https://www.reddit.com/r/ExploitDev/comments/7zdrzc/exploit_development_learning_roadmap/

Exploit Development is hard, learning how to do it is going to require a lot of study, practice and a good understanding of a fairly wide range of associated subjects. The good news is that you don't have to learn everything at once, or overnight, and that there are a lot of people who have done or are on the same painful journey - some of whom write blogs like corelan security or fuzzy security.

The generally recommended approach for a beginner is to start at the beginning, the late 90's style simple stack based buffer overflows popularised by Aleph One's "Smashing the stack for fun and profit", and then to gradually work on introducing and defeating progressively more modern mitigations, new exploitation vectors and architectures. As you do this and practise against real world exploits you start to pick up some of the ancillary knowledge from your own research, and don't forget to make notes, you might find it helps to keep a blog, or post walkthroughs of your exploits here

Exactly what skill level you need to be at before starting to learn about binary exploitation is always going to be something that causes some people concerns. Are you ready yet? The answer is generally yes and no, you learn more by starting today and failing than any amount of procrastination, but at the same time every time you learn something new you discover two things that you don't understand. Hacking is terrible for this, the more I learn the more I feel like a complete newbie. The only thing for it is to try; the worst case is that you discover that you need to learn some other stuff first, and it never hurts to read a book.

Resources:

Recommended Subjects:

An understanding of C / C++

Memory and CPU concepts such as memory addressing, registers and stacks

A scripting language such as Python, Perl, Ruby or Bash

Fluency in your chosen OS, and at least a basic understanding of whichever debugger you're using

The question of platforms to use as your victims is mostly a personal choice, some people like to learn Windows exploitation first and then move to Linux, whereas some (like myself) prefer to start with Linux exploitation before moving to Windows. In my opinion there are more and better resources for learning the basics on Linux but the choice really is yours.

Resources:

Some of the concepts involved in learning how to do this kind of simple exploitation will be quite alien to a novice, but with some time spent hands on with a debugger you should start to get an understanding of some of the things you're going to need to read up about

Resources:

Format string exploits are a good next step after simple buffer overflows because they share a great many similarities, but also give you an opportunity to play around with arbitrary memory manipulations. Format strings also shows you some of the weirdness that can result in exploitable situations

3: Return to LibC - Defeating Non-Executable Stacks (aka DEP, W^X, NX)

Resources:

[Exploit Exercises Protostar: Stack level 6](Exploit Exercises Protostar: Stack level 6](https://exploit.education/protostar/stack-six/)