دانلود کتاب از روز صفر تا روز صفر، راهنمای عملی برای تحقیقات آسیب‌پذیری

Zero day. The term evokes a sense of urgency, fear, and yes, even excitement in infosec circles. They are called zero days because no one other than the researchers who discovered them knows about them, and the clock to patch a known vulnerability hasn’t even started yet. The discoverers of the zero days are thus free to exploit them at will. Rare, dangerous, and often overhyped, zero days capture the imagination of security enthusiasts, who view zero-day research as one of the pinnacles of offensive security. In my early days as a journeyman hacker who’d had some minor successes in security testing, hunting for zero days seemed to me a mystic art reserved for only the wisest and most experienced hackers. I read blog posts and watched conference talks detailing incredible zero-day discoveries and exploits, but like the audience at a magic show, I could only be impressed by the final reveal without grasping the method, or trick, behind it all. How did the researcher know to look at this particular part of the code? Why did they attempt this exploit instead of another? Answering those questions was often left as an exercise for the viewer or reader, but despite me venturing into other disciplines, like red teaming and web penetration testing, my experiences did not shed much light. I felt like there was a huge gap between where I was and where I needed to be: not quite a beginner, but far from a master. However, with the right opportunities to practice cross-disciplinary skills such as malware reverse engineering, and the time and space to focus on deep security research, I began to discover that zero-day hunting wasn’t as arcane as I’d thought. Like with a magic trick, the process behind it was actually systematic and, more importantly, learnable. In spite of the wide variety of targets and techniques, there are many common tools and approaches researchers can use to effectively discover new vulnerabilities. This book aims to take you through the journey from day zero as a novice researcher to discovering your first zero day and beyond.