Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 51 guests and 2 members online
 
Advertisement

You are here: Home arrow Resourcesarrow Tutorialsarrow introduce me exploitation books
EH-Net
May 22, 2013, 05:27:19 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1] 2   Go Down
  Print  
Author Topic: introduce me exploitation books  (Read 4647 times)
0 Members and 1 Guest are viewing this topic.
Cyber.spirit
Sr. Member
****
Offline Offline

Posts: 351


The World is sick, Save your mind...


View Profile
« on: February 02, 2013, 10:20:43 PM »

Hi there.
I am really busy in these days i can't use this forum like before but i'll be back soon.

Well, i am learning c programming at Harvard unversity cs50 course. After some weeks I've developed some ciphers and ...

Now i know the basics about c. So please let me know if there is any books out there about writing exploits only with c that i can study after this course?

Thank you so much
Logged

ICS Academy Network Security Certified
superkojiman
Jr. Member
**
Offline Offline

Posts: 60



View Profile WWW
« Reply #1 on: February 02, 2013, 11:09:29 PM »

If you're looking for a book, Hacking: The Art of Exploitation is an excellent one that covers exploitation of Linux programs in C. You'll also find numerous exploitation tutorials on Google.
Logged

OSCP, GSEC
Cyber.spirit
Sr. Member
****
Offline Offline

Posts: 351


The World is sick, Save your mind...


View Profile
« Reply #2 on: February 02, 2013, 11:15:16 PM »

If you're looking for a book, Hacking: The Art of Exploitation is an excellent one that covers exploitation of Linux programs in C. You'll also find numerous exploitation tutorials on Google.

Thanks kojiman. Is it good for beginner like me?
Logged

ICS Academy Network Security Certified
ajohnson
Recruiters
Hero Member
*
Offline Offline

Posts: 1057


aka dynamik


View Profile WWW
« Reply #3 on: February 03, 2013, 02:15:44 AM »

+1 for Hacking:AoE

Also hit up SecurityTube for assembly and exploitation instruction. Corelan and The Grey Corner have excellent tutorials as well.
Logged

WIP: GCFA | www.infosiege.net | @infosiege

The day you stop learning is the day you start becoming obsolete.
hurtl0cker
Jr. Member
**
Offline Offline

Posts: 73


View Profile
« Reply #4 on: February 03, 2013, 02:18:15 AM »

Hey, take a look at the "Open Security Training" courses, esp. "Into to Software Exploits" by Corey K., thats a good place to start.

http://opensecuritytraining.info/IntroductionToSoftwareExploits.html
« Last Edit: February 04, 2013, 07:33:15 AM by hurtl0cker » Logged

“Knowing is not enough; we must apply. Willing is not enough: we must do.”
- Bruce Lee
Cyber.spirit
Sr. Member
****
Offline Offline

Posts: 351


The World is sick, Save your mind...


View Profile
« Reply #5 on: February 04, 2013, 07:29:25 AM »

If you're looking for a book, Hacking: The Art of Exploitation is an excellent one that covers exploitation of Linux programs in C. You'll also find numerous exploitation tutorials on Google.

Hey Super kojiman I've bought the book its great man great!! It even teachs C programming language to the audience!! Thanks again.
Logged

ICS Academy Network Security Certified
Cyber.spirit
Sr. Member
****
Offline Offline

Posts: 351


The World is sick, Save your mind...


View Profile
« Reply #6 on: February 04, 2013, 07:31:31 AM »

+1 for Hacking:AoE

Also hit up SecurityTube for assembly and exploitation instruction. Corelan and The Grey Corner have excellent tutorials as well.

Man thanks for your answer but i am busy in these days i don't have enough time to learn a super hard programming language called assembly!!!!! but thanks again maybe i'll go for it later.
Logged

ICS Academy Network Security Certified
Cyber.spirit
Sr. Member
****
Offline Offline

Posts: 351


The World is sick, Save your mind...


View Profile
« Reply #7 on: February 04, 2013, 07:35:56 AM »

Hey, take a look at the "Open Security Training" courses, esp. "Into to Software Exploits" by Corey K., they are a good place to start.

http://opensecuritytraining.info/IntroductionToSoftwareExploits.html

Goooood!

Thanks i am really more comfortable with videos but its needs a gigantic internet bandwidth but its ok thanks.

is exploits are written in C or not??   
Logged

ICS Academy Network Security Certified
hurtl0cker
Jr. Member
**
Offline Offline

Posts: 73


View Profile
« Reply #8 on: February 04, 2013, 07:39:28 AM »

Quote
Goooood!

