Metasploit Toolkit for Penetration Testing, Exploit Development, and Vulnerability Research Review

Average Reviews:

(More customer reviews)I'm going to take a harsh stance on this book, mostly because this book had potential to really build upon all the information publicly available for Metasploit and really make a great book on Metasploit internals and advanced usage. Instead it seems like current public/free information was just rehashed and new information not updated for the 3.x branch of MSF.
What I consider the "meat" of this book, and what should have made this a 4 or 5 star book, covers the Metasploit Framework 2.x branch and NOT the current 3.x branch. By "meat" I mean the case studies covering exploitation using MSF. The major difference between the two is that 2.x was written in Perl and 3.x in Ruby. To be fair the first 5 chapters cover using MSF 3.x, but I really didn't feel they covered much, if anything, that's not out on the net with the exception of Chapter 5 (Adding new Payloads). "Using" Metasploit has been covered a million times in a million other books. A book specifically on Metasploit should have covered things not covered in every other hacking book.
Chapter 1 is an "Introduction to Metasploit." If you haven't ever used the tool and didn't want to RTFM, then "maybe" it would be useful for you. Most of the material I felt could be found on the Metasploit main support page, the wiki, or via google, but mostly the first two. I'm also not sure why there are pages and pages of current payloads and exploits with no explanations as to why I would use one type of payload versus another especially for the obscure ones like find tag or ordinal payloads. Doing a "show exploits" or "show payloads" without dialogue on the differences adds little value. The Leveraging Metasploit on Penetration Tests section is one paragraph :-(
Chapter 2 is "Architecture, Environment, and Installation." There are 2-3 pages on locking down a system. Why is that included? Very random. Let me cover the installation covered in the book for you. Windows, double click the executable. *nix, download via svn. That's about the level of detail we get...sigh :-(
Chapter 3 is a whopping 7 pages including the FAQ section on "Metasploit Framework and Advanced Environment Configurations." That chapter covers what is in the directories of your msf installation and using the setg command.
Chapter 4 is "Advanced Payload and Add-on Modules." Covers some old information on meterpreter and some meterpreter basics, the stuff on the net covers it in far more detail. Decent coverage of the VNC Inject payload, crappy coverage of the PassiveX payload, ok coverage of auxiliary modules and a mention of db autopwn.
Chapter 5 is "Adding New Payloads." Chapter 5 is the best chapter in the book because it discusses something...here it goes...NEW! and related to MSF 3.x. Chapter 5 is an excellent chapter walking us thru building a SIP Invite spoofer auxiliary module. Had the whole book been of this caliber it would have been a 5 star book.
The case studies should have been rewritten to work with MSF 3.x, they are all for 2.x. They are good and contain the required detail (but I didn't not work through all the examples yet) Things are similar between the branches and you can probably muddle through the conversions but it makes no sense for the first half of the book to be about 3.x and the meat to be about 2.x. At a minimum a chapter or section on converting exploits from 2.x to 3.x was in order, but was not included.
I didn't find Appendix B, "Building a Test Lab for Penetration Testing" to be all that helpful either. I think it's a reprint from Penetration Tester's Open Source Toolkit v2, but can't confirm because I don't have that book.


Click Here to see more reviews about: Metasploit Toolkit for Penetration Testing, Exploit Development, and Vulnerability Research

This is the first book available for the Metasploit Framework (MSF), which is the attack platform of choice for one of the fastest growing careers in IT security: Penetration Testing. The book and companion Web site will provide professional penetration testers and security researchers with a fully integrated suite of tools for discovering, running, and testing exploit code.This book discusses how to use the Metasploit Framework (MSF) as an exploitation platform. The book begins with a detailed discussion of the three MSF interfaces: msfweb, msfconsole, and msfcli .This chapter demonstrates all of the features offered by the MSF as an exploitation platform. With a solid understanding of MSF's capabilities, the book then details techniques for dramatically reducing the amount of time required for developing functional exploits.By working through a real-world vulnerabilities against popular closed source applications, the reader will learn how to use the tools and MSF to quickly build reliable attacks as standalone exploits. The section will also explain how to integrate an exploit directly into the Metasploit Framework by providing a line-by-line analysis of an integrated exploit module. Details as to how the Metasploit engine drives the behind-the-scenes exploitation process will be covered, and along the way the reader will come to understand the advantages of exploitation frameworks. The final section of the book examines the Meterpreter payload system and teaches readers to develop completely new extensions that will integrate fluidly with the Metasploit Framework. A November 2004 survey conducted by "CSO Magazine" stated that 42% of chief security officers considered penetration testing to be a security priority for their organizations The Metasploit Framework is the most popular open source exploit platform, and there are no competing books The book's companion Web site offers all of the working code and exploits contained within the book

Click here for more information about Metasploit Toolkit for Penetration Testing, Exploit Development, and Vulnerability Research

Read More...

Dissecting the Hack: The F0rb1dd3n Network Review

Average Reviews:

(More customer reviews)Let me get this out of the way: If books could be reviewed as "first effort" this would be a five/five. For a really ambitious book out of the gate it does a decent job of hitting tons of domains from multiple angles to inform, excite, and influence the thought processes of the reader.
To be even more honest had I thumbed through this book before buying it I would not have bought it. A lot of alarms can go off when you see pictures of vendor equipment, tables of network services, and a touch of conspiracy theory in places. Not that those things are inherently bad but it's only a 400 page tome so that's a lot of real estate to be worried about misusing. The authors use those pages as well as can be expected and in a way that even the most jaded readers should be able to ~respect~ if not always appreciate.
I'm not being hard on this book, trust me. It's now the third book, along with Silence on the Wire, and Anderson's Security Engineering, I expect all newer ITSec professionals to read early and often. I don't judge a non-textbook by the accuracy or timeliness of every statement. Or the quality of the story telling or case studied. I judge these types of books by their ability to affect ~thought processes~, ~perspective~, and ~risk analysis~... and I think this book is a winner on all three counts. It is all about influencing thought, not hand-feeding PRECISE EXACTING and ultimately useless step-by-step hacks.
Solid 4/4.5 star on any scale and a 5/5 for a new set of authors. I hope the editors and publisher give them the opportunity to add about 120/150 pages and build a community. One last note, the books and resources noted within this book are good stand-up lists and should not be overlooked either. The single paragraph stories from the web or people profiles are not to be skipped over.

Click Here to see more reviews about: Dissecting the Hack: The F0rb1dd3n Network


Dissecting the Hackis one heck of a ride! Hackers, IT professionals, and Infosec aficionados will find a gripping story that takes the reader on a global trip through the world of computer security exploits. One half massive case study, one half technical manual, Dissecting the Hack has it all - learn all about hacking tools and techniques and how to defend your network against threats.

Yes, the security threats are real - read more about the tactics that you see executed throughout the story in the second half of the book where you will learn to recon, scan, explore, exploit and expunge with the tools and techniques shown in the story. Every hack is real and can be used by you once you have the knowledge within this book!

Utilizes actual hacking and security tools in its story- helps to familiarize a newbie with the many devices and their code
Introduces basic hacking techniques in real life context for ease of learning
Presented in the words of the hacker/security pro, effortlessly envelops the beginner in the language of the hack

Click here for more information about Dissecting the Hack: The F0rb1dd3n Network

Read More...

