Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you learn to develop exploits?

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 87 posts

Re: Ask HN: How do you learn to develop exploits?

#71

Post by lawnchair_larry »

tptacek wrote: post #65
lawnchair_larry wrote: post #62

Earlier quoted context omitted.

That will help you find C bugs in open source software. Won't do a thing to advance your exploit-writing skills though.

I didn't bring up the list, nor did I make that list for exploit developers. Someone else posted the list, and I said that of the books on it, only TAOSSA would be particularly relevant. It's amusing that you think finding memory corruption bugs (or, "C bugs in open source software") is irrelevant to exploit development, but, O.K.

I just felt that your post could create mismatch of expectations for someone asking specifically about exploit development..

You're twisting my reply a bit though, I didn't say it's irrelevant. It does not cover binary auditing other than a casual mention (which is what I mean by open source) and it does not discuss exploit writing other than a brief intro of the theory behind them.

Chapter 4, Page 167:

"Exploit creation and software auditing are two different-but highly complementary-skill sets. ...The coverage is not intended as a definiteive guide to exploiting memory corruption vulnerabilities, but it does provide the background you need to understand and appreciate many of the vulnerabilities covered throughout this book."

It then goes on to recommend that:

"Readers interested in learning more about exploiting memory corruption vulnerabilities should pick up The Shellcoder's Handbook, or Exploiting Software ...". It also suggests Phrack and Uninformed journals.

I've read Shellcoder's Handbook and recommend it, however, it is out of date now. Despite this, I don't think the value has diminished, as current exploits build on all of the basics discussed there. Another I recommend is Hacking: The Art of Exploitation. I have not read Exploiting Software.

Re: Ask HN: How do you learn to develop exploits?

#72

Post by adrusi »

This question reminds me of when people in my school ask me "where did you learn all this computer stuff?"

You can't make a list of resources that will get you to your goal, you can make one that will give you the foundational knowledge you need to start, but after that you just need to live in the right mindset and start doing it.

I'm not and exploit developer, but I'd imagine that the following would be useful practice:

1) Find a famous exploit, and read about what it accomplished but not how it was done. Then attempt to redo it. When you get stuck, look at what the original exploit did and continue from there. 2) Do the above on a heavily exploited technology, but only read about a few of the exploits. While attempting to exploit in one way, keep your eye out for other holes that you can exploit and develop an exploit that you hadn't even heard of before. It's probably already been done, but you came up with it independently. 3) Now try the same on something less exploited, but still with at least one exploit that you can follow along with. Try to develop a completely original exploit in this way. 4) Now find something unexploited and dig around for an exploit. Now you have enough practice that you should have the ability to identify a potential exploit when confronted with it.

Of course, you should repeat each of the above steps at least a few times before moving on to the next.

Re: Ask HN: How do you learn to develop exploits?

#73

Post by unconed »

saurik wrote: post #21

I would argue the magazines (such as 2600, which I absolutely loved when I was young) and books and oral tradition are all just ways of passing around specific and awesome anecdotes: it doesn't teach you how to do that, it is just interesting facts or entertainment for people who know. What you need, instead, is a mindset: when you are at the supermarket checking out with one of those self-checkout machines, does som…

Specifically with code, you have to learn how to see it in a more abstract way. Not just a sequence of instructions, but a function that operates on a space of inputs, some good, some bad. Almost like a quantum superposition of all possible inputs, and which outputs those generate.

There is a great interactive article on this by Bret Victor: http://worrydream.com/LadderOfAbstraction/

Re: Ask HN: How do you learn to develop exploits?

#74

Post by sitkack »

DanBC wrote: post #46
manish_gill wrote: post #34

Earlier quoted context omitted.

That would be really nice. I actually started learning programming so I could become a better "h4x0r" (I was a kid). But then I discovered I liked making things a lot more. I'd be really fun to go back and learn the things that inspired me to play with a computer in the first place.

For some (old, out of date) information you could have a look at Fravia's information. ( http://www.woodmann.com/fravia/ ) This is ancient; and Fravia is dead, so updates are unlikely. Fravia was also Italian and the writing is, uh, sometimes hard to follow. But I include it because it gives insight to the frame of mind that is needed, and is comprehensive about the tools that used to be used. ( http://en.wikipedia.o…

rip. His cracking, reversing and searching tutorials are an amazing body of work.

Re: Ask HN: How do you learn to develop exploits?

#75

Post by jamesbritt »

orthecreedence wrote: post #69
wasd wrote: post #16

Earlier quoted context omitted.

+1

"I will write blog posts if people support this notion." "I support you writing blog posts on this matter." Downvotes ensue... . Seriously?

Doesn't upvoting the original comment suffice?

Do people really need to also write out their support?

Re: Ask HN: How do you learn to develop exploits?

