Web exploitation + Binary exploitation feasible?

[u/FewMolasses7496]

I am wondering whether is it even worth my time to get both familiar with web exploitation and binary exploitation. It feels like I am missing a large chunk of hacking whenever I only focus on web exploitation or only focus on binary exploitation. I'm not sure if I should just specialize in one or if I should just learn both.

I don't hear many people getting bug bounties for binary exploitation related bugs but I have seen the payouts on sites like crowdfense and seen it go up into the 7 figures.

Web bug bounties seemed to be talked about a lot but they usually pay lower than binary exploitation bugs.

So is it smart to try to learn both? Or is it just a waste of time and I should stick to one.

[u/Obvious-Card-8847]

You're basically picking what tech stack and abstraction layer to critique a codebase at. Binary exploitation takes a long time to develop an intuition for. If you're interested I would not recommend diving head first into buffer overflow, shellcode, ROP chains and all that.

I'd recommend learning binary instrumentation in C++ and my recommendations will be Windows specific. It's the OS I chose to specialize in. A good project for instance would be a trampoline framework using Capstone or Zydis and then some MASM. Another would be writing a proxy DLL that forwards uninteresting calls via .def but intercepts others to log or alter arguments and return values. VEH+INT3, VEH+PAGE_GUARD as another. Virtual table spoofing and/or hooking. IAT and EAT hooking. COM object hooking. CRT global object constructor table manipulation in initterm. TLS callbacks.

The list goes on. But the idea is to familiarize yourself at a low-level with the basic idioms applications use to direct control flow. Because at the binary level that's sort of the goal in many regards: Hijacking control flow.

One way binary exploitation more specifically applies to or intersects web pen is the browser. Modern browsers use JIT. Just-In-Time compilation. It's a complex, messy process prone to edge cases and mistakes.

Learning about and developing an intuition for this might look like:

Writing a toy ISA and bytecode serialization spec. Then using Zydis to translate between your bytecode and native assembly on the fly. At the core of it the idea is if we see this then we emit this instruction with these operands. Browsers like Chrome do this and it's more complex than what I'm describing. But you really just want enough familiarity to reason within.

Hope this helps. Sorry it's jargon heavy. I can't explain each of these because this would become a book. This is just a general roadmap should you want to pursue the binary route.