 
or not.

Cheers - Erick