#76

Post by aestetix »

DanBC wrote: post #46
manish_gill wrote: post #34

Earlier quoted context omitted.

That would be really nice. I actually started learning programming so I could become a better "h4x0r" (I was a kid). But then I discovered I liked making things a lot more. I'd be really fun to go back and learn the things that inspired me to play with a computer in the first place.

For some (old, out of date) information you could have a look at Fravia's information. ( http://www.woodmann.com/fravia/ ) This is ancient; and Fravia is dead, so updates are unlikely. Fravia was also Italian and the writing is, uh, sometimes hard to follow. But I include it because it gives insight to the frame of mind that is needed, and is comprehensive about the tools that used to be used. ( http://en.wikipedia.o…

I cannot upvote this enough. Fravia was brilliant, also check out searchlores, where he views the internet as a binary. Beautiful, beautiful work.

Re: Ask HN: How do you learn to develop exploits?

#77

Post by dhx »

The following comment will likely be deemed controversial—but also critical to understanding how the open source community operates with respect to security issues.

Recognise that a lot of hype and circus has built up around around the field of ICT security. Linus made a very public and passionate argument in mid 2008 on the topic. Some sample quotes:

  So I personally consider security bugs to be just "normal bugs". I don't
  cover them up, but I also don't have any reason what-so-ever to think it's
  a good idea to track them and announce them as something special.
  ...
  To me, security is important. But it's no less important than everything 
  *else* that is also important!
―Linus Torvalds[1]

Part of Linus’ argument stems from the bazaar[2] model for developing software. A separate security ecosystem that works in secret and controls the distribution of source code is a throwback to the cathedral[2] model. Linux continues to be a success because it does not use the cathedral model.

Linux development occurs in the open amongst many selfish parties that sit anywhere on the scale between not caring at all about security to being paranoid about security at the exclusion of all other interests. In the middle of this disorder is someone like Linus who is trusted by the community to balance interests. On one side of the debate is PaX/grsecurity (or similar projects) lobbying for more controls and security features in the kernel. This party is generally happier to trade off factors such as performance and ease of kernel maintenance to gain additional security. The other side of the debate may be supercomputing users or embedded platforms who are not willing to trade off performance.

The security hype and circus around security-related bugs can be very dangerous to the ongoing health of open source software projects. I will use the personal example of Mantis Bug Tracker—a project I have contributed to for the past few years. Many of the contributions I have made to the project are security related—XSS, CSRF, access control, cryptography and more[3]. The CSRF protection in particular is a disgrace within Mantis Bug Tracker—for reasons unrelated to security. A few years ago, some forms within MantisBT were protected by CSRF nonces. Obviously this is not a good situation—every form which results in changes to state or data should be protected. I went through every form (grep -PRn "When usability is broken to the detriment of security, the natural and completely understandable user decision may be to disable form CSRF security altogether or switch to another piece of bug tracking software that is less secure—but also more usable. This is a security failure worth being concerned over.

The bazaar model calls for these issues to be thrown out in public on project mailing lists, bug trackers and source code repositories in the hope that a maximum number of eyes will look over the issue and feel a compulsion to assist with patches in the shortest period of time. Hopefully usability issues about any proposed patches are considered as part of this process, preventing the problem I mentioned above with CSRF nonce time-outs. The cathedral model on the other hand prefers to keep these issues secret amongst a select group of self-titled “experts” (core developers or otherwise). The chance of a quick resolution amongst this small group is smaller than if the issue was public with hundreds of eyes looking upon it. There is also a much greater chance that a small highly biased group will fail to correctly consider all the trade-offs.

In summary,

* Recognise that security is a trade-off against other factors and a balance needs to be struck. Bruce Schneier has been repeating this statement for over a decade on his blog. Linus has been proclaiming it on the Kernel mailing list. It is important.

* Know what the bazaar model of software development is, how it works and why the concept of secret walled-garden development communities in a much larger open source project can be considered offensive.

* Software developers have many “most important” problems to deal with at any time and are often volunteering their time. A bad, demanding attitude from a security researcher will not help.

* Security patches do not warrant a Millennium Prize any more-so than a patch to resolve a severe performance regression, data loss bug or major usability issue. Standing on top of a security pedestal in the sky is the antithesis to gaining respect from open source communities.

* Study the work of programmers who are well respected for their knowledge and experience with creating secure software. Some examples are Daniel J. Bernstein (djbdns amongst numerous other projects), Chris Evans (vsftpd), Timo Sirainen (Dovecot), Wietse Venema (Postfix) and Igor Sysoev (Nginx). If you want to make a contribution to ICT security there is no better way of doing it than creating your own secure-by-design software that is relied upon by billions of Internet users each day. The adversarial mindset is important but is not worth much without an ability to practically implement constructive changes.

