finelybook
The Vulnerability Researcher's Handbook: A comprehensive guide to discovering, reporting, and publishing security vulnerabilities
by Benjamin Strout(Author)
Publisher Finelybook 出版社: Packt Publishing (February 17, 2023)
Language 语言: English
pages 页数: 260 pages
ISBN-10 书号: 1803238879
ISBN-13 书号: 9781803238876
Book Description
Learn the right way to discover, report, and publish security vulnerabilities to prevent exploitation of user systems and reap the rewards of receiving credit for your work
Key Features
Build successful strategies for planning and executing zero-day vulnerability research
Find the best ways to disclose vulnerabilities while avoiding vendor conflict
Learn to navigate the complicated CVE publishing process to receive credit for your research
Book Description
Vulnerability researchers are in increasingly high demand as the number of security incidents related to crime continues to rise with the adoption and use of technology. To begin your journey of becoming a security researcher, you need more than just the technical skills to find vulnerabilities; you'll need to learn how to adopt research strategies and navigate the complex and frustrating process of sharing your findings. This book provides an easy-to-follow approach that will help you understand the process of discovering, disclosing, and publishing your first zero-day vulnerability through a collection of examples and an in-depth review of the process.
You'll begin by learning the fundamentals of vulnerabilities, exploits, and what makes something a zero-day vulnerability. Then, you'll take a deep dive into the details of planning winning research strategies, navigating the complexities of vulnerability disclosure, and publishing your research with sometimes-less-than-receptive vendors.
By the end of the book, you'll be well versed in how researchers discover, disclose, and publish vulnerabilities, navigate complex vendor relationships, receive credit for their work, and ultimately protect users from exploitation. With this knowledge, you'll be prepared to conduct your own research and publish vulnerabilities.
What you will learn
Find out what zero-day vulnerabilities are and why it's so important to disclose and publish them
Learn how vulnerabilities get discovered and published to vulnerability scanning tools
Explore successful strategies for starting and executing vulnerability research
Discover ways to disclose zero-day vulnerabilities responsibly
Populate zero-day security findings into the CVE databases
Navigate and resolve conflicts with hostile vendors
Publish findings and receive professional credit for your work
Who this book is for
This book is for security analysts, researchers, penetration testers, software developers, IT engineers, and anyone who wants to learn how vulnerabilities are found and then disclosed to the public. You'll need intermediate knowledge of operating systems, software, and interconnected systems before you get started. No prior experience with zero-day vulnerabilities is needed, but some exposure to vulnerability scanners and penetration testing tools will help accelerate your journey to publishing your first vulnerability.
Table of contents
An Introduction to Vulnerabilities
Exploring Real-World Impacts of Zero-Days
Vulnerability Research – Getting Started with Successful Strategies
Vulnerability Disclosure – Communicating Security Findings
Vulnerability Publishing – Getting Your Work Published in Databases
Vulnerability Mediation – When Things Go Wrong and Who Can Help
Independent Vulnerability Publishing
Real-World Case Studies – Digging into Successful (and Unsuccessful) Research Reporting
Working with Security Researchers – A Vendor's Guide
Templates, Resources, and Final Guidance
