Metasploit Book Unleashed

I just finished reading a new book from some of the guys at Offensive Security, Metasploit: The Penetration Tester's Guide and all I can say is that it is amazing.  Be sure to check it out and get yours from Amazon.com or your favorite bookseller.

One thing I have to say about it is that if you want to learn how to do a solid penetration test using a tool in every pen tester's toolbox then this has to be in you library. It not only shows you how to test the security of your network using Metasploit.

You learn how to integrate other programs such as nmap, nessus, and nexpose. It also teaches how exploits work and how to craft cleaver exploits that avoid detection. All of this is done with the goal of teaching best practices within pen testing and testing systems. The final step it goes over is cleaning up after the testing.

Another benefit of the book is that it tells you how to configure your lab environment to test some of the techniques and tools to attack both a Windows virtual machine and a Linux virtual machine, and walks you through the steps of doing a pen test in a safe and legal manner. It puts together the steps that you learned throughout the book into a consistent and concise chapter. The pen test is a small one, but with the skills and vm's that they give you it is a good starting point.  

Overall I give this book a 4 out of 5 stars only because I wish it would have been a bigger book. :) I hope they will continue to update the book or expand as the Metasploit Project continues to grow and techniques become more standardized though the Penetration Execution Standards become more firm. 

Gray Hat Hacking 3rd Edition Review

I have just finished reading Gray Hat Hacking: The Ethical Hacker's Handbook 3rd Edition by: Shon Harris. The book has been updated and expanded with new content and expended chapters and techniques.

The book starts out explaining what "Ethical Hacking" is, and what is Responsible Disclosure. You also learn about conducting and managing a penetration test in a professional setting.

Then an exploration of BackTrack 4 R2 is introduced. This is the defacto standard in security and penetration testing used by professionals. The BackTrack chapter could have been longer, but this book isn't designed as a BackTrack manual. Metasploit is also introduced. I think these are the best chapters in the book on using the Metapretor Shell and scripting Metasploit. It goes into real in-depth knowledge on using Metasploit to exploit the systems.
ow to an
The book teaches an introduction on computer programming for security professionals, which is always needed I think. Programming teaches you how to think logically and you can follow what the source code may be trying to accomplish.

The chapters on Malware Analyst is excellent. It builds on the previous chapters of programming and exploitation, which is great. You learn about capturing malware and how to run analysis software to figure out how the malware works and how to possible defend against it.

Linux in a Nutshell 5th Edition Review

Linux in a Nutshell, 5th Edition By: Ellen Siever, Aaron Weber, Stephen Figgins, Robert Love, Arnold Robbins, et al. is a fantastic reference book for both newbies to Linux or system administrators that have 20+ years of experience. The book is published by O'Reilly Media, which is the leader in great and easy to read technical book. The book is a massive 944 pages. Two-thirds of which is commands to use with linux and a detail and examples of most if not all the options with that command. If you are reading a forum post and want to find the truth about what that command is doing to the system then use this book to find that out so you want be left with possible deleting your system. The list of commands are in alphabetical order so they are easy to thumb to the correct command. It is great to learn about the commands. I think adding the commands in this kind of list and format is the best thing about the book. I will use that section for years to come. 

Also if you want to know about how to set up different services or servers running Linux you can with this book also. You can learn about DNS/BIND, SSH, file sharing, networking and a lot more within the other chapters of the book. 

My only caution with this book is that it is for the person wanting to become proficient in the use of the command line. It is not for the typical user unless you love the command line. If you are a casual user then I would recommend an Ubuntu book by O'Reilly. There are no graphics in the book, so you will know the command line by the time you study and read this book. Also you cannot understand the command line unless you use it day in and day out.

I give this book 4 out of 5 Penguins just because I wished they would have given more examples and covered more administration topics and expanded on them. But it is still a wonderful book and reference tool. It will stay next to me and my computer.