Best Books of the Month Shop Costumes Learn more nav_sap_plcc_6M_fly_beacon $5 Albums All-New Fire TV Stick with Voice Remote Grocery Introducing Handmade New Kitchen Scale from AmazonBasics Amazon Gift Card Offer hog hog hog  Amazon Echo Starting at $49.99 Kindle Voyage  McCartney Shop Now Kids Halloween

Enter your mobile number or email address below and we'll send you a link to download the free Kindle App. Then you can start reading Kindle books on your smartphone, tablet, or computer - no Kindle device required.

  • Apple
  • Android
  • Windows Phone
  • Android

To get the free app, enter your email address or mobile phone number.

Exploiting Software: How to Break Code 1st Edition

30 customer reviews
ISBN-13: 978-0201786958
ISBN-10: 0201786958
Why is ISBN important?
This bar-code number lets you verify that you're getting exactly the right version or edition of a book. The 13-digit and 10-digit formats both work.
Scan an ISBN with your phone
Use the Amazon App to scan ISBNs and compare prices.
Have one to sell? Sell on Amazon
Buy used
Buy new
More Buying Choices
28 New from $27.44 30 Used from $4.50
Free Two-Day Shipping for College Students with Amazon Student Free%20Two-Day%20Shipping%20for%20College%20Students%20with%20Amazon%20Student

Save up to 80% on Textbook Rentals Rent Textbooks
$35.26 FREE Shipping. Only 9 left in stock (more on the way). Ships from and sold by Gift-wrap available.

Frequently Bought Together

  • Exploiting Software: How to Break Code
  • +
  • Software Security: Building Security In
Total price: $76.38
Buy the selected items together

Editorial Reviews Review

Computing hardware would have no value without software; software tells hardware what to do. Software therefore must have special authority within computing systems. All computer security problems stem from that fact, and Exploiting Software: How to Break Code shows you how to design your software so it's as resistant as possible to attack. Sure, everything's phrased in offensive terms (as instructions for the attacker, that is), but this book has at least as much value in showing designers what sorts of attacks their software will face (the book could serve as a checklist for part of a pre-release testing regimen). Plus, the clever reverse-engineering strategies that Greg Hoglund and Gary McGraw teach will be useful in many legitimate software projects. Consider this a recipe book for mayhem, or a compendium of lessons learned by others. It depends on your situation.

PHP programmers will take issue with the authors' blanket assessment of their language ("PHP is a study in bad security"), much of which seems based on older versions of the language that had some risky default behaviors--but those programmers will also double-check their servers' register_globals settings. Users of insufficiently patched Microsoft and Oracle products will worry about the detailed attack instructions this book contains. Responsible programmers and administrators will appreciate what amounts to documentation of attackers' rootkits for various operating systems, and will raise their eyebrows at the techniques for writing malicious code to unused EEPROM chips in target systems. --David Wall

Topics covered: How to make software fail, either by doing something it wasn't designed to do, or by denying its use to its rightful users. Techniques--including reverse engineering, buffer overflow, and particularly provision of unexpected input--are covered along with the tools needed to carry them out. A section on hardware viruses is detailed and frightening.


