Does exploit development have a future?

I mean there are a lot of fuzzers and they can find bugs better and with less time than humans.

And today's there are lots of great fuzzers.

I love exploit development, but is it worth it to learn exploit development today or not?

closed as primarily opinion-based by Steffen Ullrich, forest, LvB, Mark, Tobi Nary Dec 12 '18 at 11:09

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    Fuzzers exist to help, not to do the work for you, and also they do not always succeed. – game0ver Dec 8 '18 at 14:20

yes definitely, fuzzer just helps you to find a potentially vulnerable code. It can be a coding error but not a security issue. Fuzzing is also difficult, you need to come up with good seed test cases and then you can use tools like AFL to mutate them.

Once a crash is found, you can look into it and see if it is a security issue. And then you will go into a whole different domain - exploit development.

Operating System has a lot of protection mechanism by default nowadays and it makes exploit development much harder than before.

Exploit development is turning a bug into an arbitrary code execution and allows the attacker to hijack the privilege of the running process.


Is it worth it to learn exploit development today or not?

Prices for 0-days by 0-ethics company.

  • 1
    This doesn't explicitly answer whether it has a future, just whether it is a thing in the present. However given the price range (even if it is largely PR marketing), it is certainly safe to say that it's not going anywhere. – forest Dec 10 '18 at 8:52

The response to your question is Yes. In fact you have this company https://zerodium.com/ that makes a lot of money by buying/creating/developing exploits.

Not the answer you're looking for? Browse other questions tagged or ask your own question.