The shellcoder's handbook

What Hacker News says

1. travmattFeb 2020
   I've been working through https://guyinatuxedo.github.io/ while reading "The Shellcoder's Handbook" and Sam Bowne's class notes (https://samsclass.info/127/127_F19.shtml). Highly recommended
   thread
2. dsaccoJul 2017
   So, I've read most of these. Here's a tour of what is definitely useful and what you should probably avoid.

   _________________

   Do Read:

   1. The Web Application Hacker's Handbook - It's beginning to show its age, but this is still absolutely the first book I'd point anyone to for learning practical application security.

   2. Practical Reverse Engineering - Yep, this is great. As the title implies, it's a good practical guide and will teach many of the "heavy" skills instead of just a platform-specific book targeted to something like iOS. Maybe supplement with a tool-specific book like The IDA Pro Book.

   3. Security Engineering - You can probably read either this or The Art of Software Security Assessment. Both of these are old books, but the core principles are timeless. You absolutely should read one of these, because they are like The Art of Computer Programming for security. Everyone says they have read them, they definitely should read them, and it's evident that almost no one has actually read them.

   4. Shellcoder's Handbook - If exploit development if your thing, this will be useful. Use it as a follow-on from a good reverse engineering book.

   5. Cryptography Engineering - The first and only book you'll really need to understand how cryptography works if you're a developer. If you want to make cryptography a career, you'll need more; this is still the first book basically anyone should pick up to understand a wide breadth of modern crypto.

   _________________

   You Can Skip:

   1. Social Engineering: The Art of Human Hacking - It was okay. I am biased against books that don't have a great deal of technical depth. You can learn a lot of this book by reading online resources and by honestly having common sense. A lot of this book is infosec porn, i.e. "Wow I can't believe that happened." It's not a bad book, per se, it's just not particularly helpful for a lot of technical security. If it interests you, read it; if it doesn't, skip it.

   2. The Art of Memory Forensics - Instead of reading this, consider reading The Art of Software Security Assessment (a more rigorous coverage) or Practical Malware Analysis.

   3. The Art of Deception - See above for Social Engineering.

   4. Applied Cryptography - Cryptography Engineering supersedes this and makes it obsolete, full stop.

   _________________

   What's Not Listed That You Should Consider:

   1. Gray Hat Python - In which you are taught to write debuggers, a skill which is a rite of passage for reverse engineering and much of blackbox security analysis.

   2. The Art of Software Security Assessment - In which you are taught to find CVEs in rigorous depth. Supplement with resources from the 2010s era.

   3. The IDA Pro Book - If you do any significant amount of reverse engineering, you will most likely use IDA Pro (although tools like Hopper are maturing fast). This is the book you'll want to pick up after getting your IDA Pro license.

   4. Practical Malware Analysis - Probably the best single book on malware analysis outside of dedicated reverse engineering manuals. This one will take you about as far as any book reasonably can; beyond that you'll need to practice and read walkthroughs from e.g. The Project Zero team and HackerOne Internet Bug Bounty reports.

   5. The Tangled Web - Written by Michal Zalewski, Director of Security at Google and author of afl-fuzz. This is the book to read alongside The Web Application Hacker's Handbook. Unlike many of the other books listed here it is a practical defensive book, and it's very actionable. Web developers who want to protect their applications without learning enough to become security consultants should start here.

   6. The Mobile Application Hacker's Handbook - The book you'll read after The Web Application Hacker's Handbook to learn about the application security nuances of iOS and Android as opposed to web applications.

   Show morethread
3. kdbgJun 2017
   Now that you've got a foundation in software development we can move onto exploit-development. Well not quite first you need to bridge your knowledge from building software to breaking it. For this you need to start learning about how software works at a lower level, the CPU level. There is a good book: Computer Organization and Design. Its solid but its also a textbook and covers a lot more detail than you need (though still valuable to know). It covers MIPS and how the CPU works, you probably can skip stuff about the hardware and microcode though. MIPS is a simpler assembly language than intel's stuff so its a nice starting place though.

   Intel is what you'll most often encounter though so you do need to learn x86 and x86_64.

   OpenSecurityTraining.info provides a number of courses that are valuable for this bridge to breaking software.

   1. Life of Binaries - http://opensecuritytraining.info/LifeOfBinaries.html - This helps you go from understanding to software to understanding the system around the software and the context in which software runs. 2. Introductory Intel x86 - http://opensecuritytraining.info/IntroX86.html - Really boring/dry class on x86 instructions but gives you the introduction you need.

   3. Introductory Intel x86-64 - http://opensecuritytraining.info/Intr oX86-64.html - Just slides this time, good to review and get a sense of the differences between 32bit and 64bit intel assembly.

   Once you've gotten the basics its finally time to move onto learning the actual exploit development skills.

   1. Introduction to Software Exploits - http://opensecuritytraining.info/Exploits1.html - In my opinion this is simply the best resource out there to learn the basics. It uses the book "The Shellcoder's Handbook" as its textbook and I completely recommend the book.

   2. Hacking: The Art of Exploitation - This is the most often recommended book, its great and has a much better introduction than the Shellcoder's Handbook but if you can make it through the course above without probably you can probably skip this book as the two resources covers more content but this book is one of the best introductions available. 3. Corelan's Exploit Development Tutorial Series - https://www.corelan.be/index.php/2009/07/19/exploit-writing-... - It'll start in familiar territory but it'll get into some new stuff, overall a good series. 4. Exploitation in the Windows Environment - http://opensecuritytraining.info/Exploits2.html - You'll find some overlap with Corelan's tutorial series and this course so you might want to take this course and reference the tutorials as you go.