Praise for Exploiting Software "Exploiting Software highlights the most critical part of the software quality problem. As it turns out, software quality problems are a major contributing factor to computer security problems. Increasingly, companies large and small depend on software to run their businesses every day. The current approach to software quality and security taken by software companies, system integrators, and internal development organizations is like driving a car on a rainy day with worn-out tires and no air bags. In both cases, the odds are that something bad is going to happen, and there is no protection for the occupant/owner. This book will help the reader understand how to make software quality part of the design - a key change from where we are today!" - Tony Scott Chief Technology Officer, IS&S General Motors Corporation ~"It's about time someone wrote a book to teach the good guys what the bad guys already know. As the computer security industry matures, books like Exploiting Software have a critical role to play." - Bruce Schneier Chief Technology Officer Counterpane Author of Beyond Fear and Secrets and Lies ~"Exploiting Software cuts to the heart of the computer security problem, showing why broken software presents a clear and present danger. Getting past the 'worm of the day' phenomenon requires that someone other than the bad guys understands how software is attacked. This book is a wake-up call for computer security." - Elinor Mills Abreu Reuters' correspondent ~"Police investigators study how criminals think and act. Military strategists learn about the enemy's tactics, as well as their weapons and personnel capabilities. Similarly, information security professionals need to study their criminals and enemies, so we can tell the difference between popguns and weapons of mass destruction. This book is a significant advance in helping the 'white hats' understand how the 'black hats' operate. Through extensive examples and 'attack patterns,' this book helps the reader understand how attackers analyze software and use the results of the analysis to attack systems. Hoglund and McGraw explain not only how hackers attack servers, but also how malicious server operators can attack clients (and how each can protect themselves from the other). An excellent book for practicing security engineers, and an ideal book for an undergraduate class in software security." - Jeremy Epstein Director, Product Security & Performance webMethods, Inc. ~"A provocative and revealing book from two leading security experts and world class software exploiters, Exploiting Software enters the mind of the cleverest and wickedest crackers and shows you how they think. It illustrates general principles for breaking software, and provides you a whirlwind tour of techniques for finding and exploiting software vulnerabilities, along with detailed examples from real software exploits. Exploiting Software is essential reading for anyone responsible for placing software in a hostile environment - that is, everyone who writes or installs programs that run on the Internet." - Dave Evans, Ph.D. Associate Professor of Computer Science University of Virginia ~"The root cause for most of today's Internet hacker exploits and malicious software outbreaks are buggy software and faulty security software deployment. In Exploiting Software, Greg Hoglund and Gary McGraw help us in an interesting and provocative way to better defend ourselves against malicious hacker attacks on those software loopholes. The information in this book is an essential reference that needs to be understood, digested, and aggressively addressed by IT and information security professionals everywhere." - Ken Cutler, CISSP, CISA Vice President, Curriculum Development & Professional Services, MIS Training Institute ~"This book describes the threats to software in concrete, understandable, and frightening detail. It also discusses how to find these problems before the bad folks do. A valuable addition to every programmer's and security person's library!" - Matt Bishop, Ph.D. Professor of Computer Science University of California at Davis Author of Computer Security: Art and Science

See all Editorial Reviews

Best Books of the Month
Best Books of the Month
Want to know our Editors' picks for the best books of the month? Browse Best Books of the Month, featuring our favorite new books in more than a dozen categories.

Product Details

Chapter 3: Reverse Engineering and Program Understanding [PDF]
  • Paperback: 512 pages
  • Publisher: Addison-Wesley Professional; 1 edition (February 27, 2004)
  • Language: English
  • ISBN-10: 0201786958
  • ISBN-13: 978-0201786958
  • Product Dimensions: 6.9 x 1.1 x 9.1 inches
  • Shipping Weight: 2.1 pounds (View shipping rates and policies)
  • Average Customer Review: 4.3 out of 5 stars  See all reviews (30 customer reviews)
  • Amazon Best Sellers Rank: #153,649 in Books (See Top 100 in Books)

More About the Authors

Discover books, learn about writers, read author blogs, and more.

