{"id":308,"date":"2026-06-08T17:45:52","date_gmt":"2026-06-08T17:45:52","guid":{"rendered":"https:\/\/fikresekhel.com\/blog\/?p=308"},"modified":"2026-06-08T17:45:52","modified_gmt":"2026-06-08T17:45:52","slug":"how-to-start-in-vulnerability-research","status":"publish","type":"post","link":"https:\/\/fikresekhel.com\/blog\/pentesting\/how-to-start-in-vulnerability-research\/","title":{"rendered":"How To Start In Vulnerability Research"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Understanding How Security Research Really Begins<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Many newcomers believe vulnerability research starts with advanced exploit development, reverse engineering malware, or discovering zero-day vulnerabilities.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In reality, most successful vulnerability researchers begin somewhere much simpler:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">They develop the ability to understand how software behaves when developers make assumptions that attackers can violate.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Vulnerability research is fundamentally the study of trust, assumptions, boundaries, and unexpected behavior.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The objective is not to &#8220;hack things.&#8221;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The objective is to understand systems deeply enough to recognize when reality differs from what developers intended.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">What Is Vulnerability Research?<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Vulnerability research is the systematic process of identifying security weaknesses in software, protocols, hardware, cloud environments, APIs, mobile applications, and operating systems.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Researchers seek to answer questions such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>What assumptions does this system make?<\/li>\n\n\n\n<li>What input is considered trusted?<\/li>\n\n\n\n<li>What happens when those assumptions fail?<\/li>\n\n\n\n<li>Can an attacker influence behavior?<\/li>\n\n\n\n<li>Can trust boundaries be crossed unexpectedly?<\/li>\n\n\n\n<li>Can security controls be bypassed?<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">A vulnerability exists when attacker-controlled behavior causes security properties to fail.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Those properties may include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Confidentiality<\/li>\n\n\n\n<li>Integrity<\/li>\n\n\n\n<li>Availability<\/li>\n\n\n\n<li>Authentication<\/li>\n\n\n\n<li>Authorization<\/li>\n\n\n\n<li>Non-repudiation<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Step 1: Learn How Software Actually Works<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Before learning exploitation, learn software architecture.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A surprising number of vulnerability researchers spend more time reading code than writing exploits.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Focus on understanding:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Web Applications<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>HTTP<\/li>\n\n\n\n<li>Cookies<\/li>\n\n\n\n<li>Sessions<\/li>\n\n\n\n<li>JWTs<\/li>\n\n\n\n<li>REST APIs<\/li>\n\n\n\n<li>GraphQL<\/li>\n\n\n\n<li>Authentication flows<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Backend Systems<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Databases<\/li>\n\n\n\n<li>Queues<\/li>\n\n\n\n<li>File systems<\/li>\n\n\n\n<li>Caching systems<\/li>\n\n\n\n<li>Cloud services<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Programming Languages<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Start with one language:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>JavaScript<\/li>\n\n\n\n<li>Python<\/li>\n\n\n\n<li>Go<\/li>\n\n\n\n<li>Java<\/li>\n\n\n\n<li>PHP<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Do not attempt to learn everything simultaneously.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Understanding one ecosystem deeply is more valuable than understanding many superficially.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Step 2: Learn Common Vulnerability Classes<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Most modern vulnerability research starts with understanding known failure patterns.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Examples include:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Vulnerability<\/th><th>Description<\/th><\/tr><\/thead><tbody><tr><td>SQL Injection<\/td><td>User input reaches database queries<\/td><\/tr><tr><td>Cross-Site Scripting (XSS)<\/td><td>Attacker-controlled content reaches browsers<\/td><\/tr><tr><td>SSRF<\/td><td>User input influences outbound requests<\/td><\/tr><tr><td>Path Traversal<\/td><td>File paths escape intended directories<\/td><\/tr><tr><td>Command Injection<\/td><td>User input reaches operating system commands<\/td><\/tr><tr><td>Authentication Bypass<\/td><td>Security decisions fail unexpectedly<\/td><\/tr><tr><td>Deserialization Issues<\/td><td>Untrusted objects influence execution<\/td><\/tr><tr><td>Access Control Flaws<\/td><td>Users access resources they should not<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Learn why these vulnerabilities happen.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Do not focus only on payloads.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Payloads change.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Failure patterns remain.