Also, updates to open source projects document the exploit being fixed and may even have automated tests written for it. You could literally just piece the tests together into an exploit.