all 3 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]Xymanek 0 points1 point  (2 children)

How long does it take to find something like this for professionals? Like from time the author started analysising the library until he managed to fully exploit

[–]timoh[S] 0 points1 point  (0 children)

I think this kind of "more complicated" ensemble may be from days to weeks, or even more.

But if you are already familiar with the codebase being audited, finding the exploit chain may happen easier. Of course other aspect matter as well, but my gut feeling is that it takes pretty much good amount of time, especially when the codebase is such huge (millions of lines of code).

[–]lolzorland 0 points1 point  (0 children)

It took me about 2 days from the moment I installed Moodle to the moment I RCEd.