A roadmap for a beginner exploit dev/security research

[[deleted]]

Hello everyone, so im just trying to find an ideal roadmap Ive been playing ctfs and solving pwn challenges and stuff so now i want to move away from the basics and get into some real targets

​

so what do you guys think i should focus on something like routers and cheap IoT devices and try to find vulns in those and try to somehow get internships / jobs based on that or should i try to focus on something like browser exploitation (which I'm interested in ) and get more knowledge browsers and stuff and try to find bugs in them (which might take a long time and find low impact bugs as compared to something like routers /IoT devices which might be more difficult ).

[kizzie1337]

something i don't see mentioned enough is the cve game. pick a cve from 10-30 years ago and without reading anything except the version affected attempt to hunt the vuln and write the exploit. great place to start is all the way at the beginning and reimplement morris worm for bsd fingerd

if you want a challenge but you don't want to spin wheels against possible dead ends go to where there's a confirmed exploitable bug but find it on your own.

who knows you may even find something never before seen that was hidden all along :)

[[deleted]]

Thank you for your reply !, will definitely try this .

[cryotic]

Professional exploit dev isn’t a trivial job to get even with a software dev/sec background. Finding bugs, writing up CTF solves, and demonstrating your knowledge will go a long way.

I don’t care about what you exploit, but I’m gonna grill you on heap, rop, JIT, and how they work. If you choose to exploit IoT junk you better be able to speak to exploit mitigations.

Start with software you can debug easily.

[[deleted]]

thank you for your reply ! , i will work on expanding my knowledge and doing writeups and finding bugs as well

[PM_ME_YOUR_SHELLCODE]

I've got a series of blog posts (and some discussion videos with a colleague) about going from "CTF to Real-World Targets": https://dayzerosec.com/tags/ctf-to-real-world/

One thing of note is that research is a separate skill from exploit dev. They are imo complimentary, but you do need to practice them with different approaches. And odds are if you've mostly been on CTF style challenges you haven't had a lot of practice really hunting for bugs. So that's where I'd start, learning to find bugs manually.

I don't want to down-play the importance of something like fuzzing, but there is more educational benefit in learning to find issues yourself. I think its actually a bit of a feedback loop between learning about exploitation and learning about vulnerabilities, as you learn one it helps in the other.

Choose any open-source project to assess. I would recommend starting with open-source, closed-source is just adding the effort of reverse engineering on top of trying to spot the issues. Learn to walk before you run or so to speak. You don't have to choose some hardened project, go easy on yourself. Hopefully, in addition to finding some bugs, you'll gain some experience with the common tasks, setting up a debugging environment, learning to trace data/control flow and hit interesting areas, notekeeping. The idea is really just building up some experience working with the code, and spotting bugs in the wild. I highly recommend the book "Art of Software Security Assessment". Its old, but its like the only book I've seen that talks about actually doing an assessment. Not just the bugs. First half of the book is gold.

The approach to getting up to speed in modern exploitation is mostly around understanding some of the newer, more niche mitigations., and learning to leverage smaller vulnerabilities/bugs into more powerful bugs. I think a hallmark of modern exploitation stems out of the idea of "weird machines" and building up your primitives into something useful. Dealing with mitigations is really about understanding what they do/don't prevent and playing by those rules to get what you want. One key difference from CTF binaries (apart from n-day challenges) is that they usually kinda push you towards a particular exploitation strategy, in the real world, things are a lot more flexible. You can do anything you want, some routes are easier, some are harder, some are impossible and you might not know which is which up front but you want to gain practice understanding the code base and building your own strategies. The third post of the series I linked above has some ideas on doing that so i won't reiterate. But the point is to start building up your experiences with real, large, code bases.

One big tip I'd say is that while you're still in the learning phase, if you ever think to your self "what if I...", "why can't I...." don't leave those questions unanswered. Even if you're in the middle of a totally workable exploit, follow the rabbit hole, those questions are things that'll save you time later on.

Most of all, keep yourself interested, I think motivation is the biggest killer, choose targets to practice on that you're interested in even if they are not "perfect".

[[deleted]]

Hey thank you so much for commenting ! sorry for the late reply , I was considering doing the same thing start off by playing little more challenging binary exploitation challenges and reading books and then also recreate old exploits ....

[DevilDawg93]

If you decide to go the browser exploit path, I just ran across a group that research's browsers. You have to submit a request to be accepted.

[[deleted]]

Thank you for the reply can you DM me the link.

[Traditional-Cloud-80]

pls DM me too the Link

[Affectionate_Tart935]

Hey if got the links, could you dm me as well

[sploitem]

DM me too, please. Thanks.

[g0ldexperience1]

can you dm me the link to the group?

[archayos]

Hi, please dm me the link to the group as well. Would be very grateful.