[phyrrus9]

It is completely possible, although it usually involves social engineering (the real kind, not the bullshit in the section here).  You overestimate companies quite a bit too.  You'll also have better luck if you write your own exploits.

This post doesn't make any sense. You write exploits after already finding a vulnerability, I don't see how writing an exploit would better your luck or why you'd need luck after already finding a vulnerability.

This isn't necessarily true. Almost every piece of code ever written is vulnerable in some way. In that case, vulnerabilities don't really mean a whole lot, since you can always exploit something. The term itself is really just a buzzword for a bug. All code has bugs, some bugs are more useful than others. You write code or input or etc that leverages a given bug to find out if it is useful. This is called a proof of concept, and although it would be an "exploit", it's usually far from the final package you use.