Thanks i am really more comfortable with videos but its needs a gigantic internet bandwidth but its ok thanks.

is exploits are written in C or not?? 


Open Security Training is like gold given for free but sadly the videos are wayyy tooo gigantic and the classes are in Assembly.
Logged

“Knowing is not enough; we must apply. Willing is not enough: we must do.”
- Bruce Lee
Cyber.spirit
Sr. Member
****
Offline Offline

Posts: 351


The World is sick, Save your mind...


View Profile
« Reply #9 on: February 04, 2013, 07:47:20 AM »

Open Security Training is like gold given for free but sadly the videos are wayyy tooo gigantic and the classes are in Assembly.

Well, I don't know assembly Cry so it is not useful for me
Logged

ICS Academy Network Security Certified
ajohnson
Recruiters
Hero Member
*
Offline Offline

Posts: 1057


aka dynamik


View Profile WWW
« Reply #10 on: February 04, 2013, 12:46:54 PM »

Well, I don't know assembly Cry so it is not useful for me

You're going to need to learn it then. Just because an exploit is written in C, Python, Perl, Ruby, etc., doesn't mean that assembly isn't involved. More often than not, those are just the deliver mechanism for the exploit. You're going to have to get comfortable working in a debugger and understanding assembly. There's no way around it.
Logged

WIP: GCFA | www.infosiege.net | @infosiege

The day you stop learning is the day you start becoming obsolete.
Cyber.spirit
Sr. Member
****
Offline Offline

Posts: 351


The World is sick, Save your mind...


View Profile
« Reply #11 on: February 04, 2013, 02:10:16 PM »

Well, I don't know assembly Cry so it is not useful for me

You're going to need to learn it then. Just because an exploit is written in C, Python, Perl, Ruby, etc., doesn't mean that assembly isn't involved. More often than not, those are just the deliver mechanism for the exploit. You're going to have to get comfortable working in a debugger and understanding assembly. There's no way around it.

So ture.
I said i have no time to learn assembly for now. I just wanna learn to write some exploits with c then after a while i am going to learn assembly. Its better for me atleast i can write exploits with c
Logged

ICS Academy Network Security Certified
unicityd
Full Member
***
Offline Offline

Posts: 156

Bored IT Manager, Crypto Nerd


View Profile WWW
« Reply #12 on: February 04, 2013, 02:44:08 PM »

Quote
I just wanna learn to write some exploits with c

An exploits has two parts: there is a dropper/delivery program that can be written in C, Python, etc.  That is not complicated to write.  The real trick is finding the vulnerability, figuring out how to exploit it and developing the shell code.  You won't be able to do much without learning some assembly.  Without it, you can't customize shell code, debug using gdb/IDA/Olly, or use any non-trivial exploitation technique (e.g. return-into-libc). 

Logged

BS in IT, CISSP, MS in IS Management (in progress)
Cyber.spirit
Sr. Member
****
Offline Offline

Posts: 351


The World is sick, Save your mind...


View Profile
« Reply #13 on: February 04, 2013, 03:45:22 PM »

so you wanna say most or its better to say all of exploits are in assembly?

Ok if you say i accept because i have no experience with exploitation. But i bought hacking AOE it teachs programming part all C and a little bit of assembly(however idk exactly because i didn't read it i just read the table of content) but if i am right tell me why it doesn't teach asembly instead of c its harder it needs more time.

Thanks for your help
« Last Edit: February 04, 2013, 03:48:36 PM by Cyber.spirit » Logged

ICS Academy Network Security Certified
H1t M0nk3y
Hero Member
*****
Offline Offline

Posts: 864



View Profile
« Reply #14 on: February 04, 2013, 04:49:20 PM »

But don't despair Cyber.spirit, you really don't need to be an assembly guru in order to write exploits. I would say you only need limited knowledge to get you started.

Start with http://www.securitytube.net/groups?operation=view&groupId=6 then http://www.securitytube.net/groups?operation=view&groupId=5 and you will know more than what you need to write exploits.

What you really need is understand how operating systems work and learning a bit of assembly will help you a lot in understanding the registries, the stack, etc. And again, you really don't need to be good at assembly. Just write a few programs and you will be fine.

For the rest C, python, ruby, perl, etc are, like ajohnson said, only there to help you deliver your shellcode.

Good luck and post your questions!  Wink
Logged

OSCP, GPEN, GWAPT, GSEC, CEH, CISSP
Pages: [1] 2   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.069 seconds with 23 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Free Business and Tech Magazines and eBooks

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.