19. Web Exploitation, cont.

• Attack code is never part of the initial exploit.

• A malicious Web page doesn't generally host the exploit, because it would be reported more quickly.

• Instead, the malicious Website instructs the victim browser to download the exploit from another server.