The Spy in the Coffee Machine Review

Average Reviews:

(More customer reviews)I found this in a charity shop and wondered how it ended up there. I mean, it was only published last year, came from a reputable academic press and discussed something that's particularly important to our lives today.
Then I read it.
There's not anything wrong with this book per se. As an overview of privacy and of the possible ramifications of technology on our privacy, it's fine. But it seems to never really become much more than an overview.
The authors are unquestionably knowledgeable about the subject of privacy, and about how communication and browsing behaviour on the Internet affect personal (and community) privacy - but it seems that they are hamstrung by the book's attempt to appeal to as wide an audience as possible. The chapters on case-studies of other nations' handling of the Net seem particularly light-on, in my view.
There's some interesting thoughts provoked by this book; the exploration of Moore's Law and the ramifications on personal surveillance, and the possible ways of ensuring government transparency on surveillance are discussion-starters. But on the whole, the book left me feeling a little unsatisfied.
That said, I suppose this is a rapidly moving area; perhaps this work would be better served in an online, easily-updated format? It's funny - something printed last year can already seem out of date, so quickly are privacy and censorship debates moving.

Click Here to see more reviews about: The Spy in the Coffee Machine

What do you know about the new surveillance state that has been created in the wake of pervasive computing - the increasing use of very small and simple computers in all sorts of host - from your computer to your coat? Well, these little computers can communicate via the web and form powerful networks whose emergent behaviour can be very complex, intelligent, and invasive. The question is: how much of an infringement on privacy are they?

Click here for more information about The Spy in the Coffee Machine

Read More...

UNIX and Linux Forensic Analysis DVD Toolkit Review

Average Reviews:

(More customer reviews)The title may mislead readers to believe that this book discusses actual forensics of Unix and Linux systems. It does not. The authors waste precious pages in this short book discussing their favorite cool Linux apps like Nessus and Metasploit but don't have any meaningful discussion about the various flavors of Unix: AIX, Solaris, *BSD, etc. Their "Unix and Linux" forensic book is almost entirely about Linux. There is no thoughtful discussion about filesystem forensics; no technical detail helpful to Forensic Examiners.
The few moments where the authors approach a meaningful forensic topic, the reader is redirected to an online resource rather than provided an analysis or explanation within the book.
The book title may lead readers to believe that an accompanying DVD contains a Unix forensic toolkit of some kind. In fact, there is only 1.8 MB of documents and no tools save for a few (4) short Bash scripts that hardly cover a thorough forensics examination: live or otherwise. One of the scripts is only one line. One of these documents is an incomplete 3.5 page summary of Sleuthkit tools. By "incomplete" I mean that it is apparent that the author decided to quit writing. Apparently there was no room in this 236 page, 14-gauge font book to cover in any detail the different Unix filesystems, data acquisition, data carving or static filesystem analysis. But the authors make plenty of room to discuss scanning with Unix tools (nmap, nessus, etc.).
There is a section entitled "Malware" except that no malware sample is actually examined. The reader is briefly introduced to Panda's AV scanner and is walked through how to use ClamAV as if that is the only AV scanner available for either a Unix user or Forensic Examiner. Forensic Examiners should pay very close attention to AntiVirus product comparative reviews.
The book cover boasts that this is the "only digital forensic analysis book for *nix". Indeed there may be little in the way of books solely dedicated to Unix forensics but other books cover Unix forensics with greater detail than this one. For example, Brian Carrier's "Filesystem Forensic Analysis" or Jones, Bejtlich and Rose's "Real Digital Forensics".
The book cover also boasts that readers can "Hit the ground running" with the information within. Unfortunately, if readers expect the content to help them bridge a gap between Windows and Unix, they will hit the ground with a resounding thud. If any Forensics Examiner finds value in the content of this book for actual Unix forensic investigations, I would question that examiner's experience and training.
If the authors wanted to write a book about cool Linux tools or network scanning, they should have entitled the book differently. Perhaps "A Beginner's Guide to Using Linux and Linux Security Applications".
I felt the title was misleading and false advertising. The authors take advantage of the word "Forensics" to sell a book that is not about forensics. For $53.95 I expected much more and was extremely disappointed and disgusted at the inferiority of the content.

Click Here to see more reviews about: UNIX and Linux Forensic Analysis DVD Toolkit

This book addresses topics in the area of forensic analysis of systems running on variants of the UNIX operating system, which is the choice of hackers for their attack platforms. According to a 2007 IDC report, UNIX servers account for the second-largest segment of spending (behind Windows) in the worldwide server market with $4.2 billion in 2Q07, representing 31.7% of corporate server spending. UNIX systems have not been analyzed to any significant depth largely due to a lack of understanding on the part of the investigator, an understanding and knowledge base that has been achieved by the attacker. The companion DVD provides a simulated or "live" UNIX environment where readers can test the skills they've learned in the book and use custom tools developed by the authors.The book begins with a chapter to describe why and how the book was written, and for whom, and then immediately begins addressing the issues of live response (volatile) data collection and analysis.The book continues by addressing issues of collecting and analyzing the contents of physical memory (i.e., RAM).The following chapters address /proc analysis, revealing the wealth of significant evidence, and analysis of files created by or on UNIX systems.Then the book addresses the underground world of UNIX hacking and reveals methods and techniques used by hackers, malware coders, and anti-forensic developers.The book then illustrates to the investigator how to analyze these files and extract the information they need to perform a comprehensive forensic analysis.The final chapter includes a detailed discussion of Loadable Kernel Modules and Malware. The companion DVD provides a simulated or "live" UNIX environment where readers can test the skills they've learned in the book and use custom tools developed by the authors.Throughout the book the author provides a wealth of unique information, providing tools, techniques and information that won't be found anywhere else.Not only are the tools provided, but the author also provides sample files so that after completing a detailed walk-through, the reader can immediately practice the new-found skills.* The companion DVD for the book contains significant, unique materials (movies, spreadsheet, code, etc.) not available any place else.* This book contains information about UNIX forensic analysis that is not available anywhere else. Much of the information is a result of the author's own unique research and work.* The authors have the combined experience of Law Enforcement, Military, and Corporate forensics. This unique perspective makes this book attractive to ALL forensic investigators.

Click here for more information about UNIX and Linux Forensic Analysis DVD Toolkit

Read More...

