Metasploit Toolkit for Penetration Testing, Exploit Development, and Vulnerability Research Review

Average Reviews:

(More customer reviews)I'm going to take a harsh stance on this book, mostly because this book had potential to really build upon all the information publicly available for Metasploit and really make a great book on Metasploit internals and advanced usage. Instead it seems like current public/free information was just rehashed and new information not updated for the 3.x branch of MSF.
What I consider the "meat" of this book, and what should have made this a 4 or 5 star book, covers the Metasploit Framework 2.x branch and NOT the current 3.x branch. By "meat" I mean the case studies covering exploitation using MSF. The major difference between the two is that 2.x was written in Perl and 3.x in Ruby. To be fair the first 5 chapters cover using MSF 3.x, but I really didn't feel they covered much, if anything, that's not out on the net with the exception of Chapter 5 (Adding new Payloads). "Using" Metasploit has been covered a million times in a million other books. A book specifically on Metasploit should have covered things not covered in every other hacking book.
Chapter 1 is an "Introduction to Metasploit." If you haven't ever used the tool and didn't want to RTFM, then "maybe" it would be useful for you. Most of the material I felt could be found on the Metasploit main support page, the wiki, or via google, but mostly the first two. I'm also not sure why there are pages and pages of current payloads and exploits with no explanations as to why I would use one type of payload versus another especially for the obscure ones like find tag or ordinal payloads. Doing a "show exploits" or "show payloads" without dialogue on the differences adds little value. The Leveraging Metasploit on Penetration Tests section is one paragraph :-(
Chapter 2 is "Architecture, Environment, and Installation." There are 2-3 pages on locking down a system. Why is that included? Very random. Let me cover the installation covered in the book for you. Windows, double click the executable. *nix, download via svn. That's about the level of detail we get...sigh :-(
Chapter 3 is a whopping 7 pages including the FAQ section on "Metasploit Framework and Advanced Environment Configurations." That chapter covers what is in the directories of your msf installation and using the setg command.
Chapter 4 is "Advanced Payload and Add-on Modules." Covers some old information on meterpreter and some meterpreter basics, the stuff on the net covers it in far more detail. Decent coverage of the VNC Inject payload, crappy coverage of the PassiveX payload, ok coverage of auxiliary modules and a mention of db autopwn.
Chapter 5 is "Adding New Payloads." Chapter 5 is the best chapter in the book because it discusses something...here it goes...NEW! and related to MSF 3.x. Chapter 5 is an excellent chapter walking us thru building a SIP Invite spoofer auxiliary module. Had the whole book been of this caliber it would have been a 5 star book.
The case studies should have been rewritten to work with MSF 3.x, they are all for 2.x. They are good and contain the required detail (but I didn't not work through all the examples yet) Things are similar between the branches and you can probably muddle through the conversions but it makes no sense for the first half of the book to be about 3.x and the meat to be about 2.x. At a minimum a chapter or section on converting exploits from 2.x to 3.x was in order, but was not included.
I didn't find Appendix B, "Building a Test Lab for Penetration Testing" to be all that helpful either. I think it's a reprint from Penetration Tester's Open Source Toolkit v2, but can't confirm because I don't have that book.


Click Here to see more reviews about: Metasploit Toolkit for Penetration Testing, Exploit Development, and Vulnerability Research

This is the first book available for the Metasploit Framework (MSF), which is the attack platform of choice for one of the fastest growing careers in IT security: Penetration Testing. The book and companion Web site will provide professional penetration testers and security researchers with a fully integrated suite of tools for discovering, running, and testing exploit code.This book discusses how to use the Metasploit Framework (MSF) as an exploitation platform. The book begins with a detailed discussion of the three MSF interfaces: msfweb, msfconsole, and msfcli .This chapter demonstrates all of the features offered by the MSF as an exploitation platform. With a solid understanding of MSF's capabilities, the book then details techniques for dramatically reducing the amount of time required for developing functional exploits.By working through a real-world vulnerabilities against popular closed source applications, the reader will learn how to use the tools and MSF to quickly build reliable attacks as standalone exploits. The section will also explain how to integrate an exploit directly into the Metasploit Framework by providing a line-by-line analysis of an integrated exploit module. Details as to how the Metasploit engine drives the behind-the-scenes exploitation process will be covered, and along the way the reader will come to understand the advantages of exploitation frameworks. The final section of the book examines the Meterpreter payload system and teaches readers to develop completely new extensions that will integrate fluidly with the Metasploit Framework. A November 2004 survey conducted by "CSO Magazine" stated that 42% of chief security officers considered penetration testing to be a security priority for their organizations The Metasploit Framework is the most popular open source exploit platform, and there are no competing books The book's companion Web site offers all of the working code and exploits contained within the book

Click here for more information about Metasploit Toolkit for Penetration Testing, Exploit Development, and Vulnerability Research

Read More...

Dissecting the Hack: The F0rb1dd3n Network Review

Average Reviews:

(More customer reviews)Let me get this out of the way: If books could be reviewed as "first effort" this would be a five/five. For a really ambitious book out of the gate it does a decent job of hitting tons of domains from multiple angles to inform, excite, and influence the thought processes of the reader.
To be even more honest had I thumbed through this book before buying it I would not have bought it. A lot of alarms can go off when you see pictures of vendor equipment, tables of network services, and a touch of conspiracy theory in places. Not that those things are inherently bad but it's only a 400 page tome so that's a lot of real estate to be worried about misusing. The authors use those pages as well as can be expected and in a way that even the most jaded readers should be able to ~respect~ if not always appreciate.
I'm not being hard on this book, trust me. It's now the third book, along with Silence on the Wire, and Anderson's Security Engineering, I expect all newer ITSec professionals to read early and often. I don't judge a non-textbook by the accuracy or timeliness of every statement. Or the quality of the story telling or case studied. I judge these types of books by their ability to affect ~thought processes~, ~perspective~, and ~risk analysis~... and I think this book is a winner on all three counts. It is all about influencing thought, not hand-feeding PRECISE EXACTING and ultimately useless step-by-step hacks.
Solid 4/4.5 star on any scale and a 5/5 for a new set of authors. I hope the editors and publisher give them the opportunity to add about 120/150 pages and build a community. One last note, the books and resources noted within this book are good stand-up lists and should not be overlooked either. The single paragraph stories from the web or people profiles are not to be skipped over.

Click Here to see more reviews about: Dissecting the Hack: The F0rb1dd3n Network


Dissecting the Hackis one heck of a ride! Hackers, IT professionals, and Infosec aficionados will find a gripping story that takes the reader on a global trip through the world of computer security exploits. One half massive case study, one half technical manual, Dissecting the Hack has it all - learn all about hacking tools and techniques and how to defend your network against threats.

Yes, the security threats are real - read more about the tactics that you see executed throughout the story in the second half of the book where you will learn to recon, scan, explore, exploit and expunge with the tools and techniques shown in the story. Every hack is real and can be used by you once you have the knowledge within this book!

