Sign In Start Free Trial
Account

Add to playlist

Create a Playlist

Modal Close icon
You need to login to use this feature.
  • Book Overview & Buying The Vulnerability Researcher's Handbook
  • Table Of Contents Toc
The Vulnerability Researcher's Handbook

The Vulnerability Researcher's Handbook

By : Benjamin Strout
5 (1)
close
close
The Vulnerability Researcher's Handbook

The Vulnerability Researcher's Handbook

5 (1)
By: Benjamin Strout

Overview of this book

Vulnerability researchers are in increasingly high demand as the number of security incidents related to crime continues to rise with the adoption and use of technology. To begin your journey of becoming a security researcher, you need more than just the technical skills to find vulnerabilities; you’ll need to learn how to adopt research strategies and navigate the complex and frustrating process of sharing your findings. This book provides an easy-to-follow approach that will help you understand the process of discovering, disclosing, and publishing your first zero-day vulnerability through a collection of examples and an in-depth review of the process. You’ll begin by learning the fundamentals of vulnerabilities, exploits, and what makes something a zero-day vulnerability. Then, you'll take a deep dive into the details of planning winning research strategies, navigating the complexities of vulnerability disclosure, and publishing your research with sometimes-less-than-receptive vendors. By the end of the book, you'll be well versed in how researchers discover, disclose, and publish vulnerabilities, navigate complex vendor relationships, receive credit for their work, and ultimately protect users from exploitation. With this knowledge, you’ll be prepared to conduct your own research and publish vulnerabilities.
Table of Contents (16 chapters)
close
close
1
Part 1– Vulnerability Research Fundamentals
5
Part 2 – Vulnerability Disclosure, Publishing, and Reporting
10
Part 3 – Case Studies, Researcher Resources, and Vendor Resources

Vulnerability Disclosure – Communicating Security Findings

In 2008, Dan Kaminsky discovered a severe vulnerability in the Domain Name System (DNS) protocol. This vulnerability was particularly dangerous because it could be used to redirect traffic from entire domains, such as .com or .org. This could allow for man-in-the-middle attacks, site redirection, and several other scenarios. It was a serious vulnerability with wide-reaching impacts.

Kaminsky understood the threat and immediately alerted Microsoft, who worked with him and many other vendors in secret to patch the issue. Once the patch was ready, Kaminsky held a press conference where he and the vendors announced patches that impacted the technology. At the press conference, few details were provided outside of the need to patch vulnerable systems. However, Kaminsky shared that all would be revealed in a talk at the BlackHat conference in Las Vegas, Nevada a few weeks after the press conference.

Vulnerability researchers...

CONTINUE READING
83
Tech Concepts
36
Programming languages
73
Tech Tools
Icon Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.
Icon Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.
Icon 50+ new titles added per month and exclusive early access to books as they are being written.
The Vulnerability Researcher's Handbook
notes
bookmark Notes and Bookmarks search Search in title playlist Add to playlist font-size Font size

Change the font size

margin-width Margin width

Change margin width

day-mode Day/Sepia/Night Modes

Change background colour

Close icon Search
Country selected

Close icon Your notes and bookmarks

Confirmation

Modal Close icon
claim successful

Buy this book with your credits?

Modal Close icon
Are you sure you want to buy this book with one of your credits?
Close
YES, BUY

Submit Your Feedback

Modal Close icon
Modal Close icon
Modal Close icon