There is a perfectly good reason to use exploits. First, to check if your own system is vulnerable, and two, to verify that the patch worked.

If you know that your system is vulnerable, then you should check it out to see if it has been broken into, and if any damage was done.

If the advisory didn't have an explot attached then it would be ignored. You can't just believe any random hacker who claims to know about a vulnerability, if he does't prove it.

Or would you rather close down your systems and look for damage everytime somebody cries "Wolf!"? That would be an easy DOS in its own.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/493/13187#13187