Utilizes actual hacking and security tools in its story- helps to familiarize a newbie with the many devices and their code
Introduces basic hacking techniques in real life context for ease of learning
Presented in the words of the hacker/security pro, effortlessly envelops the beginner in the language of the hack

Click here for more information about Dissecting the Hack: The F0rb1dd3n Network

Read More...

Cyber Spying Tracking Your Family's (Sometimes) Secret Online Lives Review

Average Reviews:

(More customer reviews)This is not a book about security and defending yourself from spying but the basics of why one might consider spying on other members of their family. Whether because they suspect infidelity, criminal activity or some other concern there are a lot of reasons why people might want to find out what others are doing on their computer. A very important point made in the beginning of the book is the question of the ethics of spying including the effect it has on the trust of a relationship. The authors also point out that sometimes spying is much less of an ethical consideration. Sometimes it might be part of protecting your children from online predators or other real dangers.
The book covers the basics of spying including creating a plan, getting the right software or hardware to implement the plan and actual implementation. The authors do a good job of pointing out how we leave tracks behind and how to get rid of those tracks as well as how to exploit them.
Written for the novice user it starts at the very beginning with things like how to open the command prompt and running explorer. From there it goes on to look at more basic as well as intermediate level techniques. The authors even include information on some rather advanced software such as ethereal (one of my personal favorites). It does give you a solid understanding of what the different software is capable of doing but really doesn't provide a thorough treatment of any of them. In the case of Ethereal and Snort both have complete books written about how to use them effectively so obviously part of a chapter barely scratches the surface of what can be done.
For the most part it teaches the easier ways of finding out information without using difficult advanced tools. It includes how to access areas where passwords, usernames, etc. are stored as well as directories and files that do not show up in explorer unless you know how to hand-enter the path to them.
Whether you are spying on someone's web browsing, e-mail, internet chat, or instant messaging the basics are all here. They even include information on how to remove evidence of your activities and ways to tell if you are being watched.
These techniques are mainly for local network spying and not for use over the Internet. Although still subject to many ethical and other considerations, for the purpose of finding out what is going on within your local network Cyber Spying is highly recommended.

Click Here to see more reviews about: Cyber Spying Tracking Your Family's (Sometimes) Secret Online Lives

This book shows everyday computer users how to become cyber-sleuths. It takes readers through the many different issues involved in spying on someone online. It begins with an explanation of reasons and ethics, covers the psychology of spying, describes computer and network basics, and takes readers step-by-step through many common online activities, and shows what can be done to compromise them. The book's final section describes personal privacy and counter-spy techniques. By teaching by both theory and example this book empowers readers to take charge of their computers and feel confident they can be aware of the different online activities their families engage in.Expert authors have worked at Fortune 500 companies, NASA, CIA, NSA and all reside now at Sytex, one of the largest government providers of IT services. *Targets an area that is not addressed by other books: black hat techniques for computer security at the personal computer level. *Targets a wide audience: personal computer users, specifically those interested in the online activities of their families.

Click here for more information about Cyber Spying Tracking Your Family's (Sometimes) Secret Online Lives

Read More...

Kismet Hacking Review

Average Reviews:

(More customer reviews)My complaint. This book didn't even mention that they use Gentoo, sorta a major piece of info. This is kinda important if you need to recompile the kernel, which you do. And if you do..what optional software to have installed to make recompiling easier? That's all I can think of because I just set it down somewhere that it is likely to just collect dust. There were of course some information that would be great to know that was told. That information was that you had to do a recompile and a few other items necessary to install kismet.

Click Here to see more reviews about: Kismet Hacking

Kismet is the industry standard for examining wireless network traffic, and is used by over 250,000 security professionals, wireless networking enthusiasts, and WarDriving hobbyists.Unlike other wireless networking books that have been published in recent years that geared towards Windows users, Kismet Hacking is geared to those individuals that use the Linux operating system. People who use Linux and want to use wireless tools need to use Kismet. Now with the introduction of Kismet NewCore, they have a book that will answer all their questions about using this great tool. This book continues in the successful vein of books for wireless users such as WarDriving: Drive, Detect Defend.*Wardrive Running Kismet from the BackTrack Live CD*Build and Integrate Drones with your Kismet Server*Map Your Data with GPSMap, KisMap, WiGLE and GpsDrive

Click here for more information about Kismet Hacking

Read More...

Geek Mafia: Black Hat Blues (PM Fiction) Review

Average Reviews:

(More customer reviews)The book once again finds a group of grifters, now aided by a number of hackers, attempting to pull off their largest heist yet. It is obvious that Dakan acquired an incredible amount of research in preparing for this story. It is welcome but, like the previous two books, the 2nd act gets bogged down in character exposition. For stories who's draw is the techno-shenanigans this section ends up being tolerated to get to the payout at the end. The lack of a clear 'baddie' also hurts the title. And for those series fans hoping for more insight into the shadowy Isaiah and his intriguing anti-corporation? Sorry, the uber compelling heavy is nothing more than a set-prop here.
Yet, despite its short comings, Black Hat Blues still is a compelling read for the right audience. Dakan does justice to the complexities of hacking - there's no magical Hollywood interfaces here. The measures and counter-measures taken are believable. Actions have real consequences. Finally, Dakan does not shy away from breaking the team down and discarding intriguing characters along the way. While it would be incredibly tempting to magically have everything work out Black Hat Blues gives no quarter in this regard, and is better for it.
Like the previous two installments of Rick Dakan's Geek Mafia series, Black Hat Blues will either be an entertaining romp or a confusing jargon-fest. Black Hat Blues is a fun summer read for those who enjoy their entertainment in the vein of the "Ocean's 13" movies, BBC's "Hustle" television series, or even TNT's "Leverage" and/or USA's "Burn Notice" shows - albeit with glasses and a propeller cap. If you enjoy reading about cool geeks doing subversive things in clever ways you'll enjoy Black Hat Blues. If long passages on how a compromised computer network can lead to more complicated social engineering sounds tedious, you'll want to pass.


Click Here to see more reviews about: Geek Mafia: Black Hat Blues (PM Fiction)

A gripping story of con artists and activists, this story follows a crew of elite hackers, new recruits, anarchists, and impersonators as they attempt to take down their most challenging target to date-the U.S. Department of Homeland Security. Gathered under the cover of HackerCon in Washington DC-a place for security experts, penetration testers, and technology geeks to meet and discuss the latest hacks and exploits-this group of renegades plot their attack on the federal government for its objectionable security practices. Thought provoking and entertaining, this fast-paced adventure is based on years of research in the hacker community, addresses many contemporary social issues, and provides an overview of how hacking really works.

Click here for more information about Geek Mafia: Black Hat Blues (PM Fiction)

Read More...

