Sell my exploits?

[kanzlooz]

n all my years of surfing on the web I've found a lot of exploits on many different websites.
One of the newest and biggest are websites that use the payment system of Ogone like [removed]. This exploit will allow you to only pay 0.01 euro for each order you do.
This concept can also be used on A LOT of other (dutch) websites like [removed].

I've contact the websites and they all didn't do a thing about it. I described what was wrong and offered my service to come over and tell more about it and discuss a fix. All the websites didn't have any interest.

Now is my (ethical) question: Can I sell my exploits?

[godofcereal]

So far its all just you saying stuff and not proving it.
If you found an exploit in those sites Im sure someone else can find it.

[radicool_systemite]

I agree with Cereal. Someone else will eventually find the exploits. It's the companies fault for not listening to you.

It's great that you've tried to inform the companies about the exploits, but if they didn't listen to you, then it hardly seems consistent for you to be the one to now go and do (i.e. exploit them) the very thing that you were trying to warn them about earlier.

[CyborgPirateNinja]

Go visit the compan(y|ies) IRL demonstrate the exploit(s) and say you're still going to release the exploit in a month...
If they didn't fix it... Its their problem...

edit:
Did they even believe you?
I sure as hell won't...

[Cruentus_Canis]

Not that I condone malicious behaviour, but if they are not listening to you, their ignorance will be their downfall. I recommend you just leave it be, and go along your merry way. Someone will find it eventually and the company and the one that exploited the flaw will bring down each other. My final advice is: don't concern your self with them.

[eljonto]

I'm not diminishing your efforts or anything- but have you thought that maybe the company didn't do anything about it because there was no exploit? maybe you were just changing client-side information? Until you actually buy something off their site with your reduced price i don't think that you have reason to inform them about the exploit.

[kanzlooz]

Thank you all for your responses.

I've opened a website with 1 exploit on it to see how it goes.

[fiftysixer]

You're not the first one to think of this - you'd be surprised at some of the secret 0-day exploits that are being sold on the underground. By all means, if you've discovered a genuine exploit, do what you want with the info.

One thing though: do NOT post links to 'target' sites.