0day.today Private exploits and 0day exploits Market

Zero-day exploits target zero-day vulnerabilities. Zero-day vulnerabilities are those for which no official patch has been released by the vendor. This means that no days [zero days] have elapsed between the time the vulnerability was discovered and the time an official patch was made available. Therefore, the administrators have had zero days to fix the flaw. It ceases to be a zero day once a fix is available.
Private category sells private Exploits and Vulnerabilities. Users can buy exploits using Gold [registered users] or using incognito mode [unregistered users], specify only mail to get material.

Remote exploits and vulnerabilities category

A "remote exploit" works over a network and exploits the security vulnerability without any prior access to the vulnerable system.

Local exploits and vulnerabilities category

A "local exploit" requires prior access to the vulnerable system and usually increases the privileges of the person running the exploit past those granted by the system administrator. Exploits against client applications also exist, usually consisting of modified servers that send an exploit if accessed with client application.

Webapplication (webapps) exploits and vulnerabilities category

This category is full with vulnerabilities, which was found in web projects and web applications.

DOS exploits and vulnerabilities category

PoC DoS (denial of service exploit) it exploits remote steps to check the resistance on the affected server or software denial of service vulnerability. The purpose of these attacks is to check the server or the software for resistance.

PoC (Proof Of Concept exploit) An attack against a computer or network that is performed only to prove that it can be done. It generally does not cause any harm, but shows how a hacker can take advantage of a vulnerability in the software or possibly the hardware.

Shellcode category

In computer security, a shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine, but any piece of code that performs a similar task can be called shellcode. Because the function of a payload is not limited to merely spawning a shell, some have suggested that the name shellcode is insufficient. Shellcode is commonly written in machine code.

Classification:
There are several methods of classifying exploits. The most common is by how the exploit contacts the vulnerable software. A remote exploit works over a network and exploits the security vulnerability without any prior access to the vulnerable system. A local exploit requires prior access to the vulnerable system and usually increases the privileges of the person running the exploit past those granted by the system administrator. Exploits against client applications also exist, usually consisting of modified servers that send an exploit if accessed with a client application. Exploits against client applications may also require some interaction with the user and thus may be used in combination with the social engineering method. Another classification is by the action against the vulnerable system; unauthorized data access, arbitrary code execution, and denial of service are examples. Many exploits are designed to provide superuser-level access to a computer system. However, it is also possible to use several exploits, first to gain low-level access, then to escalate privileges repeatedly until one reaches root. Normally a single exploit can only take advantage of a specific software vulnerability. Often, when an exploit is published, the vulnerability is fixed through a patch and the exploit becomes obsolete until newer versions of the software become available Shellcodes any types.