Stealing the Network: How to Own a Shadow Review

Average Reviews:

(More customer reviews)Did you enjoy the previous three Stealing the Network books? Are you looking for more? Then move along now, nothing to see here.
The prior books were interesting because they introduced the reader to new ideas or new angles on old ideas, then moved on without belaboring them. If you wanted more details, there were often URLs provided. The last two tied the stories together with the intriguing Knuth character. But the folks running the project chose to switch to a new format, with fewer characters and stories, not to mention fewer authors, and fewer ways to split the profits.
After three books with the same (proven) formula, it's understandable the authors would want to try something new. Alas, it's a disaster.
Welcome to "How to Own a Shadow," aka "The SQL Injection Adventures of Pawn." Pawn is one of the new characters in this volume, and is the first StN character I hoped would get shot to death by the cops in a mini-mall parking lot. Yes, he's that irritating. Particularly after reading 40 pages about his childhood as a high-functioning autistic (or something like that), and around 100 pages of him performing SQL injection attacks. Most of which is totally unrelated to Knuth. Note to the authors: SQL injection is interesting, but if you want to write a book about it, just write a book about it. I even gave you a title, what more do you want? You can even recycle much of this book, like you recycled part of the last one here.
Oh, you noticed the real subtitle of the book, "The Chase for Knuth." First, one chases _after_ fugitives, and hunts or searches _for_ them. Not that it matters, because there's not much chasing or hunting going on in this book. There isn't much Knuth, either. We see him in the first hundred pages, which is mostly about his son analyzing poker software. That's the last we see of either of them. Because, really, this is "The Biography of Pawn." We do get 50 pages of Knuth at the end of the book, but don't get excited: it's all from the last book, added as obvious filler.
Speaking of filler, there's a 17 page advertorial thrown in for BiDiBLAH, which is commercial software by SensePost. Oddly enough, they're listed as technical advisors for the book. I'm sure it's a fine app, but the authors have forgotten about Knuth again, since it has nothing to do with the story. If it had been relevant, it might have been a less obnoxious addition.
Not everything is bad. There's a brief bit about RFID, which of course turns into how to use RFID for SQL attacks. We get to meet Knuth's supposedly dead wife, and a charming shrew she is. All in all, though, this book isn't worth reading unless you're a truly devoted fan of the series, or SQL. I'm still a fan of the previous books, and I hope the authors can recapture what made them so intriguing for their next book. I won't be buying that one until I'm sure it's not Book Two of the Pawn Saga, however.

Click Here to see more reviews about: Stealing the Network: How to Own a Shadow

The best-selling Stealing the Network series reaches its climactic conclusion as law enforcement and organized crime form a high-tech web in an attempt to bring down the shadowy hacker-villain known as Knuth in the most technically sophisticated Stealing book yet.Stealing the Network: How to Own a Shadow is the final book in Syngress' ground breaking, best-selling, Stealing the Network series. As with previous title, How to Own a Shadow is a fictional story that demonstrates accurate, highly detailed scenarios of computer intrusions and counter-strikes. In How to Own a Thief, Knuth, the master-mind, shadowy figure from previous books, is tracked across the world and the Web by cyber adversaries with skill to match his own. Readers will be amazed at how Knuth, Law Enforcement, and Organized crime twist and torque everything from game stations, printers and fax machines to service provider class switches and routers steal, deceive, and obfuscate. From physical security to open source information gathering, Stealing the Network: How to Own a Shadow will entertain and educate the reader on every page. The book's companion Web site will also provide special, behind-the-scenes details and hacks for the reader to join in the chase for Knuth. The final book in the Stealing the Network series will be a must read for the 50,000 readers worldwide of the first three titles The companion Web site to the book will provide challenging scenarios from the book to allow the reader to track down Knuth Law enforcement and security professionals will gain practical, technical knowledge for apprehending the most supplicated cyber-adversaries

Click here for more information about Stealing the Network: How to Own a Shadow

Read More...

Hacking Wireless Networks For Dummies (For Dummies (Computers)) Review

Average Reviews:

(More customer reviews)Think your wireless network is secure from unauthorized use or attack? It's probably not. I just finished reading Hacking Wireless Network For Dummies by Kevin Beaver and Peter T. Davis, and this is one of the most practical books I've ever read for testing a network against attack.
Contents:
Part 1 - Building the Foundation for Testing Wireless Networks: Introduction to Wireless Hacking; The Wireless Hacking Process; Implementing a Testing Methodology; Amassing Your War Chest
Part 2 - Getting Rolling with Common Wi-Fi Hacks: Human (in)Security; Containing the Airwaves; Hacking Wireless Clients; Discovering Default Settings; Wardriving
Part 3 - Advanced Wi-Fi Hacks: Still at War; Unauthorized Wireless Devices; Network Attacks; Denial-of-Service Attacks; Cracking Encryption; Authenticating Users
Part 4 - The Part of Tens: Ten Essential Tools for Hacking Wireless Networks; Ten Wireless Security-Testing Mistakes; Ten Tips for Following Up after Your Testing
Part 5 - Appendixes: Wireless Hacking Resources; Glossary of Acronyms
Index
The target of this book is the security professional involved in testing networks to make them more secure. There's a heavy emphasis on "ethical hacking", or learning how to test a network's security without doing harm or using the information in a destructive fashion. A security consultant using this book would learn how to pre-plan a test, work with the company to make sure they were properly authorized, and then write up the results in a professional manner. That aspect of the book is impressive, and it helps to frame the information in the right light (not as a textbook on how to break into networks).
From a practical standpoint, this book excels. Each of the chapters covers the theory behind how or why a certain aspect of a wireless network would be vulnerable to an attack or exploit. Then the authors cover a number of open source and commercial software packages that are available to focus on that area. For instance, chapter 14 goes into why WEP encryption is flawed and how it can be broken with relatively little effort. It's followed by an explanation on how WPA addresses some of those issues. Finally you get coverage on available tools that are used to crack WEP and how you can use them to test your own network.
Highly practical and heavy on application... If you're a security professional with responsibility for your organization's wireless network, you need to read this book. And if you're a techno-geek with your own wireless network, you'll want to get this book to play around. I know I will be doing a little hacking at Chez Duffbert...

Click Here to see more reviews about: Hacking Wireless Networks For Dummies (For Dummies (Computers))

Become a cyber-hero - know the common wireless weaknesses
"Reading a book like this one is a worthy endeavor toward becoming an experienced wireless security professional."--Devin Akin - CTO, The Certified Wireless Network Professional (CWNP) Program
Wireless networks are so convenient - not only for you, but also for those nefarious types who'd like to invade them. The only way to know if your system can be penetrated is to simulate an attack. This book shows you how, along with how to strengthen any weak spots you find in your network's armor.
Discover how to:
Perform ethical hacks without compromising a system
Combat denial of service and WEP attacks
Understand how invaders think
Recognize the effects of different hacks
Protect against war drivers and rogue devices

Click here for more information about Hacking Wireless Networks For Dummies (For Dummies (Computers))

Read More...

