security - What are some advanced and modern resources on exploit writing? -

I have read and finished both, and both of them were illuminating their way, but I still have lots of I feel like techniques and information presented like that which is somewhat old.

When the infamous Faraq article was written in 1996, how do I consider computer security "golden age".

It was relatively easy to write exploits in later years. Some basic knowledge in C and Assembly was necessary to overflow the buffer and execute some arbitrary shell code on the victim machine.

To keep it lightweight, things are more complex now, security engineers have to struggle with such things, such as, heap cookies, and more

You can not organize most buffer-growing exploits in this tutorial without writing these events.

With a flock of flag to close modern security.

Now if you want to write an exploitation then you have to find ways to stop DEP, spray the heap with your shell-code hundreds of times and try a random memory location near your shellcode Planted Not to mention the prevalence of managed languages ​​in use today, when it comes to vulnerabilities, it is safer.

I am moving forward to keep my security knowledge beyond a toy-exploitation for a decade old system. I am having trouble finding resources which help solve the issues of writing in the face of all the security given above.

Challenges of writing exploitation for modern systems devoted to conflict with more advanced and popular papers, books or other resources?

You have mentioned that 'Staging the Stack' research-wise before publishing this article It was only published. The Morris worm of the late 80s used it (to take the IIRC finger in the finger) at that time it was a big stir because every server back was written in optimistic C.

It took some (10 or so) years, but gradually all people have to face public-server.

Servers written in C were subject to multiple security analysis, and server-side processing was split into other languages ​​and runtime.

Different The server is not considered to be a big goal. These days it is big fish. Hijack the client and the server will allow you to operate under the client's credentials.

The scenario has changed.

Personally I am a sparse fan of assembly playing game. I do not have any practical use for them, but if you want to join, then I recommend checking the Metasplight source and reading their mailing lists. They do a lot of crazy stuff and this is all in the open.