0x00sec

Seems like a good place to copy/paste one of my comments from a different thread. Disclaimer: I'm not particularly good at this, so whatever comments I make are well intentioned but may be of varying accuracy. ... Online sources: * OWASP.org is a good place to find info. If you look something up, there's a good chance you will find it here. * https://owasp.org/www-project-web-security-testing-guide/ Thanks to redis_mic for this one, I didn't know it existed until today. * overthewire.org Similar to HTS, but you don't need an account. The subject matter covered is also slightly different. * https://0x00sec.org/ A forum dedicated to security. There's a lot of script kiddies, but also some gold. * https://www.hackerone.com/ What better way to learn then practice on live targets? That being said, I would do some of the others first. ... I do a lot of learning through reading, so books: * Network Security Assessment by Chris McNab. I have second edition, which is a good and instructive read, but quite outdated. * Real-World Bug Hunting by Peter Yaworski. Web security 101. Good read, and fairly useful. * Advanced Penetration Testing by Wil Allsop. Outdated, but interesting. You will never use flash again after reading this. * Social Engineering, The Science of Human Hacking by Christopher Hadnagy. This is a very interesting read. Also, one of the few that can't go out of date. ... This should be enough to get you started. There's a couple more books I can think of,…

I think that there's a big difference between "news stories" and low-level exploit details. The audiences would be very different. There are existing sites with a good niche, such as https://0x00sec.org/ which might have more direct input though.

https://0x00sec.org/ for security, malware analysis, reversing etc. It's more of a forum, but the write-ups are pretty helpful

Lately, I've been getting into https://0x00sec.org

https://en.wikipedia.org/wiki/Buffer_overflow#History confirms The earliest documented hostile exploitation of a buffer overflow was in 1988. It was one of several exploits used by the Morris worm to propagate itself over the Internet. The program exploited was a service on Unix called finger. (source code here https://0x00sec.org/t/examining-the-morris-worm-source-code-malware-se… ) Later, in 1995, Thomas Lopatic independently rediscovered the buffer overflow and published his findings on the Bugtraq security mailing list. A year later, in 1996, Elias Levy (also known as Aleph One) published in Phrack magazine the paper "Smashing the Stack for Fun and Profit", a step-by-step introduction to exploiting stack-based buffer overflow vulnerabilities. And here is "How to write buffer overflow" by Mudge (10/20/95) : https://insecure.org/stf/mudge_buffer_overflow_tutorial.html

The article mentions that Python malware comes with difficulties but in my experience it has the advantage to be an easy and simple way to write reliable malware. Packaging with PyInstaller to create a single (but large) executable is easy and helps avoiding detection as the interpreter is embedded in the PE (I never went in depth on this topic but it would be interesting to check out). Shameless plug; I wrote a few popular articles on 0x00sec about Python malware on Windows just to show how simple and easy it is to build either using ctypes to call WinAPI functions or using pywin32 wrapper which makes the whole thing a lot faster. See part 1 here https://0x00sec.org/t/malware-writing-python-malware-part-1/11700 Definitely not the way to go if you have limited memory and need to write tiny shell code but it’s good enough for a stage 2 payload.

The 0x00sec.org security forum has/had this effort to mine coins to keep the site ad-free. From the comments[1] users seem to have been happy to help. [1]https://0x00sec.org/t/mine-for-the-community/3709

Realmode assembly - writing bootable stuff: https://0x00sec.org/t/realmode-assembly-writing-bootable-stuff-part-2/… Writing a bootloader: http://3zanders.co.uk/2017/10/13/writing-a-bootloader/ (Both from my HN archive, posted somewhere this year)