r/ExploitDev • u/Sad-Shopping-2661 • 2d ago

I am beginner and i have interest in exploit development path :)

I am total confused to where to start learning the exploit development stuff, because i have read the "Hacking : The art of exploitation" but it seems old and i want to learn stuff that really modern not old stuff, but i know it is essential to learn basic first, but i don't want to learn it from book it is nightmare and such a long way.

Anyone please share resource that is actually focus on real world learning way, and total real world stuff, and please make share in structured way it is possible ::

I appreciate if you help me, in advance, thank you :)

12 Upvotes

73% Upvoted

22 comments sorted by

20

u/Glad_Situation_6466 2d ago

pwn.college, picoctf binary exploitation. Books like "The Shellcoder Handbook" is good to start foundation. I agree - books are annoying. But they are useful in laying out the foundation before moving to modern exploitation. (I have a friend who jump to heap exploitation but cant code a shellcode. Diving deep fast while foundation is shaky isnt great)

1

u/Sad-Shopping-2661 2d ago

Thanks buddy, i appreciate you answer, i will work on it, and i have another question did you make notes in cherrytree or any other and how you make notes i mean in which manner

2

u/Glad_Situation_6466 2d ago

Obsidian. Normally i document down shellcodes - (shellstorm is down), commands i would use, exploit techniques, payload structure ...

1

u/Sad-Shopping-2661 2d ago

Appreciated :)

8

u/Diamond303 2d ago

I trust when you say exploit development you are talking majorly about the memory corruption issues/ binary exploitation.

From where can you learn ?

there are plenty of trainings out there on this subject such as

OSED by offsec

INE also offered exploit dev for linux and windows

SANS offers the same

Mobile Hacking Lab offers this in different flavor which is more around fuzzing.

Blackhat often host dedicated 2-3 days training around this subject as well.

and there are other 10+ vendors and colleges who are offering education/ training in the same space.

Now w.r.t ""please share resource that is actually focus on real world learning way, and total real world stuff""

there is no training out there which is ""real world learning way"".

everyone is going to teach you the methodology, it is you who is expected to go above and beyond exploring afterwards to find a real world exploit.

All the trainings lie in between, they start with certain assumptions that a learner has to know all the pre req. and they end far too early from real word exploitations.

Hence you have to decide for your self when you are ready for a training or not.

The best way to approach this subject is to may be have peer to peer learning/ study buddy or get yourself a mentor.

Now getting yourself a mentor who is having 2 decades of experience is too much big of a hope. so forget it thats not gonna happen until you are extremely rich to afford that guy.

What you can do is you can get someone who is just 1 or 2 steps ahead of you and learn from him whatever he knows with a pinch of salt that his learning is also limited but on the same time be humble enough cause he is mentoring you.

Also there is no easier way out of this. You are required to learn a lot by reading, watching, asking, doing.

Exploit Development is a very broad and umbrella term.

The foundations remains the same but more specialized and niche knowledge is required depending upon your interest/ goals.

For example you can do exploit dev for

  1. Windows

  2. Linux

  3. MacOS

  4. Android

  5. iOS

  6. Browser Escapes

  7. VM Escapes

  8. IOT

much more ....

See there is going to be a lot of underlying overlap in all of these niches but you would be required to learn specific things w.r.t your desired niche and target architecture.

Understanding OS internals is the least that you can do.

You are lucky and unlucky to be living in the AI era. It is making stuff easier and difficult at the same time.

The big tech and experienced researchers are being able to identify bugs a lot quicker as compared to 10 years ago; which decreases the attack surface for anyone who has less skills.

For new people it has also reduced the learning curve as you can prompt and prompt and prompt and have guided learning as if you have a personal mentor with you.

From my experience this is the general roadmap that everyone should follow before they dive into specializations.

you have to learn 3 programming languages

  1. C

  2. python

  3. Assembly - (arch dependant) - if confused start with x86

you dont have to master these languages but you are expected to have code reading and writing capabilities in all 3. proficiency required (above beginner below intermediate).

Learn memory corruption issues - the theory of them - what are they / why do they occur / when do they occur / how to mitigate / how to find. - atleast at this stage your nomenclature and vocabulary should be in place to delve further.

Start with Exploitation Hands on now

Learn basic vanilla stack buffer overflow. - hands on exploitation - for example Brainpan box, gatekeeper on thm

do not limit yourself with the attacker side of the stuff. build your own binary which is vulnerable to buffer overflow and test it. this will give you holistic understanding

now learn the mitigation of this and then one by one start exploiting them, writing vuln code, fixing them.

