I'm guessing this comes under software/application hacking. For exploiting applications and software you can take one of three approaches, use static code analysis - work your way through the code for the program looking for vulnerabilities or possible vulnerable code such as strcpy() in c++, fuzzing - can be quick depending on the amount of input the application takes and the amount of data you are allowing the fuzzer to send. Good fuzzers include sulley framework and spike. There's many more in the /pentest/fuzzers/ (i believe) directory in backtrack. The other option is a half-assed shit technique, you can have a look around the vulnerability databases and look at a specific software, then see what vulns people have found and then look for similar or using different commands. If one vuln's exists more will often follow.

The other thing you can do is to look for POC's (Proof of Concept's) and then design/write a fully working exploit for that POC.

Mr. P-teo, you can also check out my video series that I originally made just for iexploit. I cover a lot of ground in pretty good detail (including fuzzing, and privilege escalation). Feel free to check it out: www.youtube.com/user/sinschild07

The videos should also be somewhere on the forum still. I'll have a look around and post back the links if I find them.

One way to find vulnerabilities... The Bash Shell... Using pre-packaged commands such as "gdb" or "nm"; you can find out a lot about compiled programs. As well as figure out ways to exploit them... It might not be a bad idea to learn as much as possible about the Bash shell; of course every shell has it's advantages, but Bash is the most widely used. C, Korn, TC, and of course Bourne; most of these are already supported in most linux and unix distributions...