Understanding Security Vulnerability, Exploit and Payload

In the context of security, the weak points in a software are called vulnerabilities. For such a weak point to be considered a vulnerability, it should have an associated PoC (Proof of Concept) code that demonstrates the vulnerability or a way it can be taken advantage. Such a PoC code is called an exploit. Since a vulnerability can be taken advantage by several means, many exploits may be developed over time corresponding to the vulnerability.

Exploit itself doesn’t do anything on the vulnerable computer. It’s just a means to do something (possibly malicious). Payload is the code that does something on the vulnerable system. Exploit is such a thing that spawns a shell or creates an environment and runs the payload. Example payloads are Trojans, rootkits, keyloggers, reverse shells etc.

Nullz hit the nail on the head in  Security StackExchange analogically. The missile system consists of a rocket, fuel and other things plus the warhead. The rocket and other aiding material is like the exploit; the warhead that does the actual destruction is like the payload. Missile without the warhead doesn’t do much when it hits the target. Also there’s not much use in having a warhead that goes off in the bunker without a missile to launch onto the target.


One more analogy. Imagine a house with a vulnerable lock which can be unlocked using two different keys. Having identified this vulnerable lock the robber designs a key and unlocks the door of the house. This process of unlocking the door by the robber is the exploit. Whatever the robber does after getting into the home (stealing money/jewelery or implanting a camera etc.) is the payload.

Note that once the payload has launched the exploit is no longer relevant.

The flowchart of the whole process is as follows:



About Deepak Devanand

Seeker of knowledge
This entry was posted in Security and tagged , , , , . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s