Steal This Computer Book 4.0: What They Won't Tell You about the Internet Review

Average Reviews:

(More customer reviews)Overall this is a good book. The first part is sorta stupid, though. It talks mainly about how not to only listen to one person but to get information from multiple sources. It could be summed up in about a page.
Chapter 4 talks about buying computers and software. It helped me out by giving me some tricks to do next time I buy a computer.
Chapter 5 tells you about keeping your files secure with encryption. It tells you about some different types of encryption algorithms and how to write your own encryption programs. It also shows you how to play some dirty tricks. It talked about using anonymous remailers to send anonymous email and talked about just how anonymous they were. It even told you how to surf the web anonymously so that people couldn't receive information about your computer, browser, and more.
Chapter 6 told about phone phreaking history such as captian crunch. Wallace then goes on by telling you possibly things that could've happened but didn't. When telling these stories he tries to make himself sound like a phreaker but he didn't even do anything. Then, he tells your some really obvious stuff like "To start phone phreaking, you need access to a telephone." and "phreaking from your own phone will let the telephone company trace it to your house." I don't know if he couldn't think of anything else or he thinks you are really stupid. After that, he talks about phreaking color boxes and then goes on to voice mail hacking. Then, he talks about cellular phone fraud and tv satellite descrambling.
Chapter 7 talks about defeating windoz 3.1/95/98 screen saver passwords which if you ever tried you should've done it on the first or second try. It also talks about cracking program passwords and then it goes on to defeating parental control software. If you can't access certain web pages, Wallace tells you how by having the html code emailed to you. He also shows you how to read banned books in secret.
Chapter 8 talks about harassing online services, how pedophiles stalk innocent children and what you can do to stop them. He tells you about generating fake credit card numbers and making your own online harassment program.
Chapter 9 talks about stopping spam. It shows you multiply ways to take revenge on spammers. If the spammer used a forged email address, Wallace shows you how to track down the spammer like two magnets attracting each other.
Chapter 10 shows some pictures of acctual hacked web sites and how to hack them.
Chapter 11 shows you how to track people down by using specific things about them. For example if you only had their SSC# how you could still find them no matter where they were. At the end of the chapter, he shows you how to hide yourself if you don't want to be tracked down or how to let someone easily find you if, for example, you gave your child up for adoption years ago and you don't want to contact him/her but you do want to let them find you if they ever wanted you.
Chapter 12 shows you about ConGames on the Internet. It shows you how to do them and how to protect yourself from them.
Chapter 13 Viruses Part I. ( I heard that the plural form of virus is exposed to be virii, just like the plural form or fungus is fungi but in the book it is written viruses so that's how I will spell it.)
This chapter expains what viruses are, the parts of them, how to tell if you have a virus on your computer, the different infection methods, if all viruses are bad and how to learn more about them.
Chapter 14 Viruses Part II.
This chapter shows the different methods of how an antivirus program works and what to do if you find a virus ( If you say any idiot knows that if you find one you should delete it, but you could also send it in to an antivirus program if you think it is a uncommon virus, keep a copy of it, modify the virus and make a new one and many other things.)
Chapter 15 tells you about writing your own computer virus. Wallace also tells you to watch out because viruses sometimes attack their own creators. He tells you some true things about antivirus companies like how they hire virus writers to help them detect viruses (makes sense, doesn't it) and how that their isn't any evidence of this, but that they may hire the virus writers to write a virus that only they have the antidote for so people will buy their program to detect it.
Chapter 16 is about Java applets. I haven't read all of it but so far so good.
Appendice A is the glossary with a decent amount of terms covered in the book. I really haven't used it too much because I never needed to.
Appendice B is Visual Basic 3.0 ( a very easy programming language that I suggest you learn ) source code for altering Mega$hack. A program he discusses in 12. ( it is used by cons but he alters it so they get a taste of their own medicine.) The source code is written on the page so you will have to type it into your Visual Basic Compiler.
Appendice C is about additional resources. It is compiled of online magazines, webpages, hacker conventions and more.
Summary: This book is for you if you are interested in the above things. The websites and newsgroups in the book lead to nothing except for a few like metacrawler that he obviously was paid to advertise for. If you are still unsure after unreading all the reviews, go to a local bookstore and see if they have this book there. If they do then look at it, see if you like it and if so, compare the prices of Amazon plus the shipping and time to the prices of the bookstore. I hope that this review helped you because I know what it is like to have one person rate it 5 stars and another person rate it 1 star. Sinse this is a pain, I figured that instead of giving my opinion, I would tell you what the book had in it.

Click Here to see more reviews about: Steal This Computer Book 4.0: What They Won't Tell You about the Internet

Click here for more information about Steal This Computer Book 4.0: What They Won't Tell You about the Internet

Read More...

Build Your Own Security Lab: A Field Guide for Network Testing Review

Average Reviews:

(More customer reviews)I'll be completely honest. I went through this in about two hours, and I plan on returning it. It simply didn't have anything new for me. I was expecting it to be more along the lines of setting up a virtual network, attempting to hack the VMs, and then checking the procedures to see if you did it right.
Instead, this book covers things like how to install OSes into VMs, gives basic overviews of tools, etc. However, this is a great book if you're at the appropriate level for it. I think this makes a good follow-up to CompTIA's Security+ certification. It'll help novices get their feet wet with actual hands-on activities. I've done nearly everything in this book on my own, and that's really the only problem with it. While I didn't pay a great deal of attention to every bit of text, it seemed to be technically accurate and free from errors.
I wish I could give a more detailed review, but I thought I'd at least post this since no one has reviewed it yet. Just take your skill level into account when considering this title. If you want more advanced books, check out the Hacking Exposed series, Grey Hat Hacking, and the Penetration Tester's Open Source Toolkit.

Click Here to see more reviews about: Build Your Own Security Lab: A Field Guide for Network Testing

If your job is to design or implement IT security solutions or if you're studying for any security certification, this is the how-to guide you've been looking for. Here's how to assess your needs, gather the tools, and create a controlled environment in which you can experiment, test, and develop the solutions that work. With liberal examples from real-world scenarios, it tells you exactly how to implement a strategy to secure your systems now and in the future.
Note: CD-ROM/DVD and other supplementary materials are not included as part of eBook file.

Click here for more information about Build Your Own Security Lab: A Field Guide for Network Testing

Read More...

Chained Exploits: Advanced Hacking Attacks from Start to Finish Review

Average Reviews:

