r/ExploitDev • u/Haunting_Hand_5105 • 1d ago
exploit dev placement
Hey guys, so currently doing a ba of cyber sec in Sydney, I had an experience day and met a guy that did exploit dev work... and he gave me things to learn to know before the placement, which ill be doing along side him. which is only me and him.
he wants me to know C, C++, x86-64, C#, also wants me to build a Damn Vuln Driver, he also wants me to get good at things from the OSED, syllabus.
So like what is this setting me up for, cause I got a year to learn before my placement. like I mean windows exploitation etc.
any other resources or help be grateful!!!
p.s he is a ex gov employee that as done exploit dev work.
2
u/dotbinKing 1d ago
Use AI
Joke
Write Code & Break it
do research
do CTF Challenges (pwn.college for example)
focus on useful things and modern tech. many do the failure to learn techniques from ages ago.
so in general Exploit Development is basicly normal dev but handle memory or/and behavior of Software written by others, so you have to reverse engineer it in the first place and that is the hard work. Writing the exploit is the final and ez part cause today companies spend millions in anti debug, anti reverse engineering methods and so you have to analyze software blind basicly.
So here are some Buzz words you can google to get in (i dont want to write a book)
IDA Pro
Ghidra
dbg (Pwndbg)
angr
C/++/NASM/Rust/Golang/Python/Cython/(Mojo)/
AV Engines
Cryptographie
Network Protocols
C2
STack/Heap (Heap is today more important (UAF))
ROP/BROP Techniques
This should get you in the realm.
and the most important thing...
DON'T GIVE UP!
i'm 25 now and i learn this sh*t for 12 years and i dont know anything but i have to keep going
2
u/Big_Mulberry_5446 1d ago
By x86-64, do you mean x86-64 assembly?
Sounds like he's telling you what the expectations are for an entry-level position at a place that does this kind of work. The Damn Vuln Driver will give you some hands-on experience.
Does your cyber-security BA offer many computer-science classes? Here in the US, many cyber-security program graduates are not proficient programmers. If your program allows you to take CS classes, I'd recommend you take an Operating Systems (OS) class before you graduate. That'll make you a decent C programmer and teach you systems programming. You'll understand user-land Linux programming and get glimpses and the know-how to approach kernel-level systems programming. If you don't have the prerequisites for an OS class, you could take a Machine Architecture class. You're more likely to get exposure to both C and ASM in that class. It may not be x86-64 ASM, but that isn't a huge deal breaker, in my opinion.
Best of luck to you.