Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you learn to develop exploits?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 87 posts

Re: Ask HN: How do you learn to develop exploits?

#41

Post by davyjones »

ChuckMcM wrote: post #38
saurik wrote: post #21

I would argue the magazines (such as 2600, which I absolutely loved when I was young) and books and oral tradition are all just ways of passing around specific and awesome anecdotes: it doesn't teach you how to do that, it is just interesting facts or entertainment for people who know. What you need, instead, is a mindset: when you are at the supermarket checking out with one of those self-checkout machines, does som…

I had an opportunity once to sit down with Don Knuth and play Halo on the X-box. Don was doing really poorly and I said, "Don, what are you doing?" His answer was "Playing." But for Don, playing wasn't kill the bad guys, get the best weapon upgrade, it was "What happens if I just sit here when this NPC wants me to follow him?", "Can I jump off this ledge in the back even though the game doesn't think I should?" He wa…

> There is a story about a physics student given a word problem of finding the height of a building using a barometer.

If memory serves me right, Bohr was the student and Rutherford was the arbitrator?

Edit: Legend according to snopes (http://www.snopes.com/college/exam/barometer.asp)

Re: Ask HN: How do you learn to develop exploits?

#42

Post by trotsky »

The way most folks learn to do high end niche programming: In advanced degree programs, research organizations and through professional development at government employers / contractors.

Charlie Miller is a well known example of this - he famously markets himself as a reliable exploit writer, his background came from doing the same work at the NSA.

In most cases it's a very technically challenging effort, beyond what most people will self teach. Simply finding the bug is often the easy part as compared to reliable exploitation.

The best publicly accessible sources of learning are security conference papers and university theses, though they don't usually explain the basic techniques or high level techniques. "Underground" sources like 2600 for the most part publish rather poor or incomplete material, though they occasionally do have some top notch stuff.

I assume this is related to the old Andy Greenberg article that's on HN right now. While I wouldn't say those prices are an outright fabrication, it is definitely misleading. It is very rare for those kind of prices to get paid, at least reliably. It's much more common for prices to be in the four or low five figures ranges when sold and often go completely unsold. It has a lot to do with who the buyer is and what their budgets are like and how well known you are and on and on - not totally unlike a traditional governmental procurement process.

What that article really was was an advertisement for that broker - the price list was there because he's trying to say hey you're getting screwed come to me! I would guess that the reality of working with him is significantly more middle class.

Re: Ask HN: How do you learn to develop exploits?

#43

Post by philfreo »

The easiest way to learn how to exploit is to learn how to prevent exploits in your own code. There are usually lots of tutorials/articles from that point of view. Some easy examples: once you've learned what SQL injection or XSS is and how to prevent it, it becomes easy (almost a habit) to look to see if other apps have done the same.

Re: Ask HN: How do you learn to develop exploits?

#45

Post by tshadwell »

Learn the oddities and the specifics in the parsing of a language, keep in memory problems with a very easy, and vulnerable solution and keep your eyes peeled. If you're awake, sometimes you think "This looks vulnerable..." and investigate. If you're lucky, something will go wrong in the site and you press on.

Re: Ask HN: How do you learn to develop exploits?

#46

Post by DanBC »

manish_gill wrote: post #34
crankyadmin wrote: post #6

Read as much as you can about assembly. Debuggers are your best friend. Pick a target (app, iPhone, xbox, whatever). Attach debugger and step through the code and learn possible entry vectors (buffer overflow, loading for arbitrary file i.e. pdfs, so forth). Once you have an entry vector you essentially have an exploit, the rest is developing that exploit to do something "useful". Sorry for the shortness of this resp…

That would be really nice. I actually started learning programming so I could become a better "h4x0r" (I was a kid). But then I discovered I liked making things a lot more. I'd be really fun to go back and learn the things that inspired me to play with a computer in the first place.

For some (old, out of date) information you could have a look at Fravia's information.

(http://www.woodmann.com/fravia/)

This is ancient; and Fravia is dead, so updates are unlikely. Fravia was also Italian and the writing is, uh, sometimes hard to follow. But I include it because it gives insight to the frame of mind that is needed, and is comprehensive about the tools that used to be used.

(http://en.wikipedia.org/wiki/Fravia)

Someone putting together some blog posts for HN would be very much appreciated.

Re: Ask HN: How do you learn to develop exploits?

#47

Post by joe_the_user »

saurik wrote: post #21

I would argue the magazines (such as 2600, which I absolutely loved when I was young) and books and oral tradition are all just ways of passing around specific and awesome anecdotes: it doesn't teach you how to do that, it is just interesting facts or entertainment for people who know. What you need, instead, is a mindset: when you are at the supermarket checking out with one of those self-checkout machines, does som…

I think finding holes can be a matter of developing dry, ironic sense of humor.

A hole is more or less a bug that can pushed a bit further. It has a lot of similarities to a joke. You thought your code "meant" X but really it "means" Y. SQL injection is a way of "saying" something that your "audience" wasn't quite expecting. It's a lot the jokes that start "he put the frozen turkey in the back of his truck and drove off ... and then ... and then" with lots of unexpected results.

My totally non-expert opinion is that if you practice finding this stuff amusing, you'll see more and more of it.

Re: Ask HN: How do you learn to develop exploits?

#48

Post by arihant »

Get very good with the instruction set. Get very good at gdb. Then learn about memory management and networking protocols. Look up networking libraries in C.

To start, I'd say have a good C manual (K&R), have a good book for computer systems (Computer Systems by Randy Bryant, but there are other good ones) and a good documentation on gdb. gdb is where it begins.

Re: Ask HN: How do you learn to develop exploits?

#49

Post by dguido »

I would say the master->apprentice relationship is quite common.

I'm surprised that no one mentioned my class yet, where I have some of the best people in the world talk about exactly how to learn this stuff.

http://pentest.cryptocity.net

http://pentest.cryptocity.net/careers

Re: Ask HN: How do you learn to develop exploits?

#50

Post by xtracto »

DanBC wrote: post #46
manish_gill wrote: post #34

Earlier quoted context omitted.

That would be really nice. I actually started learning programming so I could become a better "h4x0r" (I was a kid). But then I discovered I liked making things a lot more. I'd be really fun to go back and learn the things that inspired me to play with a computer in the first place.

For some (old, out of date) information you could have a look at Fravia's information. ( http://www.woodmann.com/fravia/ ) This is ancient; and Fravia is dead, so updates are unlikely. Fravia was also Italian and the writing is, uh, sometimes hard to follow. But I include it because it gives insight to the frame of mind that is needed, and is comprehensive about the tools that used to be used. ( http://en.wikipedia.o…

Aahhh... Fravia and the "crackstore" were great places to get tuts about hacking/cracking in their time (e.g. tKC tuts where good to follow as a kid).

I still miss those days of SoftIce :). Good memories.

Post reply on HN