(More customer reviews)I looked forward to Chained Exploits (CE) by Whitaker, Evans and Voth with much anticipation as the concept is a much needed addition to the lexicon on information security. Often academic fields are severely limited by the vocabulary available to discuss issues and the "chained exploit" is sure to become a mainstay in the discourse of information security. Despite my enthusiasm for the concept, however, I was disappointed by the material presented in CE. The genius of the chained exploit is that it upends the traditional threat matrix, typically presented as:
[value of resource] x [likelihood of exploit] = [risk level]
For example, a high value resource that is unlikely to be exploited should be ranked as a low risk, as should a low value resource that is likely to be exploited. Think of this in terms of a temporary database of publically available information used to populate a user demonstration website that is wiped out every 24 hours. If that information is compromised it has no value, so even if the compromise is likely it is a low risk system. Conversely if a system that contains critical financial information is confined to a single workstation that is removed from any networking and housed in a guarded facility it too is a low risk system (since the likelihood of compromise is low).
Unfortunately many auditors make risk assessments based on circumstances in a vacuum. This is where the concept of "chained exploits" becomes so valuable. For instance, if a vulnerability were discovered in a local binary accessible to users that allows privilege escalation, but the local binary exists on a system that has no users (other than administrators who already have root privileges) it is often considered a low risk. Many times patches for these sorts of vulnerabilities are not installed because the patch could introduce instability and would not be considered worthy of the expense given the low risk. Similarly a vulnerability could be discovered in a web service that when exploited could allow a remote attacker to gain an unprivileged local account that, say, only had access to read and write to the /tmp directory. This could also be considered a low risk since such limited access wouldn't present any threat to the system. However, if you "chained exploits" for the two vulnerabilities you suddenly have a condition where a remote attacker can gain a local account and elevate their privilege! This contravenes the low risk ranking of the individual vulnerabilities. When combined they suddenly become a very high risk to the system.
It was this sort of "chain" that I hoped CE would explore. Instead the material presented in the book consisted of context to several high risk vulnerabilities to explain why they might be used in tandem. For instance, the book would propose a scenario where a remote attacker installed a backdoor rootkit on a corporate network workstation then used that workstation to access the central database using default system administrator credentials. Each of the conditions used in these "chains" are extremely high risk already, and thus the book doesn't present any new material for seasoned information security professionals to consider.
For a novice this book is a great resource. It is full of the sorts of horror stories that professionals are all too familiar with, but could potentially be eye opening for a neophyte or someone unfamiliar with computer security. At the very least it is a page turning exploration of very real and often under appreciated risks to enterprises.
I was disappointed that the book didn't raise the level of discourse in the information security field but I suspect that wasn't the point of Chained Exploits. Instead it reads like a greatest hits sequence prepared by veteran penetration testers. It makes for interesting reading, but it isn't particularly informative. Don't look for any new 0 day exploits (or even a discussion of how to find such flaws). Instead the book contains a litany of well known routes to system compromise and illustrative narratives that tie them together in real world scenarios.

Click Here to see more reviews about: Chained Exploits: Advanced Hacking Attacks from Start to Finish

The complete guide to today's hard-to-defend chained attacks: performing them and preventing themNowadays, it's rare for malicious hackers to rely on just one exploit or tool; instead, they use "chained" exploits that integrate multiple forms of attack to achieve their goals. Chained exploits are far more complex and far more difficult to defend. Few security or hacking books cover them well and most don't cover them at all. Now there's a book that brings together start-to-finish information about today's most widespread chained exploits–both how to perform them and how to prevent them. Chained Exploits demonstrates this advanced hacking attack technique through detailed examples that reflect real-world attack strategies, use today's most common attack tools, and focus on actual high-value targets, including credit card and healthcare data. Relentlessly thorough and realistic, this book covers the full spectrum of attack avenues, from wireless networks to physical access and social engineering. Writing for security, network, and other IT professionals, the authors take you through each attack, one step at a time, and then introduce today's most effective countermeasures— both technical and human. Coverage includes:Constructing convincing new phishing attacksDiscovering which sites other Web users are visitingWreaking havoc on IT security via wireless networksDisrupting competitors' Web sitesPerforming–and preventing–corporate espionageDestroying secure filesGaining access to private healthcare recordsAttacking the viewers of social networking pagesCreating entirely new exploitsand moreAndrew Whitaker, Director of Enterprise InfoSec and Networking for Training Camp, has been featured in The Wall Street Journal and BusinessWeek. He coauthored Penetration Testing and Network Defense. Andrew was a winner of EC Council's Instructor of Excellence Award.Keatron Evans is President and Chief Security Consultant of Blink Digital Security, LLC, a trainer for Training Camp, and winner of EC Council's Instructor of Excellence Award. Jack B. Voth specializes in penetration testing, vulnerability assessment, and perimeter security. He co-owns The Client Server, Inc., and teaches for Training Camp throughout the United States and abroad.informit.com/awCover photograph © Corbis /Jupiter Images$49.99 US $59.99 CANADA

Click here for more information about Chained Exploits: Advanced Hacking Attacks from Start to Finish

Read More...

Stealing the Network: The Complete Series Collector's Edition, Final Chapter, and DVD Review

Average Reviews:

(More customer reviews)I have just finished a marathon session of reading "Stealing the Network: The Complete Series Collector's Edition" and I have a very conditional review of it: It's a must-have if you don't already own the previous editions of these guilty pleasures. If you are already a fan, however, prepare to be let-down by the compilation.
The stories of the Stealing the Network series entertain in the same way that "war stories" from fellow hackers and security professionals often keeps a more intimate audience's interest: by mixing intriguing situations with juicy technical detail that can serve as a useful take-away. No one will accuse these books of containing fine literature, but that's not really the point. The stories are well written enough to keep you wanting to know what will happen next, while the technical information is as accurate as you're likely to see in fiction. Segments involving hacking are written and illustrated with enough attention to detail and length to serve as introductory educational tutorials for the topics (including web application hacking, reverse engineering, and wireless security). Most of these scenarios are believable as parts of larger-scale operations.
The first book of the series consists of independent short-stories based around characters of the authors' creation. The other three books in the compilation tell an over-arching story of a larger "operation", which involves many characters and their independent stories. The second book, "How to Own a Continent", is probably my favorite, along with the first ("How to Own a Box"), for keeping things simple, technical, and focusing on the individual stories. The third book, "How to Own an Identity" suffers from having worse editing then the rest of the series, and may lose some readers' interest. The fourth book ("How to Own a Shadow") reads a lot better, and wraps the overall story up well, however it focuses only on a relative handful of the series' characters.
As a compilation, this Collector's Edition leaves much to be desired. While the original description for this edition described the books contained within as being "author-annotated", this is not the case. The individual books are reproduced exactly as they were in their original editions, with no additional commentary from the authors, and with all the same problems as the originals. For example, screenshots in the first chapter of the first book are the same illegible black squares that were in the original edition of the book published 7 years ago. The annotations along with other features described in the original description (emails, photographs) that would provide a lot of interesting background material, would have made this compilation a must-buy.
The extra content that you are receiving is a brief new forward by Jeff Moss, and a "Final Chapter" by Ryan Russell. The new chapter is about 20 pages long, and gives the story-line a proper ending. I won't ruin anything about it, but I will say that I enjoyed it. Syngress has promised in the description of the book to make this content available separately in electronic form in six months.
The included DVD is described on the back-cover copy as being "full" of behind-the-scenes stories. In reality, you will only find 20 minutes of interviews with a few of the authors. I enjoyed these interviews, however, much like the print companion, I felt like more should have been done. Also beware that there are problems with the audio on the DVD. When played on my MacBook, there was noticeable crackling/popping in the audio of the DVD. The same noise was present, but less noticeable when played through a stand-alone DVD player through a television.
To summarize, I like the books, and find them as entertaining as I did when they were originally published, and I like the new hardcover binding. I do think that it is unfortunate that the "Stealing the Network: The Complete Series Collector's Edition" does not meet its potential to be more than the sum of its parts. There seems to have been intent at some point to add value to the set, but it wound up simply being a rough concatenation of the individual books.
If you haven't read these books, then I very much recommend picking up this set. It's 1,000 pages of interesting stories and technical material. If you already have the previous editions of the Stealing the Network Series, however, you might find it hard to justify paying for them again.

