Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you learn to develop exploits?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 87 posts

Re: Ask HN: How do you learn to develop exploits?

#61

Post by lawnchair_larry »

trotsky wrote: post #42

The way most folks learn to do high end niche programming: In advanced degree programs, research organizations and through professional development at government employers / contractors. Charlie Miller is a well known example of this - he famously markets himself as a reliable exploit writer, his background came from doing the same work at the NSA. In most cases it's a very technically challenging effort, beyond what…

The way most folks learn to do high end niche programming: In advanced degree programs, research organizations and through professional development at government employers / contractors.

Charlie Miller is a well known example of this - he famously markets himself as a reliable exploit writer, his background came from doing the same work at the NSA.

Nope, Charlie is definitely not the typical story. Most of these guys don't even have college degrees.

Re: Ask HN: How do you learn to develop exploits?

#62

Post by lawnchair_larry »

tptacek wrote: post #37
ihodes wrote: post #8

tptacek (of Matasano) has a list of books on Amazon he has suggested for learning just that: http://www.amazon.com/lm/R2EN4JTQOCHNBA

On that list, TAOSSA is probably the book you want if you're looking to sell exploits to The Gruhhghhgq.

That will help you find C bugs in open source software. Won't do a thing to advance your exploit-writing skills though.

Re: Ask HN: How do you learn to develop exploits?

#63

Post by rboyd »

DanBC wrote: post #46
manish_gill wrote: post #34

Earlier quoted context omitted.

That would be really nice. I actually started learning programming so I could become a better "h4x0r" (I was a kid). But then I discovered I liked making things a lot more. I'd be really fun to go back and learn the things that inspired me to play with a computer in the first place.

For some (old, out of date) information you could have a look at Fravia's information. ( http://www.woodmann.com/fravia/ ) This is ancient; and Fravia is dead, so updates are unlikely. Fravia was also Italian and the writing is, uh, sometimes hard to follow. But I include it because it gives insight to the frame of mind that is needed, and is comprehensive about the tools that used to be used. ( http://en.wikipedia.o…

I too grew up reading Fravia and absolutely loved his tutorials. One nostalgic evening several months ago I went googling for his tutorials and was saddened to see he had passed.

I've been very curious ever since to know what he wrote in his last post, but unfortunately I can't read Italian and the online translation service I've tried seem to fail horribly. Are there any Italian speakers able to translate this for the rest of us?

http://beri.it/2009/08/28/fravia/

Re: Ask HN: How do you learn to develop exploits?

#64

Post by tptacek »

maayank wrote: post #60
tptacek wrote: post #37

Earlier quoted context omitted.

On that list, TAOSSA is probably the book you want if you're looking to sell exploits to The Gruhhghhgq.

I see the book is from late 2006. An honest question for better understanding the security research field: how and how come is it still relevant? Things like algorithms (a la TAOCP) I can understand, as if you prove for example a lower bound for a class of algos it will stay like that forever, but in security research I would imagine the people involved protecting themselves from what is now 6 years old bad practices…

Two reasons.

First, because TAOSSA is an extremely good book.

Second, because TAOSSA deals with the fundamentals of vulnerabilities (with an intense focus on memory corruption issues).

The mainstream exploitation of memory corruption has evolved rapidly over the last 5 years or so, but the vulnerabilities themselves haven't changed. Use-after-free- style object lifecycle bugs are as old as Phrack.

Re: Ask HN: How do you learn to develop exploits?

#65

Post by tptacek »

lawnchair_larry wrote: post #62
tptacek wrote: post #37

Earlier quoted context omitted.

On that list, TAOSSA is probably the book you want if you're looking to sell exploits to The Gruhhghhgq.

That will help you find C bugs in open source software. Won't do a thing to advance your exploit-writing skills though.

I didn't bring up the list, nor did I make that list for exploit developers. Someone else posted the list, and I said that of the books on it, only TAOSSA would be particularly relevant.

It's amusing that you think finding memory corruption bugs (or, "C bugs in open source software") is irrelevant to exploit development, but, O.K.

Re: Ask HN: How do you learn to develop exploits?

#67

Post by trotsky »

lawnchair_larry wrote: post #61
trotsky wrote: post #42

The way most folks learn to do high end niche programming: In advanced degree programs, research organizations and through professional development at government employers / contractors. Charlie Miller is a well known example of this - he famously markets himself as a reliable exploit writer, his background came from doing the same work at the NSA. In most cases it's a very technically challenging effort, beyond what…

The way most folks learn to do high end niche programming: In advanced degree programs, research organizations and through professional development at government employers / contractors. Charlie Miller is a well known example of this - he famously markets himself as a reliable exploit writer, his background came from doing the same work at the NSA. Nope, Charlie is definitely not the typical story. Most of these guys…

Do you work in the industry? It's changed significantly in the last five or ten years. There are dozens or even hundreds of small shops in the dc area doing this kind of work and self taught no degree folks are a small minority.

Maybe it's the silent majority. After all, most developers aren't the node and nosql pioneers that get all the press, most are working in some office park doing .net and plsql.

Re: Ask HN: How do you learn to develop exploits?

#68

Post by jonnyscholes »

xtracto wrote: post #50
DanBC wrote: post #46

Earlier quoted context omitted.

For some (old, out of date) information you could have a look at Fravia's information. ( http://www.woodmann.com/fravia/ ) This is ancient; and Fravia is dead, so updates are unlikely. Fravia was also Italian and the writing is, uh, sometimes hard to follow. But I include it because it gives insight to the frame of mind that is needed, and is comprehensive about the tools that used to be used. ( http://en.wikipedia.o…

Aahhh... Fravia and the "crackstore" were great places to get tuts about hacking/cracking in their time (e.g. tKC tuts where good to follow as a kid). I still miss those days of SoftIce :). Good memories.

Anyone else frequent http://freaky.staticusers.net/ back in the day? I always found their forums full of goodies [esp if you were interested in hacking from or into osx / os9] - pity it seems to have been taken down! [google still has some of it though].

Re: Ask HN: How do you learn to develop exploits?

#69

Post by orthecreedence »

wasd wrote: post #16
crankyadmin wrote: post #6

Read as much as you can about assembly. Debuggers are your best friend. Pick a target (app, iPhone, xbox, whatever). Attach debugger and step through the code and learn possible entry vectors (buffer overflow, loading for arbitrary file i.e. pdfs, so forth). Once you have an entry vector you essentially have an exploit, the rest is developing that exploit to do something "useful". Sorry for the shortness of this resp…

+1

"I will write blog posts if people support this notion."

"I support you writing blog posts on this matter."

Downvotes ensue.... Seriously?

Post reply on HN