2

I suppose that a lot of users hate this type of 'noob' questions, but I really eager to become a Cyber Security specialist and I need a little advice.

As for now I'm learning Networking/Routing & Switching basics, ANSI C and ruby languages. Also I'm an experienced Linux user, so I have basic shell scripting skills and general understanding of Linux architecture.

But after all, I still feel myself as nobody when it comes to some hacking/exploits stuff. Does somebody know a book that would give me a solid understanding of types of exploit without overwhelming me with a practical matters (I'll study them later separately)?

P. S. There are a lot of books of such kind all over the Internet, but I would rather read the one experienced people would recommend.

closed as off-topic by Deer Hunter, user45139, schroeder Oct 30 '15 at 14:51

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • "without overwhelming me with a practical matters" is a constraint that is hard to meet. We can't know where you are at in your level of understanding. We also don't know what kinds of "hacking/exploits stuff" you are looking for: network, device, application, web, physical, etc. – schroeder Oct 29 '15 at 22:29
  • 1
    We do not mind "noob" questions at all. The questions need to be answerable, though. – schroeder Oct 29 '15 at 22:29
  • Well, I'm interested mostly in Internet exploits such as SQL Injections etc. I tried to read this book amazon.com/Hacking-The-Art-Exploitation-Edition/dp/1593271441, but then I felt overwhelmed with assembler details, while I wanted to get a general understanding of possible ways of hacking, not an Intel CPU registers guide. Any thoughts? – ddnomad Oct 29 '15 at 22:35
  • Then you need a book on web application exploits. Frankly, books might not be the best way for you because they go into the level of depth you do not want. What you seem to need is tutorials. Millions of those on the web. – schroeder Oct 29 '15 at 22:50
  • Actually, I would be ok with that kind of details that are necessary for understanding of the topic. So you can't come up with an example or two of such books? – ddnomad Oct 29 '15 at 22:54
2

As I understood from your comments, you want to learn web application security. I would recommend reading web application hackers handbook. This book explains many web application vulnerabilities with simple language yet it goes into detail with each one of them. Also it has really useful "hack steps" which explains how to conduct an attack in detail with real world examples. For a side note, writers of this book is also the creators of Burp Intruder which is very famous attack proxy among the security researchers.

0

A good book for this sort of thing is actually one that doesn't mention "exploit" in it at all: Gödel, Escher, Bach: An Eternal Golden Braid by Douglas Hofstadter. The book is a rambling and entertaining treatise on artificial and real intelligence, mathematics, and formal systems. It relates to computer security and exploitation as it describes various formal systems, and how each is limited to its own consistency.

What do SQL injection, buffer overflows, XSS, etc. all have in common? They are results of a system of symbols (SQL, call stack, HTML) that cannot guarantee its own correctness. This is similar to the halting problem. You can't allow arbitrary inputs of the symbols of a system into that system and expect to guarantee anything about the outcome of that system. If you let user input to a SQL statement include single-quote characters (which have special significance), then the outcome of executing the user input can be catastrophically different than the programmer intended.

You asked for theory, and this is about as theoretical and foundational as it gets. Thanks for reminding me to reread GEB:EGB, because it's one of those things you just don't completely absorb the first time through.


EDIT: A couple more foundational documents that really help to understand the scope and history of this branch of information science:

  • I don't see where the OP asked for theory. "Types of exploit" would appear to be an overview of the specifics without the technical detail. – schroeder Oct 30 '15 at 18:13
  • @schroeder Tagged theory and asks for an answer "without overwhelming me with a practical matters." – bonsaiviking Oct 31 '15 at 12:47

Not the answer you're looking for? Browse other questions tagged or ask your own question.