From Day Zero to Zero Day: A Hands-On Guide to Vulnerability Research (Paperback)
暫譯: 從 Day Zero 到 Zero Day:漏洞研究實作指南

Lim, Eugene

  • 出版商: No Starch Press
  • 出版日期: 2025-08-12
  • 定價: $2,160
  • 售價: 9.0 折 $1,944
  • 語言: 英文
  • 頁數: 344
  • 裝訂: Quality Paper - also called trade paper
  • ISBN: 1718503946
  • ISBN-13: 9781718503946
  • 相關分類: Penetration-test
  • 立即出貨 (庫存=1)

買這商品的人也買了...

相關主題

商品描述

Find vulnerabilities before anyone else does.

Zero days aren't magic--they're missed opportunities. From Day Zero to Zero Day teaches you how to find them before anyone else does.

In this hands-on guide, award-winning white-hat hacker Eugene "Spaceraccoon" Lim breaks down the real-world process of vulnerability discovery. You'll retrace the steps behind past CVEs, analyze open source and embedded targets, and build a repeatable workflow for uncovering critical flaws in code.

Whether you're new to vulnerability research or sharpening an existing skill set, this book will show you how to think--and work--like a bug hunter.

You'll learn how to:

  • Identify promising targets across codebases, protocols, and file formats.
  • Trace code paths with taint analysis and map attack surfaces with precision.
  • Reverse engineer binaries using Ghidra, Frida, and angr.
  • Apply coverage-guided fuzzing, symbolic execution, and variant analysis.
  • Build and validate proof-of-concept exploits to demonstrate real-world impact.


More than a toolkit, this is a window into how top vulnerability researchers approach the work. You'll gain not just techniques but also the mindset to go deeper, ask better questions, and find what others miss.

If you're ready to stop reading write-ups and start writing them, From Day Zero to Zero Day is your guide.

商品描述(中文翻譯)

找出漏洞,搶在任何人之前發現它們。

零時差漏洞並非魔法——而是那些被錯過的機會。《From Day Zero to Zero Day》教你如何搶在任何人之前找出它們。

在這本實作導向的指南中,屢獲殊榮的白帽駭客 Eugene「Spaceraccoon」Lim 將深入拆解真實世界中的漏洞探索流程。你將重走過去 CVE 背後的發掘步驟,分析開放原始碼與嵌入式目標,並建立一套可重複執行的工作流程,找出程式碼中的重大缺陷。

無論你是剛接觸漏洞研究,或是想精進既有技能,本書都將帶你學會如何像漏洞獵人一樣思考與工作。

你將學會:

• 從程式碼庫、協定與檔案格式中辨識具潛力的目標。
• 使用污點分析(taint analysis)追蹤程式碼路徑,並精準描繪攻擊面。
• 使用 Ghidra、Frida 與 angr 進行二進位檔逆向工程。
• 應用覆蓋率導向模糊測試(coverage-guided fuzzing)、符號執行(symbolic execution)與變體分析(variant analysis)。
• 建立並驗證概念驗證(proof-of-concept,PoC)漏洞利用程式,以展示真實世界中的影響。

這不只是一套工具箱,更是深入了解頂尖漏洞研究人員如何進行工作的窗口。你獲得的不只是技術,還有更深入探索、提出更佳問題,以及找出他人遺漏之處的思維方式。

如果你已準備好不再只是閱讀漏洞分析報告,而是開始撰寫報告,《From Day Zero to Zero Day》就是你的指南。

作者簡介

Eugene Lim (aka "Spaceraccoon") is a security researcher and white-hat hacker who has reported hundreds of vulnerabilities across enterprise software, hardware, and cloud services. In 2021, he was one of five researchers selected from a pool of over one million for HackerOne's H1 Elite Hall of Fame. His research has been featured at Black Hat and DEF CON and in WIRED and The Register.

作者簡介(中文翻譯)

Eugene Lim(又名「Spaceraccoon」)是一名安全性研究員與白帽駭客,曾在企業軟體、硬體和雲端服務中發現並回報數百項漏洞。2021 年,他從超過一百萬名候選人中脫穎而出,成為 HackerOne H1 Elite 名人堂選出的五名研究員之一。他的研究成果曾在 Black Hat 和 DEF CON 發表,並刊登於《WIRED》和《The Register》。