[DarkMuse]

The amount of decent tutorials on here has been lacking recently and I'm hoping to change that. There has certainly been a few on here in the past, but as of late it's really basic stuff that you could find with a "How do I hax" search on Google.

I've always wondered how people find exploits and thought it would be interesting to post a request here. How do you find exploits? I don't need spoon-feeding, but it's certainly not discouraged. Just enough information that anyone could Google/learn everything else by their self. I'd also be interested in learning 1 on 1 if you would prefer, just pm me. I want to make it clear that I do not plan on doing anything malicious with this, more so for my own curiosity and bank of knowledge.

I know Java, and a bit of Python but that's really it. Do you have any other languages you would recommend for finding exploits? I.e. PHP has more bugs, etc.

-DarkMuse

[Sans]

You don't find exploits. You find bugs and create software that exploits them. As for finding bugs, it really is trial and error and lots of reading. Fuzzers help, static code analysis helps, grepping for commonly-misused functions helps (mysql_query in PHP for example?).. I could write something more detailed but I'm really lazy and tired.

[meow]

The word you're looking for here is vulnerabilities. You find vulnerabilities and create exploits. 2 of the 3 things Sans mentioned only apply to things that you have the source code for, which in my opinion, makes finding vulnerabilities MUCH easier. When black-box testing, if you take it seriously, you find anywhere where the said application/program allows for user-input. Using your findings you test all possible inputs that could trigger an error or vulnerability to show.

It's hard to put it into words, usually the more experience you have, the better you'll be at finding vulnerabilities. That's why nobody can just read an HF tutorial and become a master hacker 5 minutes later.

"Those competent enough to teach The Way know that it cannot be taught."

[DarkMuse]

The word you're looking for here is vulnerabilities. You find vulnerabilities and create exploits. 2 of the 3 things Sans mentioned only apply to things that you have the source code for, which in my opinion, makes finding vulnerabilities MUCH easier. When black-box testing, if you take it seriously, you find anywhere where the said application/program allows for user-input. Using your findings you test all possible inputs that could trigger an error or vulnerability to show.

It's hard to put it into words, usually the more experience you have, the better you'll be at finding vulnerabilities. That's why nobody can just read an HF tutorial and become a master hacker 5 minutes later.

"Those competent enough to teach The Way know that it cannot be taught."

You know I learned about Black-Boxing or whatever you want to call it in my Java class when we were learning about debugging. I never put it together that the same could be used on other people's code. Interesting. Thank you.

[meow]

You know I learned about Black-Boxing or whatever you want to call it in my Java class when we were learning about debugging. I never put it together that the same could be used on other people's code. Interesting. Thank you.

Black-box testing can be applied to anything that's closed source and allows at least some form of user-input, assuming we're thinking about the same thing.

[xulas]

I have this cool exploit that reads the admin password + gives you admin access on a VPN router. I do not think it has been documented as of yet.
But...no particular incentive to write tutorials about it.

How do you find exploits? Well, you just go fuck around. That is literally it. After a while you get accustomed to finding *potential* vulnerabilities to exploit. You just need experience to begin with, writing exploits is a bit of a more advanced thing to do. People read their morning papers, I start the day by checking exploitdb and reading up on new exploits , that too will help you develop your own sensors for writing exploits. After a while, browsing the internet, occasionally glancing at URL structure or inputting bad information will become second nature to you.

One of the bigger vulnerabilities I found was a bitcoin-trader which did not sanitize requests. So by exploiting it by sending malicious requests, I could send negative values and actually receive bitcoin. Basically what i'm telling you is that it is part of a mentality that is not simply 'learned', you have to become a human vulnerability scanner by practice and fucking around.