End User License Agreement

Exploit Pack VOF – Exploit Pack, Control Pack, Kernel Pack, Ultimate Pack, and related software
Last updated: 21 September 2026

This End User License Agreement ("Agreement") is a legally binding agreement between Exploit Pack VOF, registered in the Netherlands under KvK number 94579121 ("Exploit Pack", "we", "us" or "our"), and the person or legal entity purchasing, downloading, installing, activating, accessing or using the Software ("Customer", "you" or "your").

By purchasing, downloading, installing, activating, accessing or using the Software, you agree to this Agreement. Where you purchase or use the Software on behalf of a company or other legal entity, you represent that you are authorised to bind that entity.

If you do not agree to this Agreement, you must not install, activate or use the Software.

1. Definitions

For the purposes of this Agreement:

"Software" means Exploit Pack, Control Pack, Kernel Pack, Ultimate Pack/EP3, where applicable), and their associated modules, agents, payloads, components, updates and documentation supplied by Exploit Pack. Separately purchased training courses and professional services are subject to their applicable terms.

"Customer" means the individual or legal entity purchasing or obtaining a license to the Software.

"Authorised User" means an individual authorised to use the Software under a purchased license. Each license seat is assigned to one named user unless otherwise expressly agreed in writing.

"Licensed Machine" means a computer or system on which an Authorised User is permitted to install or operate the Software under the applicable license.

"License Details" means the product, license type, license term, permitted users and other applicable licensing conditions specified at checkout, in a license confirmation, quotation or other written commercial agreement.

"Target Systems" means systems, applications, networks, devices, accounts and environments owned or controlled by the Customer, or for which the Customer has obtained prior explicit authorisation sufficient under applicable law and contractual requirements to perform the intended security testing or research.

"Permitted Purpose" means lawful cybersecurity testing, authorised penetration testing, authorised red teaming, adversary simulation, exploit development, vulnerability research, detection engineering, training or other legitimate security activities performed within an authorised scope.

2. Scope and Professional Use

The Software is designed for professional cybersecurity use by qualified practitioners, including penetration testers, red teams, security researchers, vulnerability researchers and internal security teams.

The Software may be used only for legitimate, lawful and authorised cybersecurity purposes in accordance with this Agreement and the applicable License Details.

Some of our products may be restricted to approved organisations or other eligible customers. Access to such products is subject to the applicable screening and approval process.

3. License Grant and Restrictions

Subject to payment of the applicable fees, approval where required and compliance with this Agreement, Exploit Pack grants the Customer a limited, non-exclusive, non-transferable and non-sublicensable license to use the Software solely for the Permitted Purpose and within the applicable License Details.

Unless otherwise specified in the License Details:

a. Each license includes one named user.

b. Each license is assigned to one Authorised User and may be used on one Licensed Machine at a time.

c. Multiple users may not share, pool or concurrently use a single license.

d. Additional users require additional purchased licenses.

e. The Software may not be transferred, resold, sublicensed, rented or made available to unauthorised third parties.

f. The Customer may use the Software for authorised engagements involving third-party systems, provided the necessary prior authorisation has been obtained.

A license may be moved to a replacement machine, subject to deactivation of the previous installation and any reasonable verification required by Exploit Pack.

License term

Unless otherwise specified in the License Details, licenses are granted for a period of one (1) year from the activation date or other expressly agreed commencement date. Annual licenses do not renew automatically unless expressly agreed at the time of purchase.

All rights not expressly granted to the Customer are reserved by Exploit Pack.

4. Permitted Use

The Customer may use the Software exclusively:

a. For the Permitted Purpose.

b. Within the authorised scope of the relevant engagement or research activity.

c. On Target Systems.

d. In accordance with all applicable laws, regulations, contracts and third-party rights.

The Customer is responsible for establishing and maintaining the appropriate authorisation and scope for each engagement. The use of the Software must be consistent with the permissions obtained for the relevant Target Systems.

5. Prohibited Conduct

The Customer shall not, and shall not permit any third party to:

a. Use the Software to obtain unauthorised access to systems, networks, devices, applications or accounts.

b. Use the Software for criminal activity, ransomware, extortion, unlawful persistence, credential theft, unauthorised interception or unauthorised data collection or exfiltration.

c. Use the Software outside the authorised scope of an engagement.

d. Operate, support or facilitate unauthorised intrusion operations, botnet activity, malware campaigns or other unlawful activities.

e. Resell, rent, lease, sublicense, distribute, lend, host or otherwise make the Software available to unauthorised third parties.

f. Copy the Software except to the extent reasonably necessary for authorised installation, backup or permitted internal use.

g. Remove, alter, obscure or circumvent license keys, product identifiers, watermarking, technical protection measures or security controls.

h. Reverse engineer, decompile, disassemble or otherwise attempt to derive source code or non-public functionality, except to the extent such restrictions are prohibited by applicable mandatory law.

i. Modify, adapt, translate or create derivative works of the Software without prior written authorisation from Exploit Pack, except where permitted by mandatory law.

j. Use the Software in a manner that violates applicable sanctions, export-control or other legal restrictions.

