Is it a rigorous trail and error exercise or do they actually read the whole code to "think" about it to find the vulnerable point?

closed as too broad by Steffen Ullrich, Mark Buffalo, rook, Xander, Neil Smithline Nov 28 '15 at 20:53

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • What do you mean by "How do hacker find vulnerability?" New ones or existing ones? Do you have any specific areas in mind? Web apps, networks, systems? – sir_k Nov 28 '15 at 19:59
  • Depends upon what kind of vulnerability is searched. For example finding vulnerabilities in an encryption-algorithm is rather a task for a mathematician, than simply reading the code. Some other vulnerabilities can easily be found by reading docs, like for e.g. attack-vectors that allow (nearly) invisible scans (SYN-scanning to name an example). This question is simply too broad to be answered – Paul Nov 28 '15 at 20:09
  • It's advised to use tags wise as I do not think virus tag is suited to this post. – Shritam Bhowmick Nov 29 '15 at 12:21

The latter (whole code to "think" about it to find the vulnerable point?) if it's white-box testing where you require expertise to go through the code and pick out vulnerabilities or even security weaknesses which could be escalated to a compromise.

If it's black-box and an attacker has to guess the source which is behind firewalls, the web application, etc.. he has to go through trial and error but obviously in the right directions (which means he should have knowledge on which part could lead to weaknesses and where he should start, e.g. entry points, parameters {if in web applications}).

Now, this doesn't mean what's the vulnerability. You have a threat agent which is obviously an attacker in this case (which you term it as a hacker), now since there is a threat agent, there has to be a weakness to exploit and hence there must be existence of a vulnerability to be able to exploit or compromise a system or a part of the system. It doesn't matter what route you take (for e.g. wireless to sniff the passwords and then compromise, or hijack session and then compromise or exploit SQL Injection to compromise databases and then extract passwords, or a buffer overflow), what it only matters to any time independent attacker is the fact that a vulnerability should exploit a system.

If it's a hacker in bad terms - he'd compromise for financial or reputation gains, if not he's merely just acting as a hacker and having his day job as a security practitioner.

Note: hacking just because you're curious is again sound-fully illegal these days according to laws of state.

  • I don't really understand how your answer addresses the OP. – Neil Smithline Nov 28 '15 at 20:51
  • OP's answer relied on two points: 1. Is it a rigorous trail and error exercise 2. or do they actually read the whole code to "think" about it to find the vulnerable point? Based on that, there are only two circumstances - whitehat segment practices and black-box segment practices. – Shritam Bhowmick Nov 28 '15 at 21:01

Not the answer you're looking for? Browse other questions tagged or ask your own question.