I think this post sums up best the problem with the hacking exposed series and the direction pdp's book is going. Hacking exposed does not explain anything it only teaches tools and results. I much prefer books like 'hacking the art of exploitation', 'the art of software security assessment', and 'secrets of reverse engineering' because they are tool agnostic and teach the low level concepts that are going on. If I was hiring people I would much rather someone who understand the details of how something worked then someone who can only rely on tools and scripts. <br>
<br>Publishing these books only hurts the 'community' by breeding more kiddies who rely on tools to do everything for them.<br><br><br>On Wed, Mar 19, 2008 at 1:35 PM, <<a href="mailto:Valdis.Kletnieks@vt.edu">Valdis.Kletnieks@vt.edu</a>> wrote:<br>
<div class="gmail_quote"><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div class="Ih2E3d">On Wed, 19 Mar 2008 17:30:08 -0000, "Petko D. Petkov" said:<br>
<br>
> moreover, the project is not a Phrack knock-off as you said. It is<br>
> very different. As I said, it wont contain explanations but like hands<br>
> on tips/tricks and techniques even the most knowledgeable can learn<br>
> from or use as a base reference.<br>
<br>
</div>Without an explanation of *why* a given tip/trick works, it's hard to learn from.<br>
<br>
For example, consider the question of "Tell me how many processes called<br>
'xyzzy' are running on a system. The naive answer is:<br>
<br>
% ps ax | grep xyzzy | wc -l<br>
<br>
However, that generates an off-by-one error because it catches the grep itself.<br>
<br>
% ps ax | grep '[x]yzzy' | wc -l<br>
<br>
Does what you wanted - but without an understanding of *why* that regexp<br>
doesn't match itself when the first example does, you can't apply the more<br>
general concept of regexps that do/don't match themselves to *other* uses.<br>
(The secret here - the second regexp is *effectively* identical to the first,<br>
but says "look for an x next to a y" in a way that doesn't itself have an<br>
x adjacent to a y).<br>
<br>
So you need an explanation.<br>
<br>
(The fact that a process can re-write its argv[0] and change the name displayed<br>
by ps is yet another "teachable moment" - does that mean that you really want<br>
the name it was invoked under and should add the 'ps' flag that gives that, or<br>
do you really want the number of processes that have that modified argv value<br>
set? For instance, if you're using 'sendmail', there are a number of states<br>
a given copy can be in, and you can do a status summary by counting the number<br>
of 'accepting connections', 'rejecting connections', 'running queue' and other<br>
similar indicators.<br>
<br>
But again, you need an explanation.<br>
<br>_______________________________________________<br>
Full-Disclosure - We believe in it.<br>
Charter: <a href="http://lists.grok.org.uk/full-disclosure-charter.html" target="_blank">http://lists.grok.org.uk/full-disclosure-charter.html</a><br>
Hosted and sponsored by Secunia - <a href="http://secunia.com/" target="_blank">http://secunia.com/</a><br></blockquote></div><br>