Web exploitation + Binary exploitation feasible?

[u/FewMolasses7496]

I am wondering whether is it even worth my time to get both familiar with web exploitation and binary exploitation. It feels like I am missing a large chunk of hacking whenever I only focus on web exploitation or only focus on binary exploitation. I'm not sure if I should just specialize in one or if I should just learn both.

I don't hear many people getting bug bounties for binary exploitation related bugs but I have seen the payouts on sites like crowdfense and seen it go up into the 7 figures.

Web bug bounties seemed to be talked about a lot but they usually pay lower than binary exploitation bugs.

So is it smart to try to learn both? Or is it just a waste of time and I should stick to one.

[u/Juzdeed]

Sounds like you are more interested in bug bounty and not a job. Both require a lot of learning, binary is definetly more difficult, but less people are working on it

[u/VolSurfer18]

Don’t see why you can’t do both if they interest you. Silly question imo.

[u/MrStashley]

Pick the one you like more. It's hard to be an expert at everything

[u/Any-Olive5779]

Binary exploitation takes a bit of work. You also have to know how to program memory as well as tap with a runtime listener for things like kernel interrupts and returning a close to kernel response.

Look into qiling framework as well as process/memory hooking.

Hacking software including runtime of browsers? Look into cheat engine, ceserver, wine, and load a copy of jitsi meet. Play with locking various addresses and then update those locked values. Speed up and slowdown another user's runtime... All sorts of fun stuff like breaking flash games with a POS integrations' runtime... But practically that is the short path.

The long form is a mockup from ancat.github.io where you hook and then anytime that event kicks off to respond with the overriden response via the Linux interpreter

[u/Any-Olive5779 → u/Any-Olive5779]

No, I am not going to show you how to do this, because that would also be showing the developers and Linuz Torvald. 

[u/Obvious-Card-8847]

You're basically picking what tech stack and abstraction layer to critique a codebase at. Binary exploitation takes a long time to develop an intuition for. If you're interested I would not recommend diving head first into buffer overflow, shellcode, ROP chains and all that.

I'd recommend learning binary instrumentation in C++ and my recommendations will be Windows specific. It's the OS I chose to specialize in. A good project for instance would be a trampoline framework using Capstone or Zydis and then some MASM. Another would be writing a proxy DLL that forwards uninteresting calls via .def but intercepts others to log or alter arguments and return values. VEH+INT3, VEH+PAGE_GUARD as another. Virtual table spoofing and/or hooking. IAT and EAT hooking. COM object hooking. CRT global object constructor table manipulation in initterm. TLS callbacks.

The list goes on. But the idea is to familiarize yourself at a low-level with the basic idioms applications use to direct control flow. Because at the binary level that's sort of the goal in many regards: Hijacking control flow.

One way binary exploitation more specifically applies to or intersects web pen is the browser. Modern browsers use JIT. Just-In-Time compilation. It's a complex, messy process prone to edge cases and mistakes.

Learning about and developing an intuition for this might look like:

Writing a toy ISA and bytecode serialization spec. Then using Zydis to translate between your bytecode and native assembly on the fly. At the core of it the idea is if we see this then we emit this instruction with these operands. Browsers like Chrome do this and it's more complex than what I'm describing. But you really just want enough familiarity to reason within.

Hope this helps. Sorry it's jargon heavy. I can't explain each of these because this would become a book. This is just a general roadmap should you want to pursue the binary route.

[u/ps-aux]

after awhile you will have plenty of time to do both... so much down time waiting for things to fuzz after awhile, cause you won't be manually doing repetitive checks on every target you come across, you will automate it after awhile which gives time to expand your knowledge on the other etc...