How would you sell the exploit? Your buyer would want to verify it works before buying, but then you've already given it away. It's not like you could enforce a contract on this.
You don't sell the exploit, you sell the hack. You could sell someone private access to all facebook data of one person. Proving you have the ability is easy, you can just show one image that is supposed to be private, and promise the rest.
