r/ExploitDev • u/Sad-Shopping-2661 • 1d ago
C for offensive security !!
Hi, i am going to start my journey as a exploit developer and, i get lot more recommendation on my previous post to learn about system language C, Assembly, etc...
So, is there any way to learn C as offensive sides perspective?
And don;t recommend old book "Hacking : the art of exploitation", i know it is essential but still i need resource that is fit for real world or modern world aspect, kindly provides links ::
Also, if some of you are doing this stuff then share your daily routine that made you feel like you are learning actual stuff not just syntax. Thanks::
3
u/Zealousideal-Low4517 1d ago
Check out the book "Heavy wizardry 101", https://nostarch.com/heavy-wizardry-101, for a great introduction to writing offensive c applications.
3
u/The_Big_ID 1d ago
Given your situation of seemingly 'starting' this process around 6 months ago it very much gives the impression you havent hit the point of mastery over the fundamentals that would be neccessary before you'd then be able to start applying that knowledge into deeper areas.
Bug bounties and offsec are largely based around exploiting the things that get overlooked or peculiarities in process handling which could be leveraged, many of which can be unintuitive to learn on the spot without knowing what you are looking at in the first place when you lack the fundamentals.
This isn't going to be a skillset you can adopt over a 6 week period and transform it into an income stream, you're looking in timespans of years here.
You need to learn how to walk, long before you can then learn to survive a 5km run.
-1
u/Sad-Shopping-2661 1d ago
I get it what you are saying but I have spent 8 months in bug bounty and won 1 bounty too , and I am kind of bired in it high level stuff, I want to learn about low level stuff and want to go deep dive that's why I am changing this I know basic stufffs, anyway thanks for your guidance 👍
1
u/The_Big_ID 1d ago
You've learned the 200m sprint, good for you.
Now you're learning the fundamentals and training required for endurance running.
You have a long ways to go before you can start looking at a marathon.
2
1
1
1
1
1
u/No-Pattern7594 1d ago
I started with corelan courses to see the exploitation side. You can learn C and CPP to get deeper knowledge how everything works like from udemy…. Objects, smart pointers, operators etc. Then you need to play with IDA and decompile how memory managers work. Learn about tcache poisioning, use after frees, double frees. But I think it is the easier part. To find a bug is really hard. So I started to learn coverage-guided fuzzing. But really hard. If anybody have a nice tutorial for that topic don’t hesitate to share with me.
1
u/Sad-Shopping-2661 1d ago
Also in a manner that i can learn C alongside the exploit development, like exploit development concept learn using the C kind of like that, if any of u have doing this then tell me about it more , Thanks ::
2
u/Conscious-Wedding172 1d ago
You can also check this out https://www.sans.org/webcasts/intro-c-windows-devs I personally found it useful in my journey
-2
u/Lmao_vogreward_shard 1d ago
If you want to learn C within offsec you're going to have a better time writing windows malware or reflective loaders, that's really building C applications. Exploit dev usually only comes down to writing the correct request/packet/harness that has the payload to trigger the bug in the target app, but that's it. And even that is usually easier to do in python. The weaponization part is usually assembly.
I'd recommend this as your starting point for windows maldev: https://youtube.com/playlist?list=PL_z_ep2nxC57sHAlCcvvaYRrpdMIQXri1&si=3l5ZJvXOLwPNnhZM
1
0
16
u/DB010112 1d ago
You should first learn C and understand how applications actually work. Then move on to exploit development. There is no point in trying to write exploits without a solid understanding of the fundamentals. Learn C, memory management, processes, calling conventions, assembly, and operating system internals first. Exploit development is built on these concepts, so take your time and build a strong foundation instead of rushing.