Snort 2.1 Intrusion Detection, Second Edition Review

Average Reviews:

(More customer reviews)Syngress published "Snort 2.0" in Mar 03, and I gave it a four star review in Jul 03. Excerpts from that review appear on the back cover and first page of "Snort 2.1," published only 14 months later. I still think "Snort 2.1" is overall the best Snort book available, but I was disappointed by signs of rushed production and lack of coverage of key Snort features.
The table of contents for "Snort 2.1" is deceiving, as it is almost exactly the same as "Snort 2.0." However, the new book is almost 200 pages larger than its predecessor, with many internal modifications. Chapters 1, 2, 3, 4, 9, 11, 12 and 13 are either completely new or substantially new. Chapters 5, 6, 7, 8, and 10 are either partial rewrites or have some material added or dropped. Despite all of this work, "Snort 2.1" fails to spend time on key subjects, which I will mention during a chapter-by-chapter examination of the book.
First, I recommend skipping ch 1. Aside from some general IDS advice, it is haphazard and contributes nothing to the core Snort discussion. Ch 2 is a quick overview of Snort capabilities, and should have been the lead chapter. Ch 3 describes Snort installation, but suffers apparently swapped figures (3.1 and 3.2) and a wrong figure (3.5). Ch 3 is still a nice upgrade from its counterpart in "Snort 2.0," which gave hints for deploying Snort on Red Hat Linux 8.0. The new ch 3 covers Linux, OpenBSD, and Windows.
Ch 4, "Inner Workings," is one of the reasons "Snort 2.1" has an advantage over the competition. It's tough to go wrong when Snort's developers describe the tool's operation. Still, signs of rough editing appear on p. 170 and 191, and the "-a cmg" switch should be "-A cmg".
Ch 5 covers rules, and is a big disappointment. For most users, rules are the primary means to customize Snort. Like "Snort 2.0," ch 5 fails to help readers with some of the more important new Snort rule options, like byte_test, byte_jump, distance, and within (available since 2.0.rc1 in Mar 03). Ch 5 implies on p. 145 that running Snort with -v is a good idea, despite every other recommendation in the book that verbose mode is a performance killer. Also, the IP "sec" option mentioned on p. 205 is not "IPSec" -- see RFC 791. Overall, ch 5 spends too much time restating rule information found in Snort's manual, and not enough time on features available even in Snort 2.0.
Ch 6's discussion of preprocessors is a solid chapter, with new material on Snort's flow module, http_inspect, and perfmonitor. The telnet preprocessor section is one of the better examples of a "code walkthrough," where the author shows code while explaining what it does.
Ch 7 is really showing its age. "Snort 2.0" was behind the times when it said "Unified logs are the future of Snort reporting," and "Snort 2.1" makes the same mistake. Barnyard, a means to read unified logs, was available in Sep 01! Ch 7 also misses the boat on XML output, calling it "our favorite and relatively new logging format" on p. 322. The XML plug-in spo_xml wasn't even part of snort-2.0.0, never mind snort-2.1.0. Basic research would have revealed Joe McAlerney's announcement of Silicon Defense's snort-idmef XML plug-in in Jun 01, followed by Sandro Poppi's assumption of the project in Aug 03. A mention of Barnyard's "XML formatting capabilities" appears in ch 7 on p. 322, yet Barnyard does not offer this natively.
I was happy to see Sguil addressed in ch 8, but sad to see Sguil's use of session and full content data not appreciated for its true worth. Ch 9 does a good job describing Oinkmaster and gives sound advice on avoiding the "not any" rule negation problem. Ch 10 covers really old testing tools like Sneeze, whose stateless operation cannot fool stream4's stateful inspection.
Ch 11, explaining Barnyard, is clearly the book's shining moment. This is the reason I read "Snort 2.1": Barnyard's author, Andrew Baker, describes Barnyard's history, the format of unified logs, and how best to use his contribution to Snort. Bravo. Ch 12 was also very good, using case studies to compare three different "active response" choices. Ch 13 was new but not exceptionally helpful.
I would enjoy seeing three improvements in the third edition. First, thoroughly scrub the book for old information. Watch out for people writing about "Cerebus" or http_decode or offerings from Silicon Defense, whose Web site disappeared in early 2004. Second, tell people to read the excellent Snort manual before reading the book. There's no need to address topics well-covered in the manual, like all of the IP- and TCP-based rule options. Third, ditch the existing rules chapter in favor of two new ones, one explaining principles via existing rules, and one showing advanced rule development.
I still recommend buying this book, but you might guide your reading choices by the comments in this review.

Click Here to see more reviews about: Snort 2.1 Intrusion Detection, Second Edition

Called "the leader in the Snort IDS book arms race" by Richard Bejtlich, top Amazon reviewer, this brand-new edition of the best-selling Snort book covers all the latest features of a major upgrade to the product and includes a bonus DVD with Snort 2.1 and other utilities.Written by the same lead engineers of the Snort Development team, this will be the first book available on the major upgrade from Snort 2 to Snort 2.1 (in this community, major upgrades are noted by .x and not by full number upgrades as in 2.0 to 3.0). Readers will be given invaluable insight into the code base of Snort, and in depth tutorials of complex installation, configuration, and troubleshooting scenarios. Snort has three primary uses: as a straight packet sniffer, a packet logger, or as a full-blown network intrusion detection system. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes. Snort uses a flexible rules language to describe traffic that it should collect or pass, a detection engine that utilizes a modular plug-in architecture, and a real-time alerting capability. A CD containing the latest version of Snort as well as other up-to-date Open Source security utilities will accompany the book.Snort is a powerful Network Intrusion Detection System that can provide enterprise wide sensors to protect your computer assets from both internal and external attack. * Completly updated and comprehensive coverage of snort 2.1* Includes free CD with all the latest popular plug-ins* Provides step-by-step instruction for installing, configuring and troubleshooting

Click here for more information about Snort 2.1 Intrusion Detection, Second Edition

Read More...

Stealing the Network: How to Own a Shadow Review

Average Reviews:

(More customer reviews)Did you enjoy the previous three Stealing the Network books? Are you looking for more? Then move along now, nothing to see here.
The prior books were interesting because they introduced the reader to new ideas or new angles on old ideas, then moved on without belaboring them. If you wanted more details, there were often URLs provided. The last two tied the stories together with the intriguing Knuth character. But the folks running the project chose to switch to a new format, with fewer characters and stories, not to mention fewer authors, and fewer ways to split the profits.
After three books with the same (proven) formula, it's understandable the authors would want to try something new. Alas, it's a disaster.
Welcome to "How to Own a Shadow," aka "The SQL Injection Adventures of Pawn." Pawn is one of the new characters in this volume, and is the first StN character I hoped would get shot to death by the cops in a mini-mall parking lot. Yes, he's that irritating. Particularly after reading 40 pages about his childhood as a high-functioning autistic (or something like that), and around 100 pages of him performing SQL injection attacks. Most of which is totally unrelated to Knuth. Note to the authors: SQL injection is interesting, but if you want to write a book about it, just write a book about it. I even gave you a title, what more do you want? You can even recycle much of this book, like you recycled part of the last one here.
Oh, you noticed the real subtitle of the book, "The Chase for Knuth." First, one chases _after_ fugitives, and hunts or searches _for_ them. Not that it matters, because there's not much chasing or hunting going on in this book. There isn't much Knuth, either. We see him in the first hundred pages, which is mostly about his son analyzing poker software. That's the last we see of either of them. Because, really, this is "The Biography of Pawn." We do get 50 pages of Knuth at the end of the book, but don't get excited: it's all from the last book, added as obvious filler.
Speaking of filler, there's a 17 page advertorial thrown in for BiDiBLAH, which is commercial software by SensePost. Oddly enough, they're listed as technical advisors for the book. I'm sure it's a fine app, but the authors have forgotten about Knuth again, since it has nothing to do with the story. If it had been relevant, it might have been a less obnoxious addition.
Not everything is bad. There's a brief bit about RFID, which of course turns into how to use RFID for SQL attacks. We get to meet Knuth's supposedly dead wife, and a charming shrew she is. All in all, though, this book isn't worth reading unless you're a truly devoted fan of the series, or SQL. I'm still a fan of the previous books, and I hope the authors can recapture what made them so intriguing for their next book. I won't be buying that one until I'm sure it's not Book Two of the Pawn Saga, however.

