I get request for tips for getting started in bounty hunting- so I group an answer here. This is what have worked for me and my primary focus is on Windows and filesystems. An area that I think is underrated as there is explosion in minifilters that have to all interact securely
-
-
Read everything by james forshaw- many times. See all hes videos- he invented most classes of logic exploits. Learn DACL,Oplocks,junction folders,symlink at the NT api level. Use filetest and procmon- I can play with filetest for hours
Show this threadThanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
do your own tooling- that is how you learn. test ideas, try stuff, come up with hypothetical exploitable scenarios, see if you can find them. Make solutions for arb file create to code exec. read, test, try stupid stuff- sometimes you get surprised. Forget assumptions, verify
Show this threadThanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.