Continuing the Journey of Vulnerability Discovery

“Give a man an exploit, and you make him a hacker for a day; teach a man to exploit bugs, and you make him a hacker for a lifetime.”

Felix “FX” Lindner

This quote by Felix “FX” Lindner, head of Recurity Labs, from Tobias Klein’s A Bug Hunter’s Diary book, skillfully rephrases a well-known Confucian adage about teaching a man to fish. It is the mantra for our final chapter – explaining the method and the approach.

So, we have come a long way and finally arrived at the book’s last chapter. We extend our gratitude for your patience and companionship on this journey.

Let’s reflect on a riveting expedition, with some chapters designed as Capture The Flag (CTF) exercises and others discovering Common Vulnerabilities and Exposures (CVEs). Let’s summarize the approach and see what to do when we find a new vulnerability.

In this chapter, we will...

An approach to discovering vulnerabilities

Beyond the vulnerabilities and challenges we’ve uncovered, our core interest lies in comprehending the approach to discovering vulnerabilities and giving examples of the techniques to find them.

Understanding what you are doing

The key to the process is understanding our actions and their implications. We will steer clear of the indiscriminate usage of automated tools. Their utility is acknowledged, but we left them outside the book’s scope. We focus on problem-solving by understanding how things work to discover vulnerabilities or overcome challenges. The key is to learn how to make something do something unexpected. The book intends to illustrate a mindset and a modus operandi by providing examples – or instances, as we can say in object-oriented languages – that apply this process.

Getting into the flow

The objective of the process is to comprehend a problem (e.g., how a specific software works, an...

The dilemma of disclosing vulnerabilities

A critical consideration arises when we discover a vulnerability – it presents a special responsibility.

There’s a separate issue if we work for an organization where we find vulnerabilities for them or third-party customers, where we’re subject to the rules of where we work. We often have to find the vulnerability, write a reliable exploit, and document it.

The decision to disclose vulnerabilities is a modern dilemma akin to a digital version of Shakespeare’s “To be, or not to be” speech.

What we did while writing the book

During the course of writing our book, we came across several vulnerabilities. We documented our findings in a brief technical report supplemented with screenshots and videos for clarity. Our next step was to notify the software authors or vendors about our discoveries, usually via email or social media. While waiting for a response, we either looked for the release of...

Summary

This chapter summarized the approach used to find vulnerabilities and the state of mind we must have.

Then, we considered the various possibilities for disclosure after we find something, from full disclosure to coordinated disclosure, and how that can be handled both on the researcher’s side and by the organization receiving the report.

We hope you have found something interesting in this book and continue finding new ways to attack and exploit web applications and beyond. To close the book, in the words of Bilbo Baggins in The Fellowship of the Ring. “Don’t adventures ever have an End? I suppose not. Someone else always has to carry on the story”.

Further reading

This chapter covered some topics but less than the previous chapters. If you want to go deeper, we’re happy to share some valuable resources with you:

• [1] Csikszentmihalyi, M. (2004). Flow, the secret to happiness. [online] www.ted.com. Available at https://www.ted.com/talks/mihaly_csikszentmihalyi_flow_the_secret_to_happiness?language=en.
• [2] Schneier, B. (2007). Essays: Schneier: Full Disclosure of Security Vulnerabilities a ‘Damned Good Idea’ - Schneier on Security. [online] www.schneier.com. Available at https://www.schneier.com/essays/archives/2007/01/schneier_full_disclo.html.
• [3] National Vulnerability Database (2021). NVD - CVE-2021-44228. [online] nvd.nist.gov. Available at https://nvd.nist.gov/vuln/detail/CVE-2021-44228.
• [4] Kiska, C. (2021). https://twitter.com/TheGamblingBird/status/1470518451198439426. [online] Twitter. Available at https://twitter.com/TheGamblingBird/status/1470518451198439426.
• [5] Wetter, J...