First things first: I have absolutely no interest in learning how to crack systems for personal enrichment, hurting other people or doing anything remotely malicious.I understand the basis of many exploits (XSS, SQL injection, use after free etc.), though I've never performed any myself. I even have some idea about how to guard web applications from common exploits (like the aforementioned XSS and SQL injection)Reading this question about the Internet Explorer zero-day vulnerability from the Security SE piqued my curiosity and made me wonder: how did someone even find out about this exploit? What tools did they use? How did they know what to look for?I'm wary about visiting hacker dens online for fear of getting my own system infected (the Defcon stories make me paranoid). So what's a good, safe place to start learning?
Learning about security and finding exploits
learning;security
First and foremost, get familiar with C and assembly! It can't be stressed over too much how important these are, because they build the whole foundation on which our vulnerable software runs.There are a few resources I can recommend from personal experience. First the theory: Hacking: The Art of Exploitation which is good especially accompanied with Reversing: Secrets of Reverse Engineering which is not so much about vulnerabilities and exploits, but much more about reverse engineering software in general to learn how it works, which is a central part in vulnerability assessment.Then there are things like IO wargame in the SmashTheStack wargame network. It should be pretty easy to figure how to get started with it, although some knowledge of Unix is required(namely how to connect via SSH, what setuid executables are, what is the purpose of privilege escalation and so on). In essence the idea is to login at levelN(where N is the current level number), find a vulnerability in an setuid executable and exploit it to gain the privileges to read the password file for the password for the level(N+1) login. And yes, you get to write your own shellcode to exploit buffer overflow and format string vulnerabilities from scratch, as well as do some cryptanalysis and reverse engineering too. Note that the SmashTheStack wargame network has other wargames too apart from IO one, but I have no experience with them and as such can't vouch much for them.