Exploit

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which statement best describes an exploit?

A A weakness in software that has not been fixed yet

B A method or piece of code that takes advantage of a vulnerability

2. A website has a flaw that lets anyone read private files. In this situation, what is the flaw?

A An exploit

B A vulnerability

3. A hacker writes a small program that uses the flaw to break into the website. What is the program?

A An exploit

B A vulnerability

4. The hacker runs the exploit against the website and steals data. What is this whole action called?

A An attack

B A vulnerability

5. Using the open door comparison, which part is the exploit?

A The tool that gets through the open door

B The open door itself

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1exploit		AA bundle of ready-made exploits that automatically scans a device for weaknesses and tries them
2exploit kit		BAn exploit kit is a bundle of tools that attackers use to find and use weaknesses. It does not fix anything. A patch is what fixes weaknesses.
3The weakness is the vulnerability, the tool that uses it is the exploit, and the act of using it is the attack		Cvulnerability -> exploit -> attack
4An exploit only works if a matching vulnerability exists, so patching the weakness stops that exploit		DA method or piece of code that takes advantage of a vulnerability to attack a system
5vulnerability = the code that attacks a system		EThis mixes up a vulnerability with an exploit. A vulnerability is the weakness, and the exploit is the code or method that attacks it.
6exploit kit = a patch that fixes weaknesses		Fpatch(vulnerability) -> exploit fails

Definitions

exploit

Fill in the Blanks

Complete each line of code by filling in the missing parts.

vulnerability = "weak login check" _______ = "code that abuses the weakness"

weakness = findWeakness(server) exploit = writeCode(weakness) ______(exploit, server)

IF patched = ____ THEN exploitWorks = false ENDIF

exploitKit = [toolA, toolB] FOR EACH tool IN __________ try(tool, targetPC)

# _____________: the open door # exploit: the tool that gets through # attack: using the tool to break in

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A weak = True

B exploit = true

C success = weak and exploit

Question 2

A weak = False

B exploit = True

C success = weak or exploit

Question 3

A vuln = "weak login"

B exploit = "tool for " + vuln

C patched = False

D if not patched

E print("Attack succeeds")

Question 4

A kit = []

B kit.append("browser exploit")

C kit.add("pdf exploit")

D print(len(kit))

Question 5

A function run_exploit(target)

B if target.vulnerable:

C return "Access gained"

D return "Blocked"

Answer Key

Exploit

Section A: Quick Questions

B — A method or piece of code that takes advantage of a vulnerability

B — A vulnerability

A — An exploit

A — An attack

A — The tool that gets through the open door

Section B: Match the Pairs

exploit → A method or piece of code that takes advantage of a vulnerability to attack a system

exploit kit → A bundle of ready-made exploits that automatically scans a device for weaknesses and tries them

The weakness is the vulnerability, the tool that uses it is the exploit, and the act of using it is the attack → vulnerability -> exploit -> attack

An exploit only works if a matching vulnerability exists, so patching the weakness stops that exploit → patch(vulnerability) -> exploit fails

vulnerability = the code that attacks a system → This mixes up a vulnerability with an exploit. A vulnerability is the weakness, and the exploit is the code or method that attacks it.

exploit kit = a patch that fixes weaknesses → An exploit kit is a bundle of tools that attackers use to find and use weaknesses. It does not fix anything. A patch is what fixes weaknesses.

Section C: Definitions

exploit — A method or piece of code that takes advantage of a vulnerability (a weakness) to attack a system. The weakness is the open door; the exploit is the tool that gets through it.

Section D: Fill in the Blanks

vulnerability = "weak login check"
exploit = "code that abuses the weakness"

weakness = findWeakness(server)
exploit = writeCode(weakness)
attack(exploit, server)

IF patched = true THEN
    exploitWorks = false
ENDIF

exploitKit = [toolA, toolB]
FOR EACH tool IN exploitKit
    try(tool, targetPC)

# vulnerability: the open door
# exploit: the tool that gets through
# attack: using the tool to break in

Section E: Spot the Error

B — Python Booleans are written with a capital letter. It should be exploit = True, otherwise Python raises a NameError.

C — An exploit only works if there is a vulnerability to use. It should be 'and', so with no weakness the attack fails even if an exploit exists.

D — An if statement needs a colon at the end of the line. It should be if not patched:

C — Python lists do not have an add method. Use kit.append("pdf exploit") to put another exploit into the exploit kit.

A — A function definition must end with a colon. It should be function run_exploit(target): so the indented lines belong to it.