A good security class will give you the principles. Look at CS 161 at Berkeley: http://www-inst.cs.berkeley.edu/~cs161/sp16/ http://www-inst.cs.berkeley.edu/~c

A good security class will give you the principles. Look at CS 161 at Berkeley: http://www-inst.cs.berkeley.edu/~cs161/sp16/ http://www-inst.cs.berkeley.edu/~cs161/sp16/ Any bug is a potential exploit. That exploit may not get you very far but it can be chained with another which will get you further. The principles are almost elegant. The details are mind numbing. Luckily, common exploits get collected into metasploit: https://www.metasploit.com/ https://www.metasploit.com/ Script kiddies (Annoyingly Persistent Teenagers to quote Nick Weaver) generally use toolkits like metasploit.