[1] http://kerneltrap.org/Linux/Security_Bugs_and_Full_Disclosur...

[2] http://www.catb.org/~esr/writings/cathedral-bazaar/cathedral...

[3] Refer to oss-security@lists.openwall.com, mantisbt-dev@lists.sourceforge.net, http://www.mantisbt.org/bugs/search.php?project_id=0&cat...

Re: Ask HN: How do you learn to develop exploits?

#78

Post by toemetoch »

crankyadmin wrote: post #6

Read as much as you can about assembly. Debuggers are your best friend. Pick a target (app, iPhone, xbox, whatever). Attach debugger and step through the code and learn possible entry vectors (buffer overflow, loading for arbitrary file i.e. pdfs, so forth). Once you have an entry vector you essentially have an exploit, the rest is developing that exploit to do something "useful". Sorry for the shortness of this resp…

I'd like to add an example from the old days: "Ralf Brown's Interrupt List" [link]. It's a list of interrupts used by various software packages with documented weaknesses (typically register range checks). Whenever I'd write an ISR I'd check the list to avoid collisions with other software. Others would use it for writing exploits, the list contains a plethora of attack vectors.

[link] http://www.ctyme.com/rbrown.htm

Re: Ask HN: How do you learn to develop exploits?

#79

Post by _b8r0 »

Vivek Ramachandran's Exploit Research Megaprimer[1] is a good video series for the basics. Peter van Eeckhoutte's article series[2] also provide a good hands on for getting started. Vivek's doing a training course at 44Con (disclaimer: I'm one of the organisers) that covers some of this[3] and looks quite promising but if London's a bit of a stretch you should be able to find training courses at conferences closer to home.

The Shellcoder's handbook is a good starting point too but is getting a bit long in the tooth. Attacking the core is a good starter on kernel bug dev. Both should be available on Amazon.

It's also worth pointing out that if you have a local Def Con chapter it's worth going at least once or twice to see whether or not you like it. Same if there's a local BSides event - these are free events, wildly variable in quality but run by the community for the community. There's also other cons like 44Con, Brucon, Cansec, Defcon etc. if you really want to get into it but these can be quite expensive.

I'm not sure where you're based, but if you're in or near London the local Def Con chapter DC4420[4] is on tuesday downstairs at the Phoenix, Cavendish square near Oxford Circus. I'll be there and will be more than happy to have a chat with you and introduce you to people.

[1] - http://www.securitytube.net/groups?operation=view&groupI...

[2] - http://www.corelan.be/index.php/articles/

[3] - http://44con.com/training/vivek-ramachandran-hacking-with-py...

[4] - http://dc4420.org/

Re: Ask HN: How do you learn to develop exploits?

#80

Post by uki »

Well exploit development is quite a broad topic - while the answers below provides answers that should pretty much help provide a certain perspective, I sure hope that this helps too.

Lets start off with Web-application security - the most common of attack vectors are detailed as part of OWASP top 10 - you can read more about specific attacks with simple google searches, there are loads of articles that do the same. In order to write exploits you can try the wargames which are present online, or download intentionally vulnerabile operating systems/applications and practice on them(DVL, DVWA etc). The techniques involved in finding these vulnerabilities include fuzzing, vulnerability scanning, source code audit and manual blackbox testing.

Another area of exploitation is that of binaries that run on a particular operating system. Such exploitation usually requires you to find the vulnerability using reverse engineering/source code audit and/or fuzzing. Writing exploits requires you to have at least a good understanding of the stack layout, calling conventions, asm and shellcode. Of course, in this case I am referring to "overflow" vulns and not logical errors.

In order to practice exploitation, you can try out wargames as they are an excellent resource. There are wargames for binary exploitation(smashthestack.org, overthewire.org), webapp hacking(hacking-lab, hackthissite.org, DVWA, and LOADS more) and crypto(overthewire.org and smashthesite.org have crypto wargames), linux admin hacking(hacking-lab has a few every now and then).

Exploit development requires one to have strong fundamentals and understand how exactly stuff works under the hood. There are quite a few books that you might find interesting based one your interests. If you are into webapplication hacking Id suggest "the tangled web" and "the web application hackers handbook". If you are into binary hacking id suggest "the shellcoders handbook"(there are so many more awesome ones but this ones the best to start off with IMO).

Please note that here I have answered the question "How to develop exploits" rather than questions such as "How do i develop the security mindset" and "How do I find security vulnerabilities".

Hope this helps.

[EDIT]

For purposes of learning do NOT use scanners(such a sqlmap), automation frameworks(for eg: msf for generating shellcode). While I think these tools are AWESOME, they should only be used once you have learnt how they work and when you reach a level that you feel you are unnecessarily doing work that could be automated.

Post reply on HN