3

Hello I'm a beginner into IT security. I want to become ethical hacker. So I know how to use metasploit to write exploits, and how to use different fuzzers, but I think this isn't enough. I can read and understand code from a lot of languages including basic assembly - I can convert simple assembly code to C code or Java to C or C# to C and a few other language to C. But I'm not the best programmer - I'm fairly familiar with data structures but algorithms are my weak point. I can't code good programs for example. If I start editing kernel I will die but I won't do anything new or good. I know that the question is without specific answer, but I have no idea where I can ask professionals. What programming skills do I need before jumping into vulnerability research?

3

Well vulnerability research implies that you have a really good knowledge of how thing work. For starters I think that knowing assembly and C is the best way to start. A really good assembly knowledge will help you with reverse engineering and finding vulnerabilities.

Personally I'm learning really hard assembly language and C. You'll also need practice (a lot of practice) in a lab environment. Personally I think this 3 books will get you really stared:

1) Shellcoders HandBook

2) Hacking The Art of Exploitation 2nd Edition

3) Gray hat hacking

2

Boogy's answer is correct and definitely right on. More than that you need to learn the structure of programming languages and systems in general. Why programmers use certain data structures. Learn those data structures and how they work. Good engineering principles apply no matter the system, so do bad ones.

The first questions in your mind when you are seeing something should be, how does this work? How can I abuse this? Abuse meaning how can you stimulate this object to do things that the original author didn't intend to happen.

What cannot be understated, is to make sure you learn "how you learn," it will help you when you are dissecting something new. The more you learn, especially about how things are engineered ... will assist your initial understanding when confronting something new. You will learn about it faster, it is a compounding knowledge.

Similar in principle to studying algorithmic complexity, once you understand the notations and their relationships, even confronted with a novel structure or a new implementation of a known structure, there are a lot of assumptions that can be made and proven based on previous work. All because of prior research and presumptions

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.