Click Here to see more reviews about: Stealing the Network: The Complete Series Collector's Edition, Final Chapter, and DVD


"Stealing the Network: How to Own the Box is a unique book in the fiction department. It combines stories that are fictional, with technology that is real. While none of the stories have happened, there is no reason why they could not. You could argue it provides a road map for criminal hackers, but I say it does something else: it provides a glimpse into the creative minds of some of today's best hackers, and even the best hackers will tell you that the game is a mental one." - from the Foreword to the first Stealing the Network book, How to Own the Box, Jeff Moss, Founder & Director, Black Hat, Inc. and Founder of DEFCON

For the very first time the complete Stealing the Network epic is available in an enormous, over 1000 page volume complete with the final chapter of the saga and a DVD filled with behind the scenes video footage!

These groundbreaking books created a fictional world of hacker superheroes and villains based on real world technology, tools, and tactics. It is almost as if the authors peered into the future as many of the techniques and scenarios in these books have come to pass.

This book contains all of the material from each of the four books in the Stealing the Network series.

All of the stories and tech from:


How to Own the Box

How to Own a Continent

How to Own an Identity

How to Own a Shadow

Plus:


Finally - find out how the story ends! The final chapter is here!

A DVD full of behind the scenes stories and insider info about the making of these cult classics!
* Now for the first time the entire series is one 1000+ page book* The DVD contains 20 minutes of behind the scenes footage* Readers will finally learn the fate of "Knuth" in the much anticipated Final Chapter

Click here for more information about Stealing the Network: The Complete Series Collector's Edition, Final Chapter, and DVD

Read More...

Hacking Exposed: Network Security Secrets and Solutions, Sixth Edition Review

Average Reviews:

(More customer reviews)Hardly a week goes by that CNN does not report a high-profile Web site being defiled or an e-commerce site being penetrated. While most people know why these incidents occurred, Hacking Exposed explains how they occurred and, more important, how to prevent them from occurring.
The cover of Hacking Exposed announces that "Network security is Y2K without the deadline." That alarmist statement, however, is the only hype in the book. The work is packed with real-world examples and links to tools needed to assess the security of any type of client/server and Web system. As they detail the myriad vulnerabilities in different types of systems, the authors provide countermeasures for each of them.
Well organized, the book progresses in an orderly fashion. It methodically goes through the process of exploiting a target to penetrate a system--from identification and enumeration to actual penetration. The authors provide detailed instructions and explanations for many security features and flaws in Unix, Linux, Windows, NetWare, routers, firewalls, and more. Topics covered include state-of-the-art computer and network penetration, as viewed by both the attacker and the defender; remote system identification; vulnerability identification; war dialers; firewall circumvention; and denial-of-service attacks. An appendix explores the security characteristics of Windows 2000.
Some may argue that books such as this one only serve to motivate and educate hackers. The truth is that hackers are already aware of the book's contents. This book is designed for system administrators and managers who need to know their systems' risks and vulnerabilities and how to address them. When they are done with this book, system administrators and managers will be familiar with such critical topics as back channels, port redirection, banner grabbing, and buffer overflows. Hacking Exposed is a must-read for anyone who wants to know what is really happening on their network....

Click Here to see more reviews about: Hacking Exposed: Network Security Secrets and Solutions, Sixth Edition

Click here for more information about Hacking Exposed: Network Security Secrets and Solutions, Sixth Edition

Read More...

XSS Attacks: Cross Site Scripting Exploits and Defense Review

Average Reviews:

(More customer reviews)XSS Attacks earns 4 stars for being the first book devoted to Cross Site Scripting and for rounding up multiple experts on the topic. The authors are synonymous with attacking Web applications and regularly share their vast expertise via their blogs and tools. However, XSS Attacks suffers the same problems found whenever Syngress rushes a book to print -- nonexistent editing and uneven content. I found XSS Attacks to be highly enlightening, but I expect a few other books on the topic arriving later this year could be better.
First, as Tadaka mentioned, ch 3 is the best written part of the book. In fact, the author of ch 3 should have written the entire book. There is a difference between an author of a tool, an author of a blog, and an author of a book. The author of ch 3 clearly knows how to make a clear argument over the course of a long stretch of pages (over 90) and carry the reader. Lucky for non-book-buyers, Syngress posted ch 3 for free on their Web site. You'll get a great foundation on XSS, and learn about CSRF and backdooring Flash and Quicktime.
In terms of readability, ch 2 wasn't bad. I liked trying out various Firefox extensions and the author's examples were good. I think ch 1 should be completely dropped. It mentions terms not defined until ch 2. The language is exceptionally rough, indicating zero editing was done. The DNS pinning examples in ch 5 were confusing; it doesn't help novice readers to discuss [...] and then use [...]. (I think that's an error.) I really didn't get as much from the book past ch 3 as I did from ch 3.
The major take-away from XSS Attacks is that one should never trust clients. Furthermore, far too many vulnerable capabilities exist in applications most people would never dream of fearing, like those that render .pdf or .swf. I really liked the point that browsers constantly interpret and "fix" broken HTML, sometimes to the detriment of the security world. I also liked reading how users can be duped by attacks against the integrity of data, such as adding or removing details of Web sites.
Right now, if you want to learn more about recent XSS attacks in printed form, this book is your main option. Last year I favorably reviewed Lance James' book, Phishing Exposed, which includes some of these techniques. Later this year one of the other book reviewers, Dafydd Stuttard, should be publishing The Web Application Hackers Handbook: Discovering and Exploiting Security Flaws. Syngress claims to be publishing Web Application Vulnerabilities: Detect, Exploit, Prevent by Steven Palmer in the fall. Hacking Exposed Web 2.0 by Himanshu Dwivedi is another option, but I find his security books to be poorly written. I highly recommend visiting the authors' blogs, since they cover a lot of the information in XSS Attacks.

Click Here to see more reviews about: XSS Attacks: Cross Site Scripting Exploits and Defense

Cross Site Scripting Attacks starts by defining the terms and laying out the ground work. It assumes that the reader is familiar with basic web programming (HTML) and JavaScript. First it discusses the concepts, methodology, and technology that makes XSS a valid concern. It then moves into the various types of XSS attacks, how they are implemented, used, and abused. After XSS is thoroughly explored, the next part provides examples of XSS malware and demonstrates real cases where XSS is a dangerous risk that exposes internet users to remote access, sensitive data theft, and monetary losses. Finally, the book closes by examining the ways developers can avoid XSS vulnerabilities in their web applications, and how users can avoid becoming a victim. The audience is web developers, security practitioners, and managers.*XSS Vulnerabilities exist in 8 out of 10 Web sites*The authors of this book are the undisputed industry leading authorities*Contains independent, bleeding edge research, code listings and exploits that can not be found anywhere else

Click here for more information about XSS Attacks: Cross Site Scripting Exploits and Defense

Read More...

