Hello I have recently started learning Reverse Engineering. I often hear that it's much easier to find vulnerabilities in a program by looking at it's source code, but i don't know how to find them or what type of loopholes i can find by looking at source code. So Can someone give some examples, study resources or Ebooks which can help me...

  • 2
    Source code review is a fairly broad topic, and not all vulnerability classes may apply to all languages. For example, in C, you could find memory corruption vulnerabilities, but in PHP you may find web Injection vulnerabilities. In all languages though, you can find bugs in logic. You just need to be able to understand the inner workings of the code to be able to ask questions like "what if an attacker enters XYZ here?". – multithr3at3d Jun 23 '20 at 14:25

and welcome to Security.SE. This question doesn't really fit the StackExchange format, and will likely be closed. Questions like this typically end up just being a list of books, which could potentially get out of date very rapidly.

To answer your question, I would recommend a couple of things:

  1. Pick an area that you would like to study (i.e. web vulnerabilites vs. C source code).
  2. Find applications which fit your choice which are open source and have had security vulnerabilities which have been discovered in the past. There are also plenty of purpose made vulnerable applications such as Owasp's WebGoat you could look at.
  3. Download an old version of the source code which still contains the vulnerability, and read through the code to see if you can understand how the vulnerability presents itself.

As far as books go, there are plenty available, but as @multithr3at3d mentioned, it's kind of a broad topic.

You can also try running some static analysis tools against some open source projects, and review the results to find other potential vulnerabilities.


See https://www.youtube.com/watch?v=ibF36Yyeehw (start watching at around 30:00) to see how Moxie Marlinspike does it. In this example, he shows how he found a serious bug in the SSL implementation used by Mozilla. By exploiting the bug, he was able to launch a deadly attack that allowed him create a certificate on the fly that could be used to MITM any site, with the certificate being trusted by the browser.

Not the answer you're looking for? Browse other questions tagged or ask your own question.