I've read the 'Shellcoder's Handbook' as well as 'The Art of Exploitation', and appreciated both a lot. Now I'm looking for additional resources delving into vulnerability spotting, code auditing, and maybe fuzzing. Any recommendation for a book or must-read online resources of great interest?
for fuzzing take a look at:
- Fuzzing: Brute Force Vulnerability Discovery (ISBN 0321446119)
- Fuzzing for Software Security Testing and Quality Assurance (ISBN 1596932147)
for code review:
- Peer Reviews in Software: A Practical Guide (ISBN 0201734850)
For static code analysis I can recommend this:
- Secure Programming with Static Analysis (Brian Chess/ Jacob West)
The web application hackers handbook is good book in web applications security and it is exploits .
A Bug Hunter's Diary: A Guided Tour Through the Wilds of Software Security this is also very good I didn't complete it though.
Also OWASP/WASC guides are too good for Vulnerability Detection and Testing .
and Google is your best friend always.