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Step 3: Build A Vulnerable Lab<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Research is learned through experimentation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Create intentionally vulnerable environments.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Examples include:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">OWASP Juice Shop<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Excellent for:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Authentication flaws<\/li>\n\n\n\n<li>XSS<\/li>\n\n\n\n<li>API abuse<\/li>\n\n\n\n<li>Business logic issues<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">DVWA<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Excellent for:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SQL Injection<\/li>\n\n\n\n<li>File Inclusion<\/li>\n\n\n\n<li>Command Injection<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Node.js Labs<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Build your own:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Express applications<\/li>\n\n\n\n<li>JWT authentication<\/li>\n\n\n\n<li>File uploads<\/li>\n\n\n\n<li>Database queries<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This approach teaches significantly more than reading writeups.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Step 4: Read Security Advisories Every Day<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Many researchers underestimate this step.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Public advisories are one of the best learning resources available.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Study:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>CVEs<\/li>\n\n\n\n<li>GitHub Security Advisories<\/li>\n\n\n\n<li>Project security releases<\/li>\n\n\n\n<li>Vendor advisories<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Ask:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>What failed?<\/li>\n\n\n\n<li>Why did it fail?<\/li>\n\n\n\n<li>What assumption was violated?<\/li>\n\n\n\n<li>How was it fixed?<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The patch is often more educational than the vulnerability itself.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Step 5: Learn To Read Source Code<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">The transition from beginner to researcher usually happens when source code becomes readable.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Start with:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Open source projects<\/li>\n\n\n\n<li>Security patches<\/li>\n\n\n\n<li>Pull requests<\/li>\n\n\n\n<li>Commit diffs<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Look for:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Missing validation<\/li>\n\n\n\n<li>Unsafe assumptions<\/li>\n\n\n\n<li>Dangerous trust transitions<\/li>\n\n\n\n<li>Authorization decisions<\/li>\n\n\n\n<li>User-controlled input<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Many vulnerabilities become obvious once you learn where to look.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Step 6: Follow Data Flow<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Modern vulnerability research often focuses on data movement.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Track:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Input \u2192 Processing \u2192 Decision \u2192 Sensitive Operation<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Example:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">User Input<br>\u2193<br>API Request<br>\u2193<br>Backend Logic<br>\u2193<br>Database Query<br>\u2193<br>Privilege Decision<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Researchers constantly ask:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&#8220;Can attacker-controlled data reach a sensitive operation?&#8221;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This mindset reveals vulnerabilities that scanners frequently miss.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Step 7: Study Real Vulnerabilities<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Avoid spending all your time on theoretical material.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Reproduce public vulnerabilities.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Examples:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Axios header leakage<\/li>\n\n\n\n<li>JWT key confusion<\/li>\n\n\n\n<li>Path traversal issues<\/li>\n\n\n\n<li>SSRF vulnerabilities<\/li>\n\n\n\n<li>Open redirect flaws<\/li>\n\n\n\n<li>Dependency supply chain attacks<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Build small proof-of-concepts.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Observe behavior directly.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Nothing accelerates learning faster.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Step 8: Learn Basic Reverse Engineering<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Eventually you will encounter software without source code.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Useful skills include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Reading assembly basics<\/li>\n\n\n\n<li>Using debuggers<\/li>\n\n\n\n<li>Understanding memory layout<\/li>\n\n\n\n<li>Following execution flow<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Useful tools:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ghidra<\/li>\n\n\n\n<li>IDA Free<\/li>\n\n\n\n<li>x64dbg<\/li>\n\n\n\n<li>GDB<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Do not rush into advanced exploit development immediately.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Focus first on understanding program behavior.