6. Customer Responsibilities

The Customer is responsible for:

a. Obtaining and maintaining all necessary authorisations before using the Software.

b. Ensuring that each Authorised User is appropriately qualified and competent to use the Software.

c. Defining and maintaining an authorised scope for each engagement.

d. Implementing appropriate safeguards, including backups, logging, access controls and recovery procedures, where appropriate to the intended use.

e. Ensuring that its Authorised Users comply with this Agreement and applicable laws.

f. Ensuring that the use of the Software does not unlawfully infringe third-party rights or violate contractual obligations.

The Customer acknowledges that cybersecurity and exploitation tools can affect the stability, availability and security of systems. The Customer is responsible for evaluating the risks of each engagement and taking appropriate precautions.

7. Export Controls and Sanctions

The Customer shall comply with all applicable export-control, sanctions and trade laws and regulations governing the purchase, transfer, access to and use of the Software.

The Customer shall not purchase, export, re-export, transfer or make the Software available in violation of applicable restrictions or to prohibited end users or for prohibited end uses.

Where reasonably necessary, Exploit Pack may request information or documentation to verify compliance with applicable sanctions and export-control requirements.

Exploit Pack may refuse, suspend or terminate access where it reasonably determines that providing or continuing access would violate applicable law or create a material legal or regulatory risk.

8. Customer Screening and Access Verification

Due to the nature of the Software, Exploit Pack may conduct customer screening and order verification before approving purchases, delivering licenses or providing access to certain products.

Screening may include verification of identity, company information, payment-related risk indicators, intended use and other relevant compliance information.

Exploit Pack may request additional information or reasonably necessary supporting documentation when an order requires further verification.

Where a material fraud, compliance, export-control or security concern remains unresolved, Exploit Pack may delay delivery, refuse an order or restrict access in accordance with this Agreement and applicable law.

Where screening is required, license issuance and activation are subject to approval by Exploit Pack. Payment or order confirmation does not guarantee approval or grant any right to use the Software.

Exploit Pack may decline or cancel an order where the required screening cannot be satisfactorily completed. Any payment received for a license that is declined and not delivered shall be handled in accordance with applicable law and the Return and Refund Policy.

Personal data collected during screening is processed in accordance with our Privacy Policy.

9. License Enforcement and Technical Measures

Exploit Pack may implement reasonable technical measures to manage licenses, verify activation, prevent unauthorised redistribution, protect intellectual property and maintain the integrity of the Software.

The Customer shall not interfere with, disable or circumvent such measures.

License verification and related processing of personal data are subject to the applicable Privacy Policy.

10. Updates, Upgrades and Support

Unless otherwise stated in the applicable License Details, annual licenses include software updates and technical support during the applicable license term.

Support is subject to reasonable technical limitations, fair-use requirements and the scope of the support services provided.

Updates, upgrades and new major versions are included only where specified in the applicable License Details or otherwise agreed in writing.

11. Third-Party and Open-Source Components

The Software may include or rely on third-party software, libraries, research tools or open-source components.

Such components remain subject to their respective license terms. Where a third-party license imposes requirements that conflict with this Agreement, the applicable third-party license shall prevail solely to the extent required for the relevant component.

Nothing in this Agreement restricts rights granted to the Customer under applicable third-party or open-source licenses.

12. Intellectual Property

The Software is licensed, not sold.

All intellectual property rights, title and interest in and to the Software, including its source code, modules, methods, documentation, branding, trade names, know-how and associated materials, remain the property of Exploit Pack or its respective licensors.

The Customer receives only the limited rights expressly granted under this Agreement.

No ownership, intellectual property rights or other rights in the Software are transferred to the Customer by purchasing or using a license.

13. Confidentiality

Each party shall protect non-public information received from the other party that is identified as confidential or that should reasonably be understood to be confidential in the circumstances.

The receiving party shall use such information only for purposes related to the Agreement and shall not disclose it to unauthorised third parties.

This obligation does not apply to information that the receiving party can demonstrate:

a. Is or becomes publicly available without breach of this Agreement.

b. Was lawfully known to the receiving party before disclosure.

c. Was lawfully received from a third party without confidentiality restrictions.

d. Was independently developed without use of the confidential information.

Disclosure is permitted where required by applicable law or a competent authority, provided that, where legally permitted, the disclosing party gives reasonable prior notice.