Click Here to see more reviews about: Stealing the Network: How to Own a Shadow

The best-selling Stealing the Network series reaches its climactic conclusion as law enforcement and organized crime form a high-tech web in an attempt to bring down the shadowy hacker-villain known as Knuth in the most technically sophisticated Stealing book yet.Stealing the Network: How to Own a Shadow is the final book in Syngress' ground breaking, best-selling, Stealing the Network series. As with previous title, How to Own a Shadow is a fictional story that demonstrates accurate, highly detailed scenarios of computer intrusions and counter-strikes. In How to Own a Thief, Knuth, the master-mind, shadowy figure from previous books, is tracked across the world and the Web by cyber adversaries with skill to match his own. Readers will be amazed at how Knuth, Law Enforcement, and Organized crime twist and torque everything from game stations, printers and fax machines to service provider class switches and routers steal, deceive, and obfuscate. From physical security to open source information gathering, Stealing the Network: How to Own a Shadow will entertain and educate the reader on every page. The book's companion Web site will also provide special, behind-the-scenes details and hacks for the reader to join in the chase for Knuth. The final book in the Stealing the Network series will be a must read for the 50,000 readers worldwide of the first three titles The companion Web site to the book will provide challenging scenarios from the book to allow the reader to track down Knuth Law enforcement and security professionals will gain practical, technical knowledge for apprehending the most supplicated cyber-adversaries

Click here for more information about Stealing the Network: How to Own a Shadow

Read More...

Spring Security 3 Review

Average Reviews:

(More customer reviews)I can not begin to tell you how much time I have wasted with this book. If you already know spring security this is a good book, but then again you already know spring security so why bother!
Each chapter contains several different example that attempt to demonstrate how to do handle some aspect of security. Unfortantly the listing in the book for each example are incomplete. Its really hard to figure out how all the "knitting" is done! The source code is really bad. All the examples for each chapter are mashed together across many different files. Some how you are supposed to read all the comments to figure out which piece of code go with which examples. The indirection is madding. Its very hard to figure out which pieces go where.

I think you would be better off using the spring security tutorial, forums and google.
Hopeful someone will write an easy to use "cookbook" with complete recipes that are described in a linear manner.
I think what few reviews have been written so far where done as a favor to the author

Click Here to see more reviews about: Spring Security 3

Secure your web applications against malicious intruders with this easy to follow practical guide
Make your web applications impenetrable.
Implement authentication and authorization of users.
Integrate Spring Security 3 with common external security providers.
Packed full with concrete, simple, and concise examples.

In Detail

Security is of critical importance to all web applications. Vulnerable applications are easy prey for hackers. This book is the perfect tool for Java developers looking to repel attacks against their web applications using the proven Spring Security library to achieve this.

A comprehensive guide to Spring Security 3. You will learn through real world business scenarios how to guard against the latest threats. You will also learn to combine Spring Security 3 with external security providers such as LDAP, OpenID, CAS, Kerberos, and Active Directory.

The book starts by giving an overview of security concepts and techniques, as well as setup and configuration. The book then gets you working with a JSP based web application that implements a simple e-commerce website. At this point you will progressively enhance the application giving you hands on experience implementing features of Spring Security 3 in real world business scenarios.

The second half of the book is devoted to common integration scenarios that you will come accross every day. At this stage you will be in a position to solve specific, complex integration problems. The book will end by showing migration from Spring Security 2 to 3.

This practical guide will show you how to implement Spring Security 3 and protect your applications from being breached using a combination of real world, straightforward examples.

What you will learn from this book

Recognize design flaws that will make your applications unsafe.
Implement basic authorization and credential storage.
Move seamlessly from Spring Security 2 to Spring Security 3.
Provide Enterprise adaptability with LDAP, Active Directory, and Kerberos.
Push the Boundaries of Spring Security 3 through Extension and Customization.
Integrate in-house applications and popular Java frameworks with Spring Security 3.
Plan the configuration of Spring Security 3 to accommodate the authentication and authorization requirements of your application.

Approach

The book starts by teaching the basic fundamentals of Spring Security 3 such as setup and configuration. Later it looks at more advanced topics showing the reader how to solve complex real world security issues.

Who this book is written for

This book is for Java developers who build web projects and applications. The book assumes basic familiarity with Java, XML and the Spring Framework. Newcomers to Spring Security will still be able to utilize all aspects of this book.

Click here for more information about Spring Security 3

Read More...

Securing the Borderless Network: Security for the Web 2.0 World Review

Average Reviews:

(More customer reviews)I am giving this four stars because in June 2010, this really helps me see the big picture from a seasoned tech executive, Harvard MBA's point of view. Through no fault of his own, the manuscript will age fast and be less valuable fast. For instance, chapter 6 doesn't have the iPad however, it does have the Apple Newton from 1993. There is a lot of history built into Gillis's research and I found that really helpful, we have to know where we have been to understand where we are going. If you need to understand the emerging trends in security and computing in general and it is still 2010, I recommend you buy this book. If it is later than 2010 and it is not second edition or updated, ask around for a copy to borrow. I guess I am a bit of a Gillis fan, I only recycled his Get the Message from 2004 last month.

Click Here to see more reviews about: Securing the Borderless Network: Security for the Web 2.0 World

Securing the Borderless Network: Security for the Web 2.0 WorldTom GillisSecuring the Borderless Network reveals New techniques for securing advanced Web 2.0, virtualization, mobility, and collaborative applicationsToday's new Web 2.0, virtualization, mobility, telepresence, and collaborative applications offer immense potential for enhancing productivity and competitive advantage. However, they also introduce daunting new security issues, many of which are already being exploited by cybercriminals. Securing the Borderless Network is the first book entirely focused on helping senior IT decision-makers understand, manage, and mitigate the security risks of these new collaborative technologies. Cisco® security technology expert Tom Gillis brings together systematic, timely decision-making and technical guidance for companies of all sizes: information and techniques for protecting collaborative systems without compromising their business benefits. You'll walk through multiple scenarios and case studies, from Cisco Webex® conferencing to social networking to cloud computing. For each scenario, the author identifies key security risks and presents proven best-practice responses, both technical and nontechnical. Securing the Borderless Network reviews the latest Cisco technology solutions for managing identity and securing networks, content, endpoints, and applications. The book concludes by discussing the evolution toward "Web 3.0" applications and the Cisco security vision for the borderless enterprise, providing you with a complete security overview for this quickly evolving network paradigm.

Click here for more information about Securing the Borderless Network: Security for the Web 2.0 World

Read More...

