For a while I've played around with reproducing vulnerabilities reported in websites such as Exploit-DB (EDB) as a learning experience. However, I often find cases which I just can't get to work. In these situations, I'm not sure whether I simply don't have enough experience and I'm lacking some technical expertise, or whether the reporter missed information, or whatever.
- Are you aware of any white papers or blogs that talk about the difficulty of reproducing vulnerabilities?
- Are you aware of any white papers or blogs that teach how troubleshoot (or what to check at least) when a case is not working?
EDIT: I’m looking to read about other’s experiences and relate them to mine. I wanted to write an essay about this topic for a class. So I’m looking for references of other people who have expressed discomfort in the reproduction of vulnerabilities. If this matters, I mainly work with memory error vulnerabilities.