4

I'm interested in learning system security. I'm thinking of installing Damn Vulnerable Linux on one of my spare machines to test on. Anyone have any recommendations, reads, methods or tutorials?

4

2 Answers 2

2

These days exploiting C/C++ and operating systems is not easy. You are starting with a massive topic. The only more complex security topic would be cryptography. With anything you need to start small and then work your way up. You should start with web application security. You should be learning about the most common vulnerabilities such as XSS and SQL Injection, Google Gruyre is a good resource.

If you are very skilled then you might be able to get though old paper smashing the stack for fun and profit. A good book for learning how to attack modern c/c++ applications is Exploiting Software: How to break code. enter image description here

2
  • Hah! Noted sir, thanks for the input. If everyone was detered by the daunting, we wouldn't have much in the ways of innovation.
    – ahodder
    May 13, 2011 at 23:27
  • 1
    I own the book, it's awesome. May 14, 2011 at 0:37
1

I feel that information security is too broad a topic, and list of interesting problems are too many to enumerate. Since you say about Damn vulnerable linux, I assume that you are confining this to operating system.

If so, some interesting topics would be - i) Buffer Overflow attacks - Stack smashing attacks, Integer overflow and Heap smashing attacks, etc. and ii) TOCTOU attacks. http://insecure.org/ is a good resource and has bunch of tutorials on them. Also, the vulnerabilities, and some attack payload can be found in vulnerability reporting DB such as secunia.org and cert.org. Also, it might be worth to study about network exploits - on how deep-packet inspection can detect simple worms. Advanced topics might include polymorphic and self-modifying worms. Firewalls can be an eventual topic.

1
  • Tahnk for the input, I will look into all that :)
    – ahodder
    May 13, 2011 at 23:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.