Business in the Cloud: What Every Business Needs to Know About Cloud Computing Review

Average Reviews:

(More customer reviews)"Business in the Cloud...Computing" is an excellent,clear & easy to understand guide designed for a broad audience of business & technical leaders to balance the needs for a comprehensive framework to understand Cloud Computing and its Business Impact with the need for a simple & direct discussion of the key points without delving so deeply into specific details!
"Business in the Cloud...Computing" is divided into three parts. The first two chapters provide a basis for understanding current organizational & economic changes / realities! The next six chapters define Cloud Technology,strategies,tactics and lessons learned-to-date! Chapter six - The Transition from Managing Technology to Managing Business Processes is very direct & relevant! The last two chapters expand upon the information in previous chapters to the Business Impact of Cloud Computing & Global Implications of the Cloud!
"Business in the Cloud...Computing" is designed to clarify the often-vague concept of Cloud Computing to not only understand it but to put it to work!...Please review & use...All Cloud Innovators & Builders...Michael.Business in the Cloud: What Every Business Needs to Know About Cloud Computing

Click Here to see more reviews about: Business in the Cloud: What Every Business Needs to Know About Cloud Computing


A close look at cloud computing's transformational role in business

Covering cloud computing from what the business leader needs to know, this book describes how IT can nimbly ramp up revenue initiatives, positively impact business operations and costs, and how this allows business leaders to shed worry about technology so they can focus on their business. It also reveals the cloud's effect on corporate organization structures, the evolution of traditional IT in the global economy, potential benefits and risks of cloud models and most importantly, how the IT function is being rethought by companies today who are making room for the coming tidal wave that is cloud computing.
Why IT and business thinking must change to capture the full potential of cloud computing
Topics including emerging cloud solutions, data security, service reliability, the new role of IT and new business organization structures
Other titles by Hugos include: Business Agility: Sustainable Prosperity in a Relentlessly Competitive World and Essentials of Supply Chain Management, 2nd Edition

Practical and timely, this book reveals why it's worth every company's time and effort to exploit cloud computing's potential for their business's survival and success.

Click here for more information about Business in the Cloud: What Every Business Needs to Know About Cloud Computing

Read More...

IT Security Interviews Exposed: Secrets to Landing Your Next Information Security Job Review

Average Reviews:

(More customer reviews)Information security is a hot career area and is among the strongest fields within IT for growth and opportunity. With excellent long-term career prospects, increasing cybersecurity vulnerabilities and an increase in security & privacy regulations and legislation, the demand for security professionals is significant. Even with a bright future, that does not necessarily mean that a career in information security is right for everyone. What differentiates an excellent security professional from a mediocre one is their passion for the job. With that, IT Security Interviews Exposed is a mixed bag of a book. For those that are looking for an information security spot and have the requisite passion for the job, much of the information should already be known. For someone who lacks that passion and simply wants a security job, their lack of breadth will show and the information in the book likely won't be helpful, unless they have a photographic memory to remember all of the various data points.
If you find information security challenging and either want a job in the field or are looking for a better job in the field, the book will be quite valuable. But for those looking for a hot security job, their lackings will likely show through on in interview, even with the help of this book.
As to the actual content, chapter 1 provides a good overview of how to find, interview and get a security job. The chapter contains many bits of helpful information, especially to those whose job seeking skills are deficient. A good piece of advice the author's state is that one should never pay a fee for headhunting services. There are many people that call themselves recruiters, but are nothing more than fax servers who charge for the service. The burden to pay is always on the hiring firm, and a job seeker should be extremely suspicious of anyone requesting a fee to find them a position.
I would hope that in future editions of the book, the authors expand on chapter one. The chapter itself in fact could easily me made into a book in its own right. As part of the job search process, many job searchers often do not ask themselves enough fundamental questions if they are indeed in the right place in their career. Such an approach is taken by Lee Kushner, founder and CEO of the information security recruitment firm LJ Kushner and Associates. Kushner formulated the following 7 questions that every information security job candidate should ask themselves:
1. What are my long and short term plans?
2. What are my strengths and weaknesses?
3. What skills do I need to develop?
4. Have I acquired a new skill during the past year?
5. What are my most significant career accomplishments and will I soon achieve another one?
6. Have I been promoted over the past three years?
7. What investments have I made in my own career?
The other 9 chapters of the book all have the same format; an overview of the topic, and then various questions and interviewer may pose. The reality that these topics of network and security fundamentals, firewalls, regulations, wireless, security tools, and more, are essential knowledge for a security professional. Anyone trying to go through a comprehensive information security interview and wing it by reviewing the material will likely only succeed if the interviewer is inept. Anyone attempting to mimic the questions and answers in the book in a real-world interview will immediately be found to be a sham if the interviewer deviates even slightly from the script, which should be expected.
What really separates a good candidate from a great candidate is hands-on, practical and real-world security experience. Such a candidate won't need a question and answer format to showcase themselves in an interview. Their experience should shine, and not their ability to rattle of security acronyms.
If a company is serious about hiring qualified people, the interview process should not be about short technical questions and acronym definitions. It should entail an open discussion with significant give and take. Having a candidate detail their methodology for deploying and configuring a firewall should be given more credence than their ability to define the TCP the three-way handshake.
Ultimately, the efficacy of the book is in the disposition of the reader. For the security newbie who wants a crash course in security in order to quickly land a security job, heaven help the company that would hire such a person. While one should indeed not judge a book by its cover; this book's cover and title may lead some readers to think that the book is their golden ticket to a quick landing into a great career. The breadth of information that a security professional needs to know precludes and short of cramming or quick introductions. Those with a lack of security experience attempting to use this book to hide their shortcomings will only embarrass themselves on an interview.
On the other hand, for the reader who has a background in information security who wants an update on network and security fundamentals, they will find IT Security Interviews Exposed a helpful title. The book contains a plethora of valuable information written in a clear and easy to read style. In a little over 200 pages, the book is able to provide the reader with a good review of what they know or may have forgotten. Used in such a setting by such a reader makes the book a most helpful tool for the serious security professional looking to advance their career.


Click Here to see more reviews about: IT Security Interviews Exposed: Secrets to Landing Your Next Information Security Job


Technology professionals seeking higher-paying security jobs need to know security fundamentals to land the job-and this book will help
Divided into two parts: how to get the job and a security crash course to prepare for the job interview
Security is one of today's fastest growing IT specialties, and this book will appeal to technology professionals looking to segue to a security-focused position
Discusses creating a resume, dealing with headhunters, interviewing, making a data stream flow, classifying security threats, building a lab, building a hacker's toolkit, and documenting work
The number of information security jobs is growing at an estimated rate of 14 percent a year, and is expected to reach 2.1 million jobs by 2008

Click here for more information about IT Security Interviews Exposed: Secrets to Landing Your Next Information Security Job

Read More...