Google Hacking for Penetration Testers Review

Average Reviews:

(More customer reviews)This review mainly focuses on evaluating how valuable is to get a copy of "Google Hacking for Penetration Testers - VOLUME 2" if you already own a copy of the first edition, and the scores rates exactly that. If you don't have neither of them, I strongly encourage you to acquire Volume 2 (see details below), no matter what area of the information security field you work in (and specially if you are a penetration tester), as the contents affect to you in multiple ways. On my day-to-day security consulting practice, I'm still very surprised about how many IT people don't know about these techniques. The book is a masterpiece for information disclosure and mining from public sources, such as (but not only) Google. If I had to evaluate the book on itself, not comparing between editions, it would definitely get a score of 5/5.
The first edition was released in 2005 and opened the world of the Google Hacking techniques to the general public, together with the GHDB. The second edition title is (at least) confusing, as Volume 2 seems to denote it is a complementary book to the first edition. It is not, so I do not recommend you to get the first edition today. Volume 2, or the second edition as it should have been called, has been thoroughly updated (including most of the screenshots) to cover the latest changes and Google applications. I did a major update to the SANS "Power Search with Google" course on the first half of 2006, when some of the new Google functionality (not in the first edition) was already available. The second edition reflects those updates I identified and put back together then, even the tiny ones, such as the maximum search terms, that changed from 10 to 32. Additionally, all the statistical references, covering number of results returned by Google, and main contents have been reviewed and updated to reflect the current state of the art.
Some chapters have been kept from the previous edition (chapters 1 to 3, and chapters 6 to 9, and chapter 12), although they have suffered updates. Others have been moved (such as the old chapter 10, now chapter 4) or redesigned (like the new chapter 5). Besides, there are brand new chapters, like 10 and 11.
I specially like the updates on chapter 5, with the new tools and scripts to query Google and, specially, to parse and process the results, including several Perl and User-Agent tricks. The book, obviously, covers the Google API changes and provides solutions to overcome them, such as Aura. Chapters 6 and 8 include relevant updates to the Google code search engine and new capabilities to locate malware and binaries, plus new techniques to track down login portals and network embedded devices and reports, respectively.
The new chapter 10 is a great reference covering the new Google services from a hacking and "malicious" perspective. It is a required update given the pace Google releases new functionality and information sources, such as the AJAX capabilities and API, the source code search engine, calendar, blogger, and alert services.
The new chapter 11, "Google Hacking Showcase", includes the real-world Google Hacking samples and cases Johnny Long has been presenting in several hacking conferences during the last years. A found having a printed copy of it within the book very valuable, as it is an eye-opener, and it is a fun read. Definitely, if you have not seen Johnny's presentations and talks, I encourage you to access the archives from BlackHat and DefCon and enjoy them.
Finally, chapter 12 (the old chapter 11), covers new techniques and tools from a defensive perspective. The new additions increase the defender arsenal in order to mitigate the old and new threats covered throughout the book.
The influence of multiple authors in this edition is evident, something good for the new contents and material, but not so good for the chapter layout, as some do not follow the original format with a final summary, solutions, links and FAQ. Chapter 10 is a good example of both.
The complementary appendixes from the first edition, not directly relevant to the book topic from my perspective, have been removed. Overall, I feel some of the waffle has been left out, a smart decision (but not always easy) in order to keep the book size reasonable, and make room for the new contents.
I would like to see some of the pages that simply provide long listings from the GHDB moved to an appendix and simply referenced from the associated chapter. It might be useful to have these lists full of query samples on the book, but not just in the middle of a chapter. Another improvement would be to have a book webpage consolidating all the code samples, such as the Blogger submission script, as I'm not sure they are all available on a single website.
To sum up, if you don't have a copy of this book, go and buy Volume 2! (not to mention Johnny's involvement with charities). If you are a professional penetration tester, the new material in this second edition is highly recommended, so update your shelves and start applying the new contents on your daily practice. If you are an infosec pro, not directly involved in Google Hacking tasks, and you already own a copy of the first edition, I think you do not need Volume 2, as you already understand the threat, risks, and what is all this about.
At some point I was almost involved in co-authoring this 2nd edition, but finally it didn't happened. A pity, as definitely, this is one of today's reference books that should be on any infosec shelves.

Click Here to see more reviews about: Google Hacking for Penetration Testers

A self-respecting Google hacker spends hours trolling the Internet for juicy stuff. Firing off search after search, they thrive on the thrill of finding clean, mean, streamlined queries and get a real rush from sharing those queries and trading screenshots of their findings. I know because I've seen it with my own eyes. As the founder of the Google Hacking Database (GHDB) and the Search engine hacking forums at http://johnny.ihackstuff.com, I am constantly amazed at what the Google hacking community comes up with. It turns out the rumors are true-creative Google searches can reveal medical, financial, proprietary and even classified information. Despite government edicts, regulation and protection acts like HIPPA and the constant barking of security watchdogs, this problem still persists. Stuff still makes it out onto the web, and Google hackers snatch it right up. Protect yourself from Google hackers with this new volume of information.-Johnny Long.Learn Google Searching BasicsExplore Google's Web-based Interface, build Google queries, and work with Google URLs..Use Advanced Operators to Perform Advanced QueriesCombine advanced operators and learn about colliding operators and bad search-fu..Learn the Ways of the Google HackerSee how to use caches for anonymity and review directory listings and traversal techniques..Review Document Grinding and Database DiggingSee the ways to use Google to locate documents and then search within the documents to locate information. .Understand Google's Part in an Information Collection FrameworkLearn the principles of automating searches and the applications of data mining..Locate Exploits and Finding TargetsLocate exploit code and then vulnerable targets..See Ten Simple Security SearchesLearn a few searches that give good results just about every time and are good for a security assessment..Track Down Web ServersLocate and profile web servers, login portals, network hardware and utilities..See How Bad Guys Troll for DataFind ways to search for usernames, passwords, credit card numbers, social security numbers, and other juicy information..Hack Google ServicesLearn more about the AJAX Search API, Calendar, Blogger, Blog Search, and more.

Click here for more information about Google Hacking for Penetration Testers

Read More...

Hacking Exposed Web 2.0: Web 2.0 Security Secrets and Solutions Review

Average Reviews:

(More customer reviews)I'm still in the middle of the book, and I definitely will skim thru all the remaining pages (just because I paid for it), but I wouldn't recommend the book to anyone looking for serious and in-depth study on web security - the book just doesn't offer that. What it does is a list of possible attack vectors and sometimes offers "solutions" which can help to fight with the attacks. However, the attacks descriptions are shallow, solutions are very short and non-extensive and many of them go as far as telling a user to install NoScript extension for Firefox (huh? Web 2.0 doesn't work with no JavaScript).
There are also quadrillions of links to a security-related site (won't list it here) which offers a toolbar to checks your sites again the most common security problems. I don't have anything against links to useful tools of course, but THAT amount of links just makes this book look like an advertisement of the fore-mentioned site. Am not even talking about page space wasted to re-iterate "go to ...., install ...., click .... in order to test for ....." which usually take 0.5-1 pages. Users who read that sort of books can somehow figure out how to use a toolbar, I believe.
I'm not by any means a security expert, and this book did introduce me into the topic, but it didn't do anything beyond that. I still need to read some other book on the topic, and that book will probably contain the same info as the Hacking Web 2.0 Exposed (i.e. the very basic info on web expoits), so.. I actually just recommend to pass on this book at all, and look for something which covers the topic in greater depth.