Customer Reviews

Most Helpful Customer Reviews

116 of 119 people found the following review helpful By Ernest Friedman-Hill VINE VOICE on April 20, 2004
Format: Paperback
"Exploiting Software" purports to be a book aimed at helping software
professionals understand the security risks they face; it uses the
pedagogical device of teaching how software can be attacked to
achieve the goal of explaining how secure software should be
built. Unfortunately, I think it fails both as a guide to building
secure software and as a guide to being a black hat hacker.
Most of "Exploiting Software" reads more like a book proposal than a
completed work: too detailed in places (do we really need a dozen
pages on writing plugins for the IDA Pro Disassembler?), not detailed
enough in others, and generally not well organized. Far too often, the
reader is simply told that an exploit exists, and is then directed to
the original source for details. Worse, the original sources are often
white papers, personal web sites, and conference proceedings -- things
that are either hard to obtain, unlikely to be available for long, or
both. As a result, the reader learns nothing.
The preface to "Exploiting Software" explains that this is a companion
volume to "Building Secure Software," written by the same Gary McGraw
with another co-author, and this helps to explain the main failings of
this book. I must admit that the last two chapters, "Buffer overflow"
and "Rootkits", are better than the rest; they provide plenty of
concrete details. But two chapters aren't enough to vindicate this
fairly shallow work. For my money, I expect a book that can stand on its
Comment Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback. If this review is inappropriate, please let us know.
Sorry, we failed to record your vote. Please try again
40 of 41 people found the following review helpful By Stuart Gardner VINE VOICE on August 19, 2004
Format: Paperback
I'm an IT auditor (my main interest area is systems software). The premise of the book, that application security is now the key risk area for exploits is spot on. Exploits of applications can be devestating. This book describes basic attacks on application software; unfortunately the level of detail varies from example to example making it a little difficult to follow. It does provide valuable examples for those developing software of potentail problem areas and common faults. It is is also of potential value in planning penetration tests. There is no real coverage of secure coding practices and how to integrate security into the development process though. The book is worth getting but provides far from exhaustive coverage of code expoitation.
Comment Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback. If this review is inappropriate, please let us know.
Sorry, we failed to record your vote. Please try again
46 of 51 people found the following review helpful By Joshua Santos on April 22, 2004
Format: Paperback
I admit it, I was expecting a lot of this book. I've seen one of the co-authors, hoglund, speak at various security conferences in the past, and he is one of the top minds in the industry. I was therefore very excited to find he was writing a book on "exploiting software".
That being said, I was led to believe that this book would actually teach me how to "exploit software" --- that is the title, isn't it? The first two chapters are kind of overview, talking about historical flaws in things like embedded processors, and then a lengthy tutorial on somewhat obscure topics, such as writing plugins for the popular belgian disassembler, IDA Pro. While this is all fine and dandy, at this point in the book you will start to read faster and think "when do I get to learn how to "exploit software", and write some friggen exploits?"
Well, I was hoping to find that content later in the book (obviously contributed by mr. hoglund), but all I found was some terse overviews on how these exploits are possible. NOT how to actually write them, or use them in practice. This is where I was letdown, and may I even say, misled by the marketing material for the book.
I do have to say, the final section on writing a windows xp rootkit does have some concrete examples, and is highly interesting and informative. But, it remains the only truly hands on and practical portion of the book. This book should have been titled, AND marketed as "The Theory of Software Exploitation + A Good Chapter On Rootkits".
Comment Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback. If this review is inappropriate, please let us know.
Sorry, we failed to record your vote. Please try again
22 of 25 people found the following review helpful By Christos Partsenidis on April 20, 2005
Format: Paperback
Anyone who's been in network security long enough will tell you that the current state of products and `solutions' to security problems are woefully inadequate.

Firewalls, intrusion detection systems, content filters and anti-virus solutions are all reactive technologies, and as a result, they fail to address the primary cause of security vulnerabilities.

This root cause is bad software. Viruses, worms and hackers exploit vulnerabilities in the design and logic of software applications to compromise, destroy and otherwise take control of important information. Once you accept this fact, you'll realize that the only path to good security is to write better code.

`Exploiting Software - How to Break Code' is a book that fires up the hacker in me. It does not aim to teach you about the latest scanning tool, instead, it teaches you how to find and exploit vulnerabilities in systems. While many of the ideas in the book (such as the omnipresent buffer overflow) are not new, there is simply no literary comparison to the treatment given to them in this book.

Application security is one of the highest regarded and specialized technical services in the security industry, and thus, finding people (let alone books) that delve in-depth into the topic is rare and refreshing. The first day I used this book, I was on an application security project. The target application was a distributed database application running on SQL server with a web front-end.

I happened to have this book along with me, and while reading through it, the section on equivalent requests was something I hadn't tried - sure enough, 20 minutes later I had full control of the application and a very good impression of this book.
Read more ›
Comment Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback. If this review is inappropriate, please let us know.
Sorry, we failed to record your vote. Please try again

Most Recent Customer Reviews

Set up an Amazon Giveaway

Amazon Giveaway allows you to run promotional giveaways in order to create buzz, reward your audience, and attract new followers and customers. Learn more
Exploiting Software: How to Break Code
This item: Exploiting Software: How to Break Code
Price: $35.26
Ships from and sold by

Want to discover more products? Check out these pages to see more: fashion design software, testing computer software architecture security