…For anyone who would like to replicate this success, know the following: 1. The Web Application Hacker's Handbook is your friend. It's outdated but it's still the best foundation. Follow it up with The Browser Hacker's Handbook or The Mobile Application Hacker's Handbook. 2. You can optimize for exotic vulnerabilities in Google, Facebook et al which pay the highest bounties or you can optimize for low hanging fruit in companies…
Kyle Simpson 写的《你不知道的JavaScript》（You Don't Know JS）。其 PDF 版本是 GitHub 上 star 最多的仓库之一：https://github.com/getify/You-Dont-Know-JS 另外针对你的问题，我认为《Browser Hacker's Handbook》和《Web Application Hacker's Handbook》在帮助理解浏览器工作原理方面也极具价值。可惜关于这个主题的文档并不是很完备。去 Mozilla 网站上浏览一下 API 列表……
You Don't Know JS by Kyle Simpson. The PDFs are one of the most starred repos on GitHub: https://github.com/getify/You-Dont-Know-JS Also more to your question, "The Browser Hacker's Handbook" and "The Web Application Hacker's Handbook" I also think are really helpful in understanding how browsers work. Sadly a not better documented subject. Visiting the list of APIs on Mozilla's website…
在 Web 安全领域：- 《The Tangled Web》（http://lcamtuf.coredump.cx/tangled/）。你可以去看看《Web Application Hacker's Handbook》或者《Browser Hacker's Handbook》，如果你想看的话。但 TTW 绝对能把它们全虐成渣。
In Web Security: - The Tangled Web (http://lcamtuf.coredump.cx/tangled/) You can look at the Web Application Hacker's Handbook or the Browser Hacker's Handbook, if you want. But TTW tops them all.
……任何想复制这种成功的人，请记住以下几点：1. 《Web Application Hacker's Handbook》是你的好帮手。虽然内容有点老了，但它依然是最好的打底教材。看完之后可以接着看《Browser Hacker's Handbook》或《Mobile Application Hacker's Handbook》。2. 你既可以专门去抓 Google、Facebook 等大厂那些奖金最高的高难度罕见漏洞，也可以专门去抓那些普通公司容易捡漏的低垂果实（low hanging fruit）……
…For anyone who would like to replicate this success, know the following: 1. The Web Application Hacker's Handbook is your friend. It's outdated but it's still the best foundation. Follow it up with The Browser Hacker's Handbook or The Mobile Application Hacker's Handbook. 2. You can optimize for exotic vulnerabilities in Google, Facebook et al which pay the highest bounties or you can optimize for low hanging fruit in companies…
Kyle Simpson 写的《你不知道的JavaScript》（You Don't Know JS）。其 PDF 版本是 GitHub 上 star 最多的仓库之一：https://github.com/getify/You-Dont-Know-JS 另外针对你的问题，我认为《Browser Hacker's Handbook》和《Web Application Hacker's Handbook》在帮助理解浏览器工作原理方面也极具价值。可惜关于这个主题的文档并不是很完备。去 Mozilla 网站上浏览一下 API 列表……
You Don't Know JS by Kyle Simpson. The PDFs are one of the most starred repos on GitHub: https://github.com/getify/You-Dont-Know-JS Also more to your question, "The Browser Hacker's Handbook" and "The Web Application Hacker's Handbook" I also think are really helpful in understanding how browsers work. Sadly a not better documented subject. Visiting the list of APIs on Mozilla's website…
在 Web 安全领域：- 《The Tangled Web》（http://lcamtuf.coredump.cx/tangled/）。你可以去看看《Web Application Hacker's Handbook》或者《Browser Hacker's Handbook》，如果你想看的话。但 TTW 绝对能把它们全虐成渣。
In Web Security: - The Tangled Web (http://lcamtuf.coredump.cx/tangled/) You can look at the Web Application Hacker's Handbook or the Browser Hacker's Handbook, if you want. But TTW tops them all.