License keys, non-public product internals, unpublished documentation and non-public technical materials supplied by Exploit Pack shall be treated as confidential information.

14. Feedback

If the Customer provides suggestions, feedback, bug reports, improvement ideas or feature requests relating to the Software, Exploit Pack may use, reproduce, modify and incorporate such feedback into its products and services without compensation or restriction.

This right does not transfer ownership of the Customer's confidential information or materials and does not permit disclosure of information protected under a separate confidentiality agreement.

15. Fees, Payment and Refunds

The applicable license fees, currency, taxes, license term and other commercial conditions are specified at checkout, in the applicable quotation or in a written commercial agreement.

The Customer is responsible for paying all applicable fees in accordance with the relevant payment terms.

Annual licenses do not renew automatically unless expressly stated otherwise. A new license term requires the applicable renewal purchase or other agreed renewal arrangement.

Refunds, cancellations and any applicable withdrawal rights are governed by the applicable Return and Refund Policy and mandatory law. Nothing in this Agreement excludes or restricts any right that cannot lawfully be excluded or restricted.

16. Disclaimer of Warranties

To the maximum extent permitted by applicable law, the Software is provided on an "AS IS" and "AS AVAILABLE" basis, subject to any express commitments made in the applicable License Details or written commercial agreement.

Exploit Pack does not warrant that the Software will operate without interruption or errors, achieve a particular result, identify every vulnerability, bypass every security control or be compatible with every third-party environment.

The Software is a technical tool and does not constitute a guarantee, certification or assurance that any system, application or network is secure or free from vulnerabilities. The Customer is responsible for independently evaluating and validating the results generated by the Software and for any decisions made on the basis of those results.

The Customer acknowledges that cybersecurity testing and exploit development involve inherent technical risks, and that results may depend on factors outside Exploit Pack's control, including the Customer's environment, configuration and manner of use.

Nothing in this Agreement excludes or limits any mandatory warranty, conformity obligation or other right that cannot lawfully be excluded or limited.

17. Limitation of Liability

To the maximum extent permitted by applicable law:

a. Exclusion of Damages. Exploit Pack shall not be liable for any indirect, incidental, special, punitive, exemplary or consequential damages, including loss of profits, revenue, business opportunities, goodwill, anticipated savings, business interruption, loss or corruption of data, or costs of system recovery or remediation, regardless of the legal basis of the claim or whether such damages were foreseeable.

b. Customer's Responsibility. Exploit Pack shall not be liable for loss or damage to the extent caused by the Customer's or its Authorised Users' unauthorised use or misuse of the Software, improper configuration, failure to maintain appropriate safeguards, failure to obtain necessary authorisations, use outside the permitted scope, or violation of applicable laws or third-party requirements.

c. Risks Inherent in the Software. The Customer acknowledges that the Software consists of professional cybersecurity tools that may affect the operation, security or integrity of Target Systems. The Customer is responsible for selecting and configuring the Software, obtaining all necessary authorisations, assessing the risks of each engagement, validating the results generated by the Software and maintaining appropriate backups and recovery procedures.

Exploit Pack shall not be liable for loss or damage resulting from the Customer's failure to fulfil these responsibilities, to the extent permitted by applicable law.

d. General Exclusion of Liability. To the maximum extent permitted by applicable law, Exploit Pack excludes all liability for damages, losses, costs or expenses arising out of or in connection with the purchase, use, performance, failure or inability to use the Software, whether arising in contract, tort (including negligence), breach of statutory duty or otherwise.

e. Subsidiary Limitation of Liability. If and to the extent any liability cannot be excluded under this Section but may lawfully be limited, Exploit Pack's total aggregate liability arising out of or in connection with the affected Software shall not exceed the total license fees actually paid by the Customer for the affected license under the order giving rise to the claim.

This limit applies in aggregate to all claims arising from the same agreement or related events, regardless of the number of claims or the legal basis on which they are brought.

f. Mitigation and Notification. The Customer shall promptly notify Exploit Pack in writing of any claim relating to the Software, provide reasonably available information and take reasonable steps to mitigate any resulting loss. To the extent permitted by applicable law, Exploit Pack shall not be liable for additional losses that could reasonably have been avoided by timely notification or reasonable mitigation.

g. Mandatory Legal Exceptions. Nothing in this Agreement excludes or limits liability to the extent such exclusion or limitation is prohibited by mandatory applicable law.

18. Indemnification

To the maximum extent permitted by applicable law, the Customer shall indemnify and hold harmless Exploit Pack VOF, its partners, employees, contractors and licensors against third-party claims, demands, proceedings, losses, liabilities and reasonable legal costs to the extent directly arising from:

a. The Customer's or its Authorised Users' unlawful or unauthorised use of the Software.

b. The Customer's or its Authorised Users' failure to obtain or maintain necessary authorisations for any engagement or Target System.

c. The Customer's material breach of this Agreement.

d. The Customer's or its Authorised Users' violation of applicable law or third-party rights in connection with the use of the Software.