Steal This Computer Book 4.0: What They Won't Tell You about the Internet Review

Average Reviews:

(More customer reviews)Overall this is a good book. The first part is sorta stupid, though. It talks mainly about how not to only listen to one person but to get information from multiple sources. It could be summed up in about a page.
Chapter 4 talks about buying computers and software. It helped me out by giving me some tricks to do next time I buy a computer.
Chapter 5 tells you about keeping your files secure with encryption. It tells you about some different types of encryption algorithms and how to write your own encryption programs. It also shows you how to play some dirty tricks. It talked about using anonymous remailers to send anonymous email and talked about just how anonymous they were. It even told you how to surf the web anonymously so that people couldn't receive information about your computer, browser, and more.
Chapter 6 told about phone phreaking history such as captian crunch. Wallace then goes on by telling you possibly things that could've happened but didn't. When telling these stories he tries to make himself sound like a phreaker but he didn't even do anything. Then, he tells your some really obvious stuff like "To start phone phreaking, you need access to a telephone." and "phreaking from your own phone will let the telephone company trace it to your house." I don't know if he couldn't think of anything else or he thinks you are really stupid. After that, he talks about phreaking color boxes and then goes on to voice mail hacking. Then, he talks about cellular phone fraud and tv satellite descrambling.
Chapter 7 talks about defeating windoz 3.1/95/98 screen saver passwords which if you ever tried you should've done it on the first or second try. It also talks about cracking program passwords and then it goes on to defeating parental control software. If you can't access certain web pages, Wallace tells you how by having the html code emailed to you. He also shows you how to read banned books in secret.
Chapter 8 talks about harassing online services, how pedophiles stalk innocent children and what you can do to stop them. He tells you about generating fake credit card numbers and making your own online harassment program.
Chapter 9 talks about stopping spam. It shows you multiply ways to take revenge on spammers. If the spammer used a forged email address, Wallace shows you how to track down the spammer like two magnets attracting each other.
Chapter 10 shows some pictures of acctual hacked web sites and how to hack them.
Chapter 11 shows you how to track people down by using specific things about them. For example if you only had their SSC# how you could still find them no matter where they were. At the end of the chapter, he shows you how to hide yourself if you don't want to be tracked down or how to let someone easily find you if, for example, you gave your child up for adoption years ago and you don't want to contact him/her but you do want to let them find you if they ever wanted you.
Chapter 12 shows you about ConGames on the Internet. It shows you how to do them and how to protect yourself from them.
Chapter 13 Viruses Part I. ( I heard that the plural form of virus is exposed to be virii, just like the plural form or fungus is fungi but in the book it is written viruses so that's how I will spell it.)
This chapter expains what viruses are, the parts of them, how to tell if you have a virus on your computer, the different infection methods, if all viruses are bad and how to learn more about them.
Chapter 14 Viruses Part II.
This chapter shows the different methods of how an antivirus program works and what to do if you find a virus ( If you say any idiot knows that if you find one you should delete it, but you could also send it in to an antivirus program if you think it is a uncommon virus, keep a copy of it, modify the virus and make a new one and many other things.)
Chapter 15 tells you about writing your own computer virus. Wallace also tells you to watch out because viruses sometimes attack their own creators. He tells you some true things about antivirus companies like how they hire virus writers to help them detect viruses (makes sense, doesn't it) and how that their isn't any evidence of this, but that they may hire the virus writers to write a virus that only they have the antidote for so people will buy their program to detect it.
Chapter 16 is about Java applets. I haven't read all of it but so far so good.
Appendice A is the glossary with a decent amount of terms covered in the book. I really haven't used it too much because I never needed to.
Appendice B is Visual Basic 3.0 ( a very easy programming language that I suggest you learn ) source code for altering Mega$hack. A program he discusses in 12. ( it is used by cons but he alters it so they get a taste of their own medicine.) The source code is written on the page so you will have to type it into your Visual Basic Compiler.
Appendice C is about additional resources. It is compiled of online magazines, webpages, hacker conventions and more.
Summary: This book is for you if you are interested in the above things. The websites and newsgroups in the book lead to nothing except for a few like metacrawler that he obviously was paid to advertise for. If you are still unsure after unreading all the reviews, go to a local bookstore and see if they have this book there. If they do then look at it, see if you like it and if so, compare the prices of Amazon plus the shipping and time to the prices of the bookstore. I hope that this review helped you because I know what it is like to have one person rate it 5 stars and another person rate it 1 star. Sinse this is a pain, I figured that instead of giving my opinion, I would tell you what the book had in it.

Click Here to see more reviews about: Steal This Computer Book 4.0: What They Won't Tell You about the Internet

Click here for more information about Steal This Computer Book 4.0: What They Won't Tell You about the Internet

Read More...

Build Your Own Security Lab: A Field Guide for Network Testing Review

Average Reviews:

(More customer reviews)I'll be completely honest. I went through this in about two hours, and I plan on returning it. It simply didn't have anything new for me. I was expecting it to be more along the lines of setting up a virtual network, attempting to hack the VMs, and then checking the procedures to see if you did it right.
Instead, this book covers things like how to install OSes into VMs, gives basic overviews of tools, etc. However, this is a great book if you're at the appropriate level for it. I think this makes a good follow-up to CompTIA's Security+ certification. It'll help novices get their feet wet with actual hands-on activities. I've done nearly everything in this book on my own, and that's really the only problem with it. While I didn't pay a great deal of attention to every bit of text, it seemed to be technically accurate and free from errors.
I wish I could give a more detailed review, but I thought I'd at least post this since no one has reviewed it yet. Just take your skill level into account when considering this title. If you want more advanced books, check out the Hacking Exposed series, Grey Hat Hacking, and the Penetration Tester's Open Source Toolkit.

Click Here to see more reviews about: Build Your Own Security Lab: A Field Guide for Network Testing

If your job is to design or implement IT security solutions or if you're studying for any security certification, this is the how-to guide you've been looking for. Here's how to assess your needs, gather the tools, and create a controlled environment in which you can experiment, test, and develop the solutions that work. With liberal examples from real-world scenarios, it tells you exactly how to implement a strategy to secure your systems now and in the future.
Note: CD-ROM/DVD and other supplementary materials are not included as part of eBook file.

Click here for more information about Build Your Own Security Lab: A Field Guide for Network Testing

Read More...

Chained Exploits: Advanced Hacking Attacks from Start to Finish Review

Average Reviews:

(More customer reviews)I looked forward to Chained Exploits (CE) by Whitaker, Evans and Voth with much anticipation as the concept is a much needed addition to the lexicon on information security. Often academic fields are severely limited by the vocabulary available to discuss issues and the "chained exploit" is sure to become a mainstay in the discourse of information security. Despite my enthusiasm for the concept, however, I was disappointed by the material presented in CE. The genius of the chained exploit is that it upends the traditional threat matrix, typically presented as:
[value of resource] x [likelihood of exploit] = [risk level]
For example, a high value resource that is unlikely to be exploited should be ranked as a low risk, as should a low value resource that is likely to be exploited. Think of this in terms of a temporary database of publically available information used to populate a user demonstration website that is wiped out every 24 hours. If that information is compromised it has no value, so even if the compromise is likely it is a low risk system. Conversely if a system that contains critical financial information is confined to a single workstation that is removed from any networking and housed in a guarded facility it too is a low risk system (since the likelihood of compromise is low).
Unfortunately many auditors make risk assessments based on circumstances in a vacuum. This is where the concept of "chained exploits" becomes so valuable. For instance, if a vulnerability were discovered in a local binary accessible to users that allows privilege escalation, but the local binary exists on a system that has no users (other than administrators who already have root privileges) it is often considered a low risk. Many times patches for these sorts of vulnerabilities are not installed because the patch could introduce instability and would not be considered worthy of the expense given the low risk. Similarly a vulnerability could be discovered in a web service that when exploited could allow a remote attacker to gain an unprivileged local account that, say, only had access to read and write to the /tmp directory. This could also be considered a low risk since such limited access wouldn't present any threat to the system. However, if you "chained exploits" for the two vulnerabilities you suddenly have a condition where a remote attacker can gain a local account and elevate their privilege! This contravenes the low risk ranking of the individual vulnerabilities. When combined they suddenly become a very high risk to the system.
It was this sort of "chain" that I hoped CE would explore. Instead the material presented in the book consisted of context to several high risk vulnerabilities to explain why they might be used in tandem. For instance, the book would propose a scenario where a remote attacker installed a backdoor rootkit on a corporate network workstation then used that workstation to access the central database using default system administrator credentials. Each of the conditions used in these "chains" are extremely high risk already, and thus the book doesn't present any new material for seasoned information security professionals to consider.
For a novice this book is a great resource. It is full of the sorts of horror stories that professionals are all too familiar with, but could potentially be eye opening for a neophyte or someone unfamiliar with computer security. At the very least it is a page turning exploration of very real and often under appreciated risks to enterprises.
I was disappointed that the book didn't raise the level of discourse in the information security field but I suspect that wasn't the point of Chained Exploits. Instead it reads like a greatest hits sequence prepared by veteran penetration testers. It makes for interesting reading, but it isn't particularly informative. Don't look for any new 0 day exploits (or even a discussion of how to find such flaws). Instead the book contains a litany of well known routes to system compromise and illustrative narratives that tie them together in real world scenarios.

Click Here to see more reviews about: Chained Exploits: Advanced Hacking Attacks from Start to Finish

The complete guide to today's hard-to-defend chained attacks: performing them and preventing themNowadays, it's rare for malicious hackers to rely on just one exploit or tool; instead, they use "chained" exploits that integrate multiple forms of attack to achieve their goals. Chained exploits are far more complex and far more difficult to defend. Few security or hacking books cover them well and most don't cover them at all. Now there's a book that brings together start-to-finish information about today's most widespread chained exploits–both how to perform them and how to prevent them. Chained Exploits demonstrates this advanced hacking attack technique through detailed examples that reflect real-world attack strategies, use today's most common attack tools, and focus on actual high-value targets, including credit card and healthcare data. Relentlessly thorough and realistic, this book covers the full spectrum of attack avenues, from wireless networks to physical access and social engineering. Writing for security, network, and other IT professionals, the authors take you through each attack, one step at a time, and then introduce today's most effective countermeasures— both technical and human. Coverage includes:Constructing convincing new phishing attacksDiscovering which sites other Web users are visitingWreaking havoc on IT security via wireless networksDisrupting competitors' Web sitesPerforming–and preventing–corporate espionageDestroying secure filesGaining access to private healthcare recordsAttacking the viewers of social networking pagesCreating entirely new exploitsand moreAndrew Whitaker, Director of Enterprise InfoSec and Networking for Training Camp, has been featured in The Wall Street Journal and BusinessWeek. He coauthored Penetration Testing and Network Defense. Andrew was a winner of EC Council's Instructor of Excellence Award.Keatron Evans is President and Chief Security Consultant of Blink Digital Security, LLC, a trainer for Training Camp, and winner of EC Council's Instructor of Excellence Award. Jack B. Voth specializes in penetration testing, vulnerability assessment, and perimeter security. He co-owns The Client Server, Inc., and teaches for Training Camp throughout the United States and abroad.informit.com/awCover photograph © Corbis /Jupiter Images$49.99 US $59.99 CANADA

Click here for more information about Chained Exploits: Advanced Hacking Attacks from Start to Finish

Read More...

Stealing the Network: The Complete Series Collector's Edition, Final Chapter, and DVD Review

Average Reviews:

(More customer reviews)I have just finished a marathon session of reading "Stealing the Network: The Complete Series Collector's Edition" and I have a very conditional review of it: It's a must-have if you don't already own the previous editions of these guilty pleasures. If you are already a fan, however, prepare to be let-down by the compilation.
The stories of the Stealing the Network series entertain in the same way that "war stories" from fellow hackers and security professionals often keeps a more intimate audience's interest: by mixing intriguing situations with juicy technical detail that can serve as a useful take-away. No one will accuse these books of containing fine literature, but that's not really the point. The stories are well written enough to keep you wanting to know what will happen next, while the technical information is as accurate as you're likely to see in fiction. Segments involving hacking are written and illustrated with enough attention to detail and length to serve as introductory educational tutorials for the topics (including web application hacking, reverse engineering, and wireless security). Most of these scenarios are believable as parts of larger-scale operations.
The first book of the series consists of independent short-stories based around characters of the authors' creation. The other three books in the compilation tell an over-arching story of a larger "operation", which involves many characters and their independent stories. The second book, "How to Own a Continent", is probably my favorite, along with the first ("How to Own a Box"), for keeping things simple, technical, and focusing on the individual stories. The third book, "How to Own an Identity" suffers from having worse editing then the rest of the series, and may lose some readers' interest. The fourth book ("How to Own a Shadow") reads a lot better, and wraps the overall story up well, however it focuses only on a relative handful of the series' characters.
As a compilation, this Collector's Edition leaves much to be desired. While the original description for this edition described the books contained within as being "author-annotated", this is not the case. The individual books are reproduced exactly as they were in their original editions, with no additional commentary from the authors, and with all the same problems as the originals. For example, screenshots in the first chapter of the first book are the same illegible black squares that were in the original edition of the book published 7 years ago. The annotations along with other features described in the original description (emails, photographs) that would provide a lot of interesting background material, would have made this compilation a must-buy.
The extra content that you are receiving is a brief new forward by Jeff Moss, and a "Final Chapter" by Ryan Russell. The new chapter is about 20 pages long, and gives the story-line a proper ending. I won't ruin anything about it, but I will say that I enjoyed it. Syngress has promised in the description of the book to make this content available separately in electronic form in six months.
The included DVD is described on the back-cover copy as being "full" of behind-the-scenes stories. In reality, you will only find 20 minutes of interviews with a few of the authors. I enjoyed these interviews, however, much like the print companion, I felt like more should have been done. Also beware that there are problems with the audio on the DVD. When played on my MacBook, there was noticeable crackling/popping in the audio of the DVD. The same noise was present, but less noticeable when played through a stand-alone DVD player through a television.
To summarize, I like the books, and find them as entertaining as I did when they were originally published, and I like the new hardcover binding. I do think that it is unfortunate that the "Stealing the Network: The Complete Series Collector's Edition" does not meet its potential to be more than the sum of its parts. There seems to have been intent at some point to add value to the set, but it wound up simply being a rough concatenation of the individual books.
If you haven't read these books, then I very much recommend picking up this set. It's 1,000 pages of interesting stories and technical material. If you already have the previous editions of the Stealing the Network Series, however, you might find it hard to justify paying for them again.

