A bug hunter's diary
Klein tracks down and exploits bugs in some of the world's most popular programs. Whether by browsing source code, poring over disassembly, or fuzzing live programs, readers get an over-the-shoulder glimpse into the world of a bug hunter as Klein unearths security flaws and uses them to take control of affected systems.
Stats for nerds
5recommend
8mentions
6people
2014–2021years
88% recommend13% neutral
Mentions per year
What Hacker News says
- I could really recommend you the book A Bug Hunter's Diary by Tobias Klein which is a practical walk-trough in finding these kinds of security bugs.
- And in addition, The Bug Hunter's Diary: https://nostarch.com/bughunter
- I found Tobias Klein's _A Bug Hunter's Diary_ to be quite readable and enlightening even if I couldn't follow all of the code.
- Now that you've got a foundation in software development we can move onto exploit-development. Well not quite first you need to bridge your knowledge from building software to breaking it. For this you need to start learning about how software works at a lower level, the CPU level. There is a good book: Computer Organization and Design. Its solid but its also a textbook and covers a lot more detail than you need (though still valuable to know). It covers MIPS and how the CPU works, you probably can skip stuff about the hardware and microcode though. MIPS is a simpler assembly language than intel's stuff so its a nice starting place though.
Intel is what you'll most often encounter though so you do need to learn x86 and x86_64.
OpenSecurityTraining.info provides a number of courses that are valuable for this bridge to breaking software.
1. Life of Binaries - http://opensecuritytraining.info/LifeOfBinaries.html - This helps you go from understanding to software to understanding the system around the software and the context in which software runs. 2. Introductory Intel x86 - http://opensecuritytraining.info/IntroX86.html - Really boring/dry class on x86 instructions but gives you the introduction you need.
3. Introductory Intel x86-64 - http://opensecuritytraining.info/Intr oX86-64.html - Just slides this time, good to review and get a sense of the differences between 32bit and 64bit intel assembly.
Once you've gotten the basics its finally time to move onto learning the actual exploit development skills.
1. Introduction to Software Exploits - http://opensecuritytraining.info/Exploits1.html - In my opinion this is simply the best resource out there to learn the basics. It uses the book "The Shellcoder's Handbook" as its textbook and I completely recommend the book.
2. Hacking: The Art of Exploitation - This is the most often recommended book, its great and has a much better introduction than the Shellcoder's Handbook but if you can make it through the course above without probably you can probably skip this book as the two resources covers more content but this book is one of the best introductions available. 3. Corelan's Exploit Development Tutorial Series - https://www.corelan.be/index.php/2009/07/19/exploit-writing-... - It'll start in familiar territory but it'll get into some new stuff, overall a good series. 4. Exploitation in the Windows Environment - http://opensecuritytraining.info/Exploits2.html - You'll find some overlap with Corelan's tutorial series and this course so you might want to take this course and reference the tutorials as you go.
5. A Bug Hunter's Diary - Excellent book that covers some similar topics as the previous resources but spends a bit more time on actually finding vulnerabilities not just exploiting them and goes into more mitigations than the previous resources also, skip the stuff you already know. 6.
While learning all this exploit development stuff, there is another necessary skill to actually finding vulnerabilities: reverse engineering.
There are two books that I frequently recommend on the topic:
1. Reversing: Secrets of Reverse Engineering - this is the most popular recommendation and its a great resource to work through.
2. Practical Reverse Engineering - This is a new comer (2014) but I quite like it. It isn't as 'complete' as Reversing is but it covers a wider rage of topics that I find more useful.
3. (Bonus) Malware Analyst's Cookbook - Malware Analysis is probably the most RE heavy field you can be in so this is a solid book on the topic. Just because of its name I didn't give it a fair chance when I was reviewing books to recommend but I did review it recently and do want to give it a plug and it has a lot of practical information and labs to work on.
By this point you should have a reasonably solid foundation and a good understanding of exploitation. You will not be up to writing the latest browser 0day but you'll have the foundation necessary to understand (and learn from) modern sophisticated exploits so you can find and development them yourself. There are no resources to fill in the final gap but to go out do your research on a system and apply what you've learned to find some way to break them and development that weakness into an exploit.
To get experience, there are a few resources I can recommend:
1. Exploit-Exercises, I already mentioned Nebula, Protostar should be accessible to you once you've done the first Software Exploits course, and Fusion after the second one.
2. Over the Wire, I've already mentioned a couple of their servers, check out the rest of them.
3. Pwnable.kr - Challenges are at various levels use the harder ones to challenge yourself.
4. Capture-The-Flag competitions - every year several CTFs are run, sign up and play in them. What is nice about CTFs is that they are bite-sized challenges, still difficult, still involving modern techniques (the ones worth the most points atleast) but not tedious and they don't require a big time investment to find a weakness in. The focus of the challenge is on the exploit development rather than on finding vulnerabilities. 5. CVE lists - find software that interests you, find a known vulnerability and try to build your own exploit in it.
6. Real world software, go and break something of interest to you, learn how it works, find a vuln and exploit it.
You may need to learn a new language, or research some new techniques to handle some mitigations, but you should have the foundation necessary to figure out what you don't know and how to learn what you need.
...and with all this content I never even touched on breaking web applications, so I must atleast give mention to "The Web-Application Hackers Handbook" cover that book, practice against any of the many vulnerable meant to be hacked web-apps out there (Damn Vulnerable Web App, OWASP Mutillidae 2, HackThisSite, HellboundHackers, Enigma-Group, HackThis.co.uk, etc, etc)
Good Luck!
- Thanks for sharing this! I could wish for some tool use (gdb) screenshots, though really the inspiration to learn is valuable enough.
A next read in this vein might be Bug Hunter's Diary by Tobias Klein: https://www.nostarch.com/bughunter
- A personal favorite of mine is this book "Fuzzing: Brute Force Vulnerability Discovery", by Michael Sutton
http://amazon.decenturl.com/fuzzing
Best looking at how hackers are getting in, as-well as programming defensively. Tobias Klein's "A Bug Hunter's Diary" is a good read too:
Related
The shellcoder's handbook
8 recommend · 13
Practical Reverse Engineering
6 recommend · 10
Practical Malware Analysis
13 recommend · 19
The codebreakers
17 recommend · 30
The art of software security assessment
21 recommend · 43
Hackers
130 recommend · 236
Sandworm
20 recommend · 27