The Customer shall not be required to indemnify any protected party to the extent that a claim results from Exploit Pack's own breach of this Agreement or from conduct for which the Customer cannot lawfully be held responsible.

Exploit Pack shall notify the Customer of any relevant third-party claim within a reasonable time. The Customer shall be entitled to participate in the defence of such claim and shall not settle any claim in a manner that imposes an admission of liability, payment obligation or non-monetary obligation on Exploit Pack without its prior written consent.

Any failure to provide timely notice shall reduce the Customer's obligations only to the extent that the failure materially prejudices the defence of the claim.

19. Suspension and Termination

Exploit Pack may suspend all or part of a license, activation, updates, support or related services where it has reasonable grounds to believe that:

a. The Customer has materially breached this Agreement.

b. The Customer has failed to provide information or documentation reasonably required for customer screening or compliance verification.

c. Continued use presents a material fraud, security, sanctions, export-control or other legal compliance risk.

d. Continued access would expose Exploit Pack to a material legal or regulatory risk.

Where reasonably practicable, Exploit Pack shall notify the Customer of the reasons for suspension and provide an opportunity to resolve the issue. Exploit Pack may suspend access immediately, without prior notice, where necessary to address an urgent security, fraud or compliance risk or to comply with applicable law.

Exploit Pack may terminate a license immediately if a material breach cannot reasonably be remedied, continued access is prohibited by law, or immediate termination is reasonably necessary to address a serious compliance or security risk.

Upon termination, the Customer shall immediately cease using the Software and uninstall or delete all copies in its possession or control, except where retention is required by law.

Suspension or termination does not release the Customer from payment obligations already accrued. Refunds, if any, remain subject to the applicable Return and Refund Policy and mandatory law.

Termination does not affect provisions which by their nature are intended to survive termination.

20. Audit and Verification

Where Exploit Pack has reasonable grounds to suspect material license misuse, unauthorised redistribution or a significant compliance breach, the Customer shall reasonably cooperate with proportionate verification measures.

Any verification shall be limited to information reasonably necessary to investigate the relevant concern and shall be conducted with due regard to confidentiality, security and applicable data protection law.

This section does not grant Exploit Pack unrestricted access to the Customer's systems, confidential business information or unrelated data.

21. Assignment

The Customer may not assign or transfer this Agreement or any license rights without Exploit Pack's prior written consent, except where such restriction is prohibited by mandatory law.

Exploit Pack may assign this Agreement to a successor or entity acquiring all or substantially all of the relevant business or assets, provided that such assignment does not unlawfully diminish the Customer's rights.

Any attempted transfer in violation of this section shall be ineffective to the extent permitted by law.

22. Severability and No Waiver

If any provision of this Agreement is held to be invalid, unlawful or unenforceable, the remaining provisions shall remain in full force and effect.

The invalid provision shall be interpreted or adjusted only to the extent permitted by applicable law to give effect to its lawful purpose. Where that is not possible, it shall be severed without affecting the remaining provisions.

Failure or delay by Exploit Pack to enforce any provision of this Agreement shall not constitute a waiver of that provision or any other right.

23. Governing Law and Jurisdiction

This Agreement shall be governed by the laws of the Netherlands, without regard to its conflict-of-law principles.

To the maximum extent permitted by applicable law, the competent courts in Limburg, the Netherlands, shall have exclusive jurisdiction over any dispute arising out of or in connection with this Agreement.

Nothing in this section limits any mandatory jurisdictional rights or protections available to consumers under applicable law.

Exploit Pack may seek interim or protective relief from any court of competent jurisdiction where reasonably necessary to protect its intellectual property, confidential information or other legitimate rights.

24. Entire Agreement and Precedence

This Agreement, together with the applicable License Details and the Compliance & Access Policy made available to the Customer before the relevant order, forms the contractual framework governing the licensing, screening and access to the Software.

The EULA governs licensing, permitted use, suspension and termination. The Compliance & Access Policy governs customer screening and access verification. The Return and Refund Policy governs refunds and cancellations, subject to mandatory applicable law. The Privacy Policy governs the processing of personal data.

Any written commercial agreement expressly accepted by both parties shall prevail only with respect to the matters it specifically addresses.

This Agreement does not amend or replace the terms of licenses already granted under earlier agreements, unless expressly agreed in writing.

25. Contact

For questions concerning this Agreement, licenses, compliance or technical support, please contact:

Exploit Pack VOF
The Netherlands
KvK: 94579121
Email: support@exploitpack.com
Website: https://www.exploitpack.com