3 ms·

I’ve always been interested in this round of thing, but have no idea how or where to get started

mikst 6y ago
one way to understand how to break things is to first build a couple when you build things you can understand the trade-offs people have to make which gives you an intuition for weak spots
- kchr 6y ago
  This is what I tell everyone interested in becoming a pentester. Know your enemy.
nwsm 6y ago
I've never hunted bugs, but you could start by picking a target website and inspecting traffic on register/login pages, user input screens, pages that load dynamic content (may lead you to API endpoints with methods to exploit), etc. Look at the Apple Distinguished Educators case. They went in with an immediate goal: get admin access. So they targeted the account admin pages. Once you know what technologies were used to build a service/site (in this case Jive), you can do a lot of due diligence looking for known vulnerabilities or common attack vectors with that software.
albntomat0 6y ago
Check out ctf competitions. They have a number of "problems" of varying difficulties. Depending on the competition, the easier ones start out with simple stack buffer overflows, SQL injection, etc., and many competitors will post writeups after the competition. Ctftime.org is a good place for a list of competitions (note: some are more difficult, in that an unexperienced person won't be able to do the intro problems). I'd recommend checking out picoctf as a good intro one.
nbk_2000 6y ago
Many years ago, you'd likely have been told to start by reading the Web Application Hackers Handbook (WAHH). But that has since been replaced by the online interactive labs, available free of charge by the fine folks of PortSwigger. https://portswigger.net/web-security https://portswigger.net/web-security IMHO there is no better place to start.
- torgian 6y ago
  Thank you. I'll check this out!

one way to understand how to break things is to first build a couple when you build things you can understand the trade-offs people have to make which gives you an intuition for weak spots

kchr 6y ago
This is what I tell everyone interested in becoming a pentester. Know your enemy.

nwsm 6y ago

I've never hunted bugs, but you could start by picking a target website and inspecting traffic on register/login pages, user input screens, pages that load dynamic content (may lead you to API endpoints with methods to exploit), etc. Look at the Apple Distinguished Educators case. They went in with an immediate goal: get admin access. So they targeted the account admin pages. Once you know what technologies were used to build a service/site (in this case Jive), you can do a lot of due diligence looking for known vulnerabilities or common attack vectors with that software.

albntomat0 6y ago

Check out ctf competitions. They have a number of "problems" of varying difficulties. Depending on the competition, the easier ones start out with simple stack buffer overflows, SQL injection, etc., and many competitors will post writeups after the competition. Ctftime.org is a good place for a list of competitions (note: some are more difficult, in that an unexperienced person won't be able to do the intro problems). I'd recommend checking out picoctf as a good intro one.

nbk_2000 6y ago

Many years ago, you'd likely have been told to start by reading the Web Application Hackers Handbook (WAHH). But that has since been replaced by the online interactive labs, available free of charge by the fine folks of PortSwigger. https://portswigger.net/web-security https://portswigger.net/web-security IMHO there is no better place to start.

torgian 6y ago
Thank you. I'll check this out!