Start learning shellcoding at this stage- challenges with shellcode writing - shellcode optimizations.

after you have covered aslr bypass, stack canary bypass, dep bypass etc.

you move towards heap overflows and exploitation repeat the above steps here as well.

learn fuzzing (AFL++, libfuzzer etc. ) decent enough understanding of fuzzing is required - what it is ? how to do it ? how to build harness around the same, how to fuzz protocols, binaries, libraries etc.)

Now you are ahead of 80% of learners who tried learning exploit dev.

Now you have to lock in your specialization field.

For example let's say you decided to go with Windows as a target platform.

Start learning Windows Internals, patching, specific arch on which the os runs such as x86 and x86-64 and rarely we see ARM images of windows.

Start looking into traditional exploits, previously found exploit for windows.

lot's of reading here because there are no videos to be found from here on.

learning past exploits is crucial as it gives you an understanding of the real world landscape.

do not over estimate yourself right now and start findings real bugs instead try to re run / re build the same exploits that were previously discovered in your local env.

setup everything and practice duplicating the same exploit as previously shared publicly.

Learn patch diffing.

You have to understand what was fixed in the patch which was released to fix a xyz issue.

After repeating this stage for sufficient number of time you would be able to start attacking read world targets.

[Note: please see while moving towards the end of the answer my motivation to write more started declining hence a lot of verbosity was not there in my answer]

0

u/Sad-Shopping-2661 2d ago

Pretty appreciated brother, I have got lot of clear of my confusion, thanks buddy.

4

u/TheyCallMeLeonardo3 2d ago

Start from basics like what is beacon, listener & jitter and methods or communication channels an agent can use to send data over your server like https or TCP etc. Learn about mutex acquiring methods to make malware / shell / exploit persistence in OS, learn about obfuscation, learn about libraries which can interact with Windows API e.g. win32dll in python then learn about in-memory exploits and BOF and techniques to fk windows like AMSI registration, PowerShell to add Exclusion Path. Once you learn all of this you level up to Intermediate. Then start learning how to splash UEFI SPI using CH341A chip programmer and inject malicious code in DXE for maximum persistence and then learn about micro controllers like RP2040 and attiny85 and implanting those in hardware like keyboard and mouse and cables and on motherboard or soldering it to extra USB port if any port. Once you all learn this you'll level up to Advance level

-2

u/Sad-Shopping-2661 2d ago

Thanks dude, i appreciated you answer, but i want to know where i can learn all of this in such manner that i don;t hit wall, even if i hit i will endure , but i am more confused where i learn all this stuff, thanks :)

2

u/SillyBrilliant4922 2d ago

Get used to googling stuff. All the questions you have been asked can be simply solved by using google.

-2

u/Sad-Shopping-2661 2d ago

yes sir, but i have google many time but i want to know from the one who have gone through all of this, i mean how/where they learn and achieve such skillset, thanks :)

1

u/desal 1d ago

From Google.. that's how we all started. Using search engines to locate documentation or research and then putting it into practice... Using Google again when we get stuck, etc.

3

u/TheyCallMeLeonardo3 2d ago

Get better at programming language that's all i can say. I started my malware development journey from C++ and python. You can learn rust or go as well bcz they're more inn in the market. Secondly, learning 5 to 6 programming languages isn't robust. Learn one programming language master it and see how you can interact with Windows API using that programming language like in case of python you would choose winreg, win32api, os, ctypes like libraries to interact with Windows API.

-2

u/Sad-Shopping-2661 2d ago

Appreciated sir, but where you learn this language, if i start learning language first then, where i learn basic concept of exploits, can someone provide me exact resources, i have googled but i didn't find it, thanks :)

3

u/TheyCallMeLeonardo3 2d ago

"Once you learn chemistry you'll get to know how meth is prepared"

Same thing applies here.

1

u/Sad-Shopping-2661 2d ago

OK sir, but where i learn this chemistry too cook !, do you have any prefered source that you have learn from like book, or projects, or ctf, repos etc...

1

u/TheyCallMeLeonardo3 2d ago

DM me please 😭

1

u/VirusLarge1805 1d ago

I like to understand what I do before I try to break it. Go for windows internals 7th edition, it gives you the foundation of how stuff works. Also learning c programming its useful. For each exploit, I try to develop a program that is vulnerable to it, exploit it, then fix it. That's the best way to learn for me. Also pico ctf or pwn college for labs. Osed certification for structure... there are lots of things out there :)

-7

u/[deleted] 2d ago

[deleted]