2

For a while I've played around with reproducing vulnerabilities reported in websites such as Exploit-DB (EDB) as a learning experience. However, I often find cases which I just can't get to work. In these situations, I'm not sure whether I simply don't have enough experience and I'm lacking some technical expertise, or whether the reporter missed information, or whatever.

  1. Are you aware of any white papers or blogs that talk about the difficulty of reproducing vulnerabilities?
  2. Are you aware of any white papers or blogs that teach how troubleshoot (or what to check at least) when a case is not working?

EDIT: I’m looking to read about other’s experiences and relate them to mine. I wanted to write an essay about this topic for a class. So I’m looking for references of other people who have expressed discomfort in the reproduction of vulnerabilities. If this matters, I mainly work with memory error vulnerabilities.

closed as too broad by David, Arminius, Eric G, tim, Anders Jan 29 '18 at 12:04

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    It might help if you asked about a specific example you're having trouble reproducing and what problems you're running into. – David Jan 17 '18 at 2:36
  • At this point I’m looking to read other’s experiences struggling with CVEs rather than solve a specific problem. I wanna see if our experiences often match. Editted – aedcv Jan 17 '18 at 4:17
  • CVEs are reports of vulnerabilities, not reports of existing, pre-designed exploits. If you discover a security bug, you may be able to get it published as a CVE without ever writing a PoC, just by virtue of the fact that it involves, for example, use-after-free bugs. – forest Jan 17 '18 at 5:36
  • This question seems way too broad and opinion-based. CVEs are just IDs for vulnerabilities, so you are basically asking "Given a description of a vulnerability, how easy is it to reproduce it?". And that obviously depends on the kind of vulnerability, the description of the vulnerability, the vulnerable software, available info online, etc. Really, the only answer we can give you is "it depends", which doesn't seem like a great answer. (in addition to being too broad, the question is also not quite clear to me. Do you mean CVEs, or exploits?) – tim Jan 25 '18 at 20:14
2

I think it's difficult to talk about "the difficulty of reproducing CVEs" as a single topic since the complexity of the underlying vulnerability varies wildly from one CVE to the next.

Exploiting some CVEs is trivial, just download the exploit code, fire it at the application and presto! You're in. Other vulnerabilities can be much trickier, requiring a very specific environment setup, or a precisely crafted payload, or both.

The general rule for defensive security is "you can't protect what you don't know" and I think the same applies, maybe to a lesser extent, to reproducing vulnerabilities. Looking back at my own experiences, the most frustrating times came when I was working on a technology stack or a vulnerability I didn't understand.

My biggest piece of advice would be for each CVE you're trying to reproduce, take the time to read the white paper and really understand how the attack works. If it's on a technology you're unfamiliar with, take the time to learn that too.

Not the answer you're looking for? Browse other questions tagged or ask your own question.