Click Here to see more reviews about: Hacking Exposed Web 2.0: Web 2.0 Security Secrets and Solutions


Lock down next-generation Web services

"This book concisely identifies the types of attacks which are faced daily by Web 2.0 sites, and the authors give solid, practical advice on how to identify and mitigate these threats." --Max Kelly, CISSP, CIPP, CFCE, Senior Director of Security, Facebook

Protect your Web 2.0 architecture against the latest wave of cybercrime using expert tactics from Internet security professionals. Hacking Exposed Web 2.0 shows how hackers perform reconnaissance, choose their entry point, and attack Web 2.0-based services, and reveals detailed countermeasures and defense techniques. You'll learn how to avoid injection and buffer overflow attacks, fix browser and plug-in flaws, and secure AJAX, Flash, and XML-driven applications. Real-world case studies illustrate social networking site weaknesses, cross-site attack methods, migration vulnerabilities, and IE7 shortcomings.

Plug security holes in Web 2.0 implementations the proven Hacking Exposed way
Learn how hackers target and abuse vulnerable Web 2.0 applications, browsers, plug-ins, online databases, user inputs, and HTML forms
Prevent Web 2.0-based SQL, XPath, XQuery, LDAP, and command injection attacks
Circumvent XXE, directory traversal, and buffer overflow exploits
Learn XSS and Cross-Site Request Forgery methods attackers use to bypass browser security controls
Fix vulnerabilities in Outlook Express and Acrobat Reader add-ons
Use input validators and XML classes to reinforce ASP and .NET security
Eliminate unintentional exposures in ASP.NET AJAX (Atlas), Direct Web Remoting, Sajax, and GWT Web applications
Mitigate ActiveX security exposures using SiteLock, code signing, and secure controls
Find and fix Adobe Flash vulnerabilities and DNS rebinding attacks

Click here for more information about Hacking Exposed Web 2.0: Web 2.0 Security Secrets and Solutions

Read More...

1337 h4x0r h4ndb00k Review

Average Reviews:

(More customer reviews)No, this isn't a malfunctioning keyboard, nor have I decided to join the ranks of kiddie hackers by starting to use "elite" language. It's the title of a new book by Sams... l337 h4xor handbook by tapeworm. For those of you not into "l337", that translates to "Elite Hacker Handbook". Having gotten *that* piece of information out of the way, I can get on to the review. And my review is that I really don't know what group this author is trying to target, and I think it fails regardless...
Content: fitting in; shortcuts; customize; browsing/e-mail; fundamentals; get the f@*! out of my chat room!; advanced automation; paranoia; networks; beyond windows; conclusion
I wanted to like this book based on the title. Sort of a gritty view of the hacker underworld, revealing "secrets" not commonly written of. What we get instead is a book that can't decide what it wants to be. People who are new to computers or confused by jargon (one of the targets from the back cover) won't see much useable info here. If you're new to computers, the whole "elite" form of typing and word creation will be lost on you, and you'll wonder what the (#@# this person is trying to tell you. If you already know enough to understand the type of style the author is trying to use, then you'll find most of the information far too basic. Desktop overviews? Running defragger? This isn't news, folks...
Parts of the book try to go into basic HTML coding and scripting languages. Again, if you don't know this stuff, this book isn't going to appeal to you in the first place. If the book appeals to you, you already know this stuff. "Advanced Automation" gets into more scripting, but again, not at a level which is going to advance the knowledge base of someone who already understands it. It seemed that with every chapter, the content was at odds with the style and tone of the book, thereby missing the target regardless of what side he chose...
The whole "l337" format really started to annoy me big time after the first chapter. I admit to not having much tolerance for that anyway. There were some cute phrases and humorous lines in places, but not enough to make me want to recommend it to anyone. I can't even recommend it as a parody of hacker culture, because I think the author is really trying to convey useful info. I just don't think the audience that would find it useful would read the book, and those who would read the book won't find it useful.

Click Here to see more reviews about: 1337 h4x0r h4ndb00k


This is your ticket into the elusive underworld of the Internet, home to millions of elite computer hackers. 1337 h4x0r h4ndb00k will show you how to walk-the-walk and talk-the-talk of this exclusive community. Soon, you too will be able to go into a chat room and carry on conversations speaking the cryptic 1337 language. 1337 h4x0r h4ndb00k will also review the nature of computer viruses, different practical jokes to play on your desktop and tips on how to live the hacker lifestyle. Join the elite society of computer hackers with 1337 h4x0r h4ndb00k as your guide.

Click here for more information about 1337 h4x0r h4ndb00k

Read More...

Steal This Computer Book 3: What They Won't Tell You about the Internet Review

Average Reviews:

(More customer reviews)I orderd this book after seeing the "stunning" reviews it recieved on this site. I'm sorry to say that I am very disappointed. I got it yesterday morning and was real eager to get into it, but within an hour I just stopped reading. Why?
Dont get me wrong this isnt a bad book per-se and its just that it has its audience and i'm not part of it. This is for people\parents\employers\new users to the internet who want to know more about its dark underbelly.

If you know or understand phrases like- firewalls, sniffers, back-doors, loggers, scanners, spam, idtheft, filters, Airsnort, dumpster-diving, social-engineering, shoulder surfing and so on....- then dont even pick this book up. I'm no computer security guru but i'd say a couple of days surfing the net and you'll soon have the bones of this book.
If on the other hand, you're new to the net, you're worried about you kids safety while on the net, who's using your computer, what they're doing, what other could be doing to you, or just need a quick jumpstart into the darker side of the net then maybe (and only just maybe!!) you should consider this book.
Its like one reviewer said, its for the ordinary guy, but if you've done any bit of work in IT then a lot of it will seem like fluff. So I've left it for now but am not gonna throw it out, its something i'll read when i got time and also there looks to be some interesting sections that I'm gonna look through.
It still gets 2 stars though; one because its well organsied and written in a very easy to understand language, not too technical which is definately a plus if you're new to the net and all thing computers, and two beacuse theres a lot of good links to related software and sites that can help you understand more. Think of it as a good reference\starting point.
Peronally i'd say save you're money and read "computer espoinage, counter measures and tactics" if you want more intersting read.

Click Here to see more reviews about: Steal This Computer Book 3: What They Won't Tell You about the Internet


This offbeat, non-technical book looks at what hackers do, how they do it, and how you can protect yourself. The third edition of this bestseller (over 150,000 copies sold) adopts the same informative, irreverent, and entertaining style that made the first two editions a huge success. Thoroughly updated, this edition also covers rootkits, spyware, web bugs, identity theft, hacktivism, wireless hacking (wardriving), biometrics, and firewalls.

Click here for more information about Steal This Computer Book 3: What They Won't Tell You about the Internet

Read More...