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Step 9: Write Everything Down<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Professional researchers maintain notes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Document:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Observations<\/li>\n\n\n\n<li>Failed attempts<\/li>\n\n\n\n<li>Interesting code paths<\/li>\n\n\n\n<li>Security assumptions<\/li>\n\n\n\n<li>Potential attack paths<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Research quality often depends more on documentation than technical brilliance.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Many discoveries occur when connecting observations made weeks earlier.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Step 10: Publish Your Findings<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Publishing accelerates learning.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Write:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Research notes<\/li>\n\n\n\n<li>Technical blogs<\/li>\n\n\n\n<li>Vulnerability analyses<\/li>\n\n\n\n<li>Advisory summaries<\/li>\n\n\n\n<li>Proof-of-concept explanations<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Teaching forces clarity.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Clarity improves research.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Common Beginner Mistakes<\/h1>\n\n\n\n<h3 class=\"wp-block-heading\">Chasing Zero-Days Too Early<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Most researchers should spend months understanding existing vulnerabilities before searching for unknown ones.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Focusing Only On Tools<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Tools help.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Understanding creates discoveries.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Memorizing Payloads<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Payloads are not the research.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Understanding why they work is the research.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Ignoring Software Engineering<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Many great vulnerability researchers are excellent software engineers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The better you understand software construction, the better you understand software failure.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Recommended Learning Path<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Year 1:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>HTTP<\/li>\n\n\n\n<li>APIs<\/li>\n\n\n\n<li>Authentication<\/li>\n\n\n\n<li>OWASP Top 10<\/li>\n\n\n\n<li>JavaScript or Python<\/li>\n\n\n\n<li>Vulnerable labs<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Year 2:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Source code review<\/li>\n\n\n\n<li>Open-source research<\/li>\n\n\n\n<li>CVE analysis<\/li>\n\n\n\n<li>Static analysis<\/li>\n\n\n\n<li>Dynamic testing<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Year 3:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Protocol analysis<\/li>\n\n\n\n<li>Reverse engineering<\/li>\n\n\n\n<li>Binary research<\/li>\n\n\n\n<li>Exploit development<\/li>\n\n\n\n<li>Original vulnerability discovery<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Final Thoughts<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Vulnerability research is not about finding bugs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It is about understanding systems.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Researchers who focus exclusively on exploits often struggle to grow.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Researchers who focus on architecture, trust boundaries, software behavior, and data flow eventually discover vulnerabilities naturally.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The best researchers are not necessarily the best hackers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">They are often the people who understand how systems were designed, how they actually behave, and where those two realities diverge.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Understanding How Security Research Really Begins Many newcomers [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":310,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,1,13],"tags":[],"class_list":["post-308","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-pentesting","category-research"],"_links":{"self":[{"href":"https:\/\/fikresekhel.com\/blog\/wp-json\/wp\/v2\/posts\/308","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fikresekhel.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fikresekhel.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fikresekhel.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fikresekhel.com\/blog\/wp-json\/wp\/v2\/comments?post=308"}],"version-history":[{"count":1,"href":"https:\/\/fikresekhel.com\/blog\/wp-json\/wp\/v2\/posts\/308\/revisions"}],"predecessor-version":[{"id":311,"href":"https:\/\/fikresekhel.com\/blog\/wp-json\/wp\/v2\/posts\/308\/revisions\/311"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fikresekhel.com\/blog\/wp-json\/wp\/v2\/media\/310"}],"wp:attachment":[{"href":"https:\/\/fikresekhel.com\/blog\/wp-json\/wp\/v2\/media?parent=308"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fikresekhel.com\/blog\/wp-json\/wp\/v2\/categories?post=308"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fikresekhel.com\/blog\/wp-json\/wp\/v2\/tags?post=308"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}