How do amateur security engineers learn to find new exploits to produce CVEs?
Saw a similar post on reddit but it didn't have many responses. I'm also very interested in the subject.
Considering one already has experience in security. E.g. Bachelors/Masters level courses, practical bug bounties, CTF and can use metasploit. These all teach the users how to use tools, or to find pre-existing/known attacks and vulnerabilities.
How does one jump from this to finding new/undiscovered vulnerabilities in applications, operating systems that could be made into actual CVEs?
Does anyone have experience in this?
For example, how do those in Google Project Zero perform such finds?
Considering one already has experience in security. E.g. Bachelors/Masters level courses, practical bug bounties, CTF and can use metasploit. These all teach the users how to use tools, or to find pre-existing/known attacks and vulnerabilities.
How does one jump from this to finding new/undiscovered vulnerabilities in applications, operating systems that could be made into actual CVEs?
Does anyone have experience in this?
For example, how do those in Google Project Zero perform such finds?
Thanks.