Click Here to see more reviews about: Stealing the Network: The Complete Series Collector's Edition, Final Chapter, and DVD


"Stealing the Network: How to Own the Box is a unique book in the fiction department. It combines stories that are fictional, with technology that is real. While none of the stories have happened, there is no reason why they could not. You could argue it provides a road map for criminal hackers, but I say it does something else: it provides a glimpse into the creative minds of some of today's best hackers, and even the best hackers will tell you that the game is a mental one." - from the Foreword to the first Stealing the Network book, How to Own the Box, Jeff Moss, Founder & Director, Black Hat, Inc. and Founder of DEFCON

For the very first time the complete Stealing the Network epic is available in an enormous, over 1000 page volume complete with the final chapter of the saga and a DVD filled with behind the scenes video footage!

These groundbreaking books created a fictional world of hacker superheroes and villains based on real world technology, tools, and tactics. It is almost as if the authors peered into the future as many of the techniques and scenarios in these books have come to pass.

This book contains all of the material from each of the four books in the Stealing the Network series.

All of the stories and tech from:


How to Own the Box

How to Own a Continent

How to Own an Identity

How to Own a Shadow

Plus:


Finally - find out how the story ends! The final chapter is here!

A DVD full of behind the scenes stories and insider info about the making of these cult classics!
* Now for the first time the entire series is one 1000+ page book* The DVD contains 20 minutes of behind the scenes footage* Readers will finally learn the fate of "Knuth" in the much anticipated Final Chapter

Click here for more information about Stealing the Network: The Complete Series Collector's Edition, Final Chapter, and DVD

Read More...

Hacking Exposed: Network Security Secrets and Solutions, Sixth Edition Review

Average Reviews:

(More customer reviews)Hardly a week goes by that CNN does not report a high-profile Web site being defiled or an e-commerce site being penetrated. While most people know why these incidents occurred, Hacking Exposed explains how they occurred and, more important, how to prevent them from occurring.
The cover of Hacking Exposed announces that "Network security is Y2K without the deadline." That alarmist statement, however, is the only hype in the book. The work is packed with real-world examples and links to tools needed to assess the security of any type of client/server and Web system. As they detail the myriad vulnerabilities in different types of systems, the authors provide countermeasures for each of them.
Well organized, the book progresses in an orderly fashion. It methodically goes through the process of exploiting a target to penetrate a system--from identification and enumeration to actual penetration. The authors provide detailed instructions and explanations for many security features and flaws in Unix, Linux, Windows, NetWare, routers, firewalls, and more. Topics covered include state-of-the-art computer and network penetration, as viewed by both the attacker and the defender; remote system identification; vulnerability identification; war dialers; firewall circumvention; and denial-of-service attacks. An appendix explores the security characteristics of Windows 2000.
Some may argue that books such as this one only serve to motivate and educate hackers. The truth is that hackers are already aware of the book's contents. This book is designed for system administrators and managers who need to know their systems' risks and vulnerabilities and how to address them. When they are done with this book, system administrators and managers will be familiar with such critical topics as back channels, port redirection, banner grabbing, and buffer overflows. Hacking Exposed is a must-read for anyone who wants to know what is really happening on their network....

Click Here to see more reviews about: Hacking Exposed: Network Security Secrets and Solutions, Sixth Edition

Click here for more information about Hacking Exposed: Network Security Secrets and Solutions, Sixth Edition

Read More...

How to Break Web Software: Functional and Security Testing of Web Applications and Web Services. Book & CD Review

Average Reviews:

(More customer reviews)I recently finished reading How to Break Web Software: Functional and Security Testing of Web Applications and Web Services by Mike Andrews and James A. Whittaker. I, like many of you, develop web software for a living. I've always taken security seriously and occasionally sneered when I ran across examples of common mistakes. Having said that, this book was an eye opener for me.
The book covers common exploits such as bypassing input validation, SQL injection, and denial of service. There were also several types of attacks I hadn't really considered before. I won't list them here because someone would undoubtedly say, "I can't believe he didn't know about that one!" The authors cover 24 different types of attacks in all. The book also includes coverage of web privacy issues and security related to web services.
Finally, as icing on the cake, a CD is included that contains many tools that will find permanent spots in your arsenal. There are tools to do things like scan web servers for common exploits, mirror sites for local analysis, and check SSL cipher strengths. My favorites are the local proxies that will allow you to view and modify posts as they travel from the client and the server. I always knew I could do this, but didn't know how easy it is. The CD also contains the source code of an example site that includes many flaws for you to practice.
This book is written for software professionals to help them put the hackers out of business. So, it necessarily includes hacker techniques. If you develop or test web software, you should read this book before the hackers do. :-)

Click Here to see more reviews about: How to Break Web Software: Functional and Security Testing of Web Applications and Web Services. Book & CD

Since its early days as an information exchange tool limited to academe, researchers, and the military, the web has grown into a commerce engine that is now omnipresent in all facets of our lifes. More websites are created daily and more applications are developed to allow users to learn, research, and purchase online. As a result, web development is often rushed, which increases the risk of attacks from hackers. Furthermore, the need for secure applications has to be balanced with the need for usability, performance, and reliability. In this book, Whittaker and Andrews demonstrate how rigorous web testing can help prevent and prepare for such attacks. They point out that methodical testing must include identifying threats and attack vectors to establish and then implement the appropriate testing techniques, manual or automated.

Click here for more information about How to Break Web Software: Functional and Security Testing of Web Applications and Web Services. Book & CD

Read More...

Cloud Application Architectures: Building Applications and Infrastructure in the Cloud (Theory in Practice (O'Reilly)) Review

Average Reviews:

(More customer reviews)All it talks about is Amazon's EC2, S3, MapReduce. It does not talk about "Application Architecture". It does not have ideas about how to break up traditional programs into MapReduce paradigm. It should be called Cloud Operations Architecture. If it was named by that title, I'd give it 5 stars. The book itself is not bad, but it will get obsolete very quickly due to its specificity to Amazon.
subtitle should be :Building Applications and Infrastructure in Amazon Cloud

Click Here to see more reviews about: Cloud Application Architectures: Building Applications and Infrastructure in the Cloud (Theory in Practice (O'Reilly))


If you're involved in planning IT infrastructure as a network or system architect, system administrator, or developer, this book will help you adapt your skills to work with these highly scalable, highly redundant infrastructure services. While analysts hotly debate the advantages and risks of cloud computing, IT staff and programmers are left to determine whether and how to put their applications into these virtualized services. Cloud Application Architectures provides answers -- and critical guidance -- on issues of cost, availability, performance, scaling, privacy, and security. With Cloud Application Architectures, you will:



Understand the differences between traditional deployment and cloud computing
Determine whether moving existing applications to the cloud makes technical and business sense
Analyze and compare the long-term costs of cloud services, traditional hosting, and owning dedicated servers
Learn how to build a transactional web application for the cloud or migrate one to it
Understand how the cloud helps you better prepare for disaster recovery
Change your perspective on application scaling

To provide realistic examples of the book's principles in action, the author delves into some of the choices and operations available on Amazon Web Services, and includes high-level summaries of several of the other services available on the market today.Cloud Application Architectures provides best practices that apply to every available cloud service. Learn how to make the transition to the cloud and prepare your web applications to succeed.

Click here for more information about Cloud Application Architectures: Building Applications and Infrastructure in the Cloud (Theory in Practice (O'Reilly))

Read More...