Black Hat Rust (Sylvain Kerkour) (Z-Library)

【One-Line Pitch】 A hands-on offensive security book that teaches you to build real hacking tools—from SHA-1 crackers to RATs and phishing kits—using Rust, blending language fundamentals with practical attack techniques for security professionals and Rust developers alike. 【Book Arc】 - **Opening (~0%–10%)**: The author's personal journey from law student to hacker, inspired by classic exploitation books, sets the tone. Early chapters introduce Rust's core concepts—ownership, borrowing, and the ecosystem—framed through the lens of building your first offensive tool: a SHA-1 password cracker. - **Early (~10%–23%)**: Focus shifts to practical Rust development patterns: avoiding lifetime annotations, using `cargo fmt` and `clippy` for code quality, and managing dependencies. The narrative then moves to concurrency—first with threads (including common borrow-checker errors), then async/await with Tokio, covering channels, mutexes, and the critical rule of never blocking the event loop. - **Early-to-Middle (~23%–39%)**: The book builds a vulnerability scanner ("tricoder") using traits, generics, and static dispatch (monomorphization). You learn to write modular HTTP checks for misconfigurations like GitLab open registration, git file disclosure, and `.DS_Store` leaks, with proper testing practices including async tests. - **Middle (~39%–48%)**: A deep dive into building a web crawler for security research—scraping CVE databases and dynamic JavaScript-heavy sites using headless browsers. This section transitions into vulnerability theory: distinguishing CVEs from CWEs, understanding 0-days vs. public exploits, and exploring attack classes like stored XSS and memory vulnerabilities (integer overflows, buffer issues). - **Late (~48%–100%)**: The final stretch covers advanced offensive tooling: reverse TCP shellcode, phishing with WebAssembly (including social engineering and email sending in Rust), and building a modern RAT (Remote Access Trojan) with Docker, binary size optimization, and distribution strategies. The book closes with end-to-end encryption for securing communications, covering the CIA triad and threat modeling. 【Key Takeaways】 - **Rust's memory safety is your offensive advantage** (Early): By staying in safe Rust, you're immune to entire classes of memory vulnerabilities that plague C/C++ tools—a key selling point for building reliable hacking software. - **Async/await is essential for I/O-bound scanners** (Early): Threads waste memory and context-switch overhead on network-heavy tasks; Tokio's async model with channels (`oneshot`, `mpsc`, `broadcast`, `watch`) and `Arc<Mutex<T>>` provides far better performance. The golden rule: never block the event loop—use `spawn_blocking` for anything over 10–100 microseconds. - **Traits and generics enable modular security tools** (Early): Using trait objects and static dispatch (monomorphization), you can build extensible scanners where each vulnerability check is a separate module—like the "tricoder" scanner for GitLab misconfigurations and file disclosures. - **Testing should follow specifications, not implementation** (Early): When writing tests for vulnerability detection (e.g., `.DS_Store` magic bytes), write them from the file format spec, not your own code—this catches bugs in your detection logic. - **Understanding vulnerability taxonomy is crucial** (Middle): CVEs are specific instances, CWEs are patterns; not all vulnerabilities get public IDs. Exploits are "weaponized" bugs requiring deep knowledge of the target technology—XSS exploits need JavaScript expertise, for example. - **Memory vulnerabilities still plague dynamic languages** (Middle): Even Python and Ruby are vulnerable indirectly through C/C++ dependencies. Integer overflows (like the `uint32` buffer allocation example) can lead to zero-size allocations and subsequent buffer overflows. - **Modern offensive tools need modern delivery** (Late): Building a RAT involves designing both server and agent components, optimizing binary size for stealth, using Docker for reproducible environments, and considering distribution methods—all while implementing end-to-end encryption for C2 communications. 【Reading Tips】 - **Skim the Rust fundamentals if you're experienced** (Early): Chapters on ownership, lifetimes, and borrow-checker errors are valuable for beginners but can be skimmed by seasoned Rust developers—focus instead on the security-specific code patterns. - **Deep-read the async and concurrency sections** (Early): The Tokio patterns (channels, mutexes, `spawn_blocking`) are foundational for every later tool you build. Understanding "colored functions" (blocking vs. async) is critical. - **Follow the "tricoder" scanner project closely** (Early-to-Middle): This is the book's core project—it teaches modular design, trait-based extensibility, and realistic testing. The GitLab and file-disclosure modules are excellent templates for your own checks. - **Pay attention to the vulnerability taxonomy chapter** (Middle): The CVE/CWE/0-day distinctions and the XSS/memory vulnerability examples provide the theoretical grounding you'll need for the advanced tools later. This is where "black hat" thinking crystallizes. - **For the advanced chapters (Late), focus on architecture, not every line**: The RAT and phishing sections are complex; understand the server/agent design, binary optimization strategies, and encryption choices rather than memorizing every code snippet. 【Coverage Limits】 This guide covers the book's progression from Rust fundamentals through offensive tooling, but the excerpts do not include detailed code for the reverse TCP shellcode, full phishing implementation, or the complete RAT codebase—those sections are summarized at a high level.