Jump to content


Photo
- - - - -

finding exploits in a program


  • Please log in to reply
6 replies to this topic

#1 hidden_user

hidden_user

    I broke 10 posts and all I got was this lousy title!

  • Members
  • 13 posts

Posted 04 March 2008 - 11:12 PM

Well I have several questions to ask about this. How do people find exploits in a software program? do they just sit there and read over the code of it and try to figure out what can go wrong or is there some secret to it? What programs are used to find exploits in software?

#2 livinded

livinded

    Dangerous free thinker

  • Agents of the Revolution
  • 1,942 posts
  • Location:~/

Posted 04 March 2008 - 11:53 PM

It depends on what you are looking for a vulnerability in and what kind of vulnerability. When you have source available, it is one of the ways that they can be found by not the only. One of the choices is fuzzing which is attempting to try unexpected input which the program may not handle correctly. Sometimes bugs are found just through normal use and they can later be confirmed as being exploitable. If you really want to understand how to find and exploit vulnerabilities, I'd suggest learning as much as you can about programming as it really is the only way to do so.

#3 teque

teque

    Will I break 10 posts?

  • Members
  • 5 posts

Posted 05 March 2008 - 02:38 PM

Some programs - Disassemblers (IDA Pro), Decompilers, Hex Editors, Resource Viewers, some Hacking Tools (check out http://sectools.org/), and on and on...

Consider looking into reverse engineering. Books such as "Reversing: Secrets of Reverse Engineering" and "
Hacking: The Art of Exploitation" -- these will cover things on how to identify structures, routines, etc.
Also, you may want to check out Fravia's labyrinth of knowledge at fravia.com

teque

#4 hidden_user

hidden_user

    I broke 10 posts and all I got was this lousy title!

  • Members
  • 13 posts

Posted 06 March 2008 - 06:44 PM

I got a friend of mine to lend me Reversing: Secrets of Reverse Engineering and it is really good and teaches you ASM as well. It shows lots of different ways to reverse engineer programs. thanks for the help.

#5 nullkraft

nullkraft

    SUP3R 31337 P1MP

  • Binrev Financier
  • 284 posts
  • Location:Think Heisenberg uncertainty principle.

Posted 13 March 2008 - 08:27 PM

Not much of a secret but it will take a bit of study. Look at the article from Phrack called "Smashing the stack for fun and profit." It's a timeless classic.

#6 JimmyRidge

JimmyRidge

    DDP Fan club member

  • Members
  • 40 posts
  • Location:513

Posted 06 April 2008 - 05:07 AM

howbout fuzzing?

#7 Poetic-Justice

Poetic-Justice

    The phorce is with me!

  • Members
  • 70 posts

Posted 06 April 2008 - 05:58 AM

http://yestoi.haktst...ngineering.html

There's a pretty good tutorial here, and read the books he suggests.




BinRev is hosted by the great people at Lunarpages!