   5. A Bug Hunter's Diary - Excellent book that covers some similar topics as the previous resources but spends a bit more time on actually finding vulnerabilities not just exploiting them and goes into more mitigations than the previous resources also, skip the stuff you already know. 6.

   While learning all this exploit development stuff, there is another necessary skill to actually finding vulnerabilities: reverse engineering.

   There are two books that I frequently recommend on the topic:

   1. Reversing: Secrets of Reverse Engineering - this is the most popular recommendation and its a great resource to work through.

   2. Practical Reverse Engineering - This is a new comer (2014) but I quite like it. It isn't as 'complete' as Reversing is but it covers a wider rage of topics that I find more useful.

   3. (Bonus) Malware Analyst's Cookbook - Malware Analysis is probably the most RE heavy field you can be in so this is a solid book on the topic. Just because of its name I didn't give it a fair chance when I was reviewing books to recommend but I did review it recently and do want to give it a plug and it has a lot of practical information and labs to work on.

   By this point you should have a reasonably solid foundation and a good understanding of exploitation. You will not be up to writing the latest browser 0day but you'll have the foundation necessary to understand (and learn from) modern sophisticated exploits so you can find and development them yourself. There are no resources to fill in the final gap but to go out do your research on a system and apply what you've learned to find some way to break them and development that weakness into an exploit.

   To get experience, there are a few resources I can recommend:

   1. Exploit-Exercises, I already mentioned Nebula, Protostar should be accessible to you once you've done the first Software Exploits course, and Fusion after the second one.

   2. Over the Wire, I've already mentioned a couple of their servers, check out the rest of them.

   3. Pwnable.kr - Challenges are at various levels use the harder ones to challenge yourself.

   4. Capture-The-Flag competitions - every year several CTFs are run, sign up and play in them. What is nice about CTFs is that they are bite-sized challenges, still difficult, still involving modern techniques (the ones worth the most points atleast) but not tedious and they don't require a big time investment to find a weakness in. The focus of the challenge is on the exploit development rather than on finding vulnerabilities. 5. CVE lists - find software that interests you, find a known vulnerability and try to build your own exploit in it.

   6. Real world software, go and break something of interest to you, learn how it works, find a vuln and exploit it.

   You may need to learn a new language, or research some new techniques to handle some mitigations, but you should have the foundation necessary to figure out what you don't know and how to learn what you need.

   ...and with all this content I never even touched on breaking web applications, so I must atleast give mention to "The Web-Application Hackers Handbook" cover that book, practice against any of the many vulnerable meant to be hacked web-apps out there (Damn Vulnerable Web App, OWASP Mutillidae 2, HackThisSite, HellboundHackers, Enigma-Group, HackThis.co.uk, etc, etc)

   Good Luck!

   Show morethread
4. dsaccoMay 2016
   Glad you asked. This is a list I like to call, "how to become an extremely effective and formidable security engineer."

   1. The Web Application Hacker's Handbook

   Probably the first book you want to read; this will teach you the core mindset you need for finding security flaws in web applications as well as give a very strong foundation for the different classes of vulnerabilities.

   2. The Mobile Application Hacker's Handbook

   Good supplement to #1 for application security, obviously focused on mobile apps.

   3. The Art of Software Security Assessment

   The bible of the security industry. Especially instructive for source code review.

   4. Security Engineering (Ron Anderson)

   Supplements #3. Very instructive for injecting security into the overall SDLC and designing secure software.

   5. The Tangled Web

   Excellent historical background and good high level overview of many information security topics. Every engineer should read this, even if they don't work in security.

   6. Gray Hat Python

   Very hands on, good introduction to aspects of reverse engineering and the typical work an e.g. security consultant will do at a top firm.

   7. Practical Malware Analysis

   Very good introduction to malware analysis.

   8. Practical Reverse Engineering

   This book, along with #9 will teach you everything you need to know to effectively reverse engineer software for security-focused analysis.

   9. Reversing: Secrets of Reverse Engineering

   10. The IDA Pro Book

   You'll want this if you have any plan to work with IDA Pro at all, which is the gold standard for decompiling and reversing software.

   11. The Shellcoder's Handbook

   If you'd like to write exploits after you're done reversing software to find an exploitable bug, this is a good book to pick up.

   12. Cryptography Engineering

   Very solid and broad introduction to cryptography. Every engineer should read this, even if they don't work in security.

   13. Introduction to Modern Cryptography

   This book, along with #14 is what you want to read if you're going to work as a cryptographer or cryptanalyst professionally.

   14. Handbook of Applied Cryptography

   --------------------------------------

   Theoretically, these books should resolve your known-unknowns and your unknown-unknowns. Anyone who reads and works through the list should be capable of designing secure software, finding errors in white and black box source code reviews and finding errors in white and black box penetration tests.

   If you're looking to get into this professionally, feel free to contact me if you have any questions and I'll do my best to help.

   Show morethread
5. MvandenberghJun 2012
   I see a few other people have already recommended resources for learning about vulnerability discovery, which is mainly about fuzzers these days. A good resource for determining how to exploit that vulnerability so that it does neat things for you is The Shellcoder's Handbook (some asm required, but not too hard if you know some OS internals).
   thread
6. jdefr89Jun 2012
   If you wan't to learn to develop exploits I would read some of these few sources to get started...

   1. The Shellcoder's Handbook 2. Hacking: The Art of Exploitation 3. Gray Hat Hacking 4. w00w00 Exploiting Heaps

   Basically memory exploits all boil down to overwriting the EIP with an address that points to some code that does something.

   Of course there are all sorts of exploits, some simply send bad data to crash the server as a Proof of concept.. others are more sophisticated, either way if you can program all you need to do is learn a few methods and then writing the exploit shouldn't be so bad..

   Show morethread