2

I'm learning Networking/Routing & Switching basics, ANSI C and ruby languages. Also I'm an experienced Linux user, so I have basic shell scripting skills and general understanding of Linux architecture.

But I still feel like a nobody when it comes to some hacking/exploits stuff. Does somebody know a book that would give me a solid understanding of types of exploit without overwhelming me with practical matters (I'll study them later separately)?

P. S. There are a lot of books of such kind all over the Internet, but I would rather read the one experienced people would recommend.

Improve this question
4
  • "without overwhelming me with a practical matters" is a constraint that is hard to meet. We can't know where you are at in your level of understanding. We also don't know what kinds of "hacking/exploits stuff" you are looking for: network, device, application, web, physical, etc.
    – schroeder ♦
    Commented Oct 29, 2015 at 22:29
  • Well, I'm interested mostly in Internet exploits such as SQL Injections etc. I tried to read this book amazon.com/Hacking-The-Art-Exploitation-Edition/dp/1593271441, but then I felt overwhelmed with assembler details, while I wanted to get a general understanding of possible ways of hacking, not an Intel CPU registers guide. Any thoughts?
    – ddnomad
    Commented Oct 29, 2015 at 22:35
  • Then you need a book on web application exploits. Frankly, books might not be the best way for you because they go into the level of depth you do not want. What you seem to need is tutorials. Millions of those on the web.
    – schroeder ♦
    Commented Oct 29, 2015 at 22:50
  • Actually, I would be ok with that kind of details that are necessary for understanding of the topic. So you can't come up with an example or two of such books?
    – ddnomad
    Commented Oct 29, 2015 at 22:54

2 Answers 2

Reset to default
2

As I understood from your comments, you want to learn web application security. I would recommend reading web application hackers handbook. This book explains many web application vulnerabilities with simple language yet it goes into detail with each one of them. Also it has really useful "hack steps" which explains how to conduct an attack in detail with real world examples.

Improve this answer
0
0

A good book for this sort of thing is actually one that doesn't mention "exploit" in it at all: Gödel, Escher, Bach: An Eternal Golden Braid by Douglas Hofstadter. The book is a rambling and entertaining treatise on artificial and real intelligence, mathematics, and formal systems. It relates to computer security and exploitation as it describes various formal systems, and how each is limited to its own consistency.

What do SQL injection, buffer overflows, XSS, etc. all have in common? They are results of a system of symbols (SQL, call stack, HTML) that cannot guarantee its own correctness. This is similar to the halting problem. You can't allow arbitrary inputs of the symbols of a system into that system and expect to guarantee anything about the outcome of that system. If you let user input to a SQL statement include single-quote characters (which have special significance), then the outcome of executing the user input can be catastrophically different than the programmer intended.

You asked for theory, and this is about as theoretical and foundational as it gets. Thanks for reminding me to reread GEB:EGB, because it's one of those things you just don't completely absorb the first time through.

EDIT: A couple more foundational documents that really help to understand the scope and history of this branch of information science:

Improve this answer
2
  • I don't see where the OP asked for theory. "Types of exploit" would appear to be an overview of the specifics without the technical detail.
    – schroeder ♦
    Commented Oct 30, 2015 at 18:13
  • @schroeder Tagged theory and asks for an answer "without overwhelming me with a practical matters."
    – bonsaiviking
    Commented Oct 31, 2015 at 12:47

Not the answer you're looking for? Browse other questions tagged .