Synopses & Reviews
Fully updated expanded to cover the latest devious hacking methods
Featuring in-depth, advanced coverage of vulnerability discovery and reverse engineering, Gray Hat Hacking, Third Edition provides eight brand-new chapters on the latest ethical hacking techniques. In addition to the new chapters, the rest of the book is updated to address current issues, threats, tools and techniques.
This one-of-a-kind guide offers a comprehensive overview of the hacking landscape and is organized in a progressive manner, first giving an update on the latest developments in hacking-related law, useful to everyone in the security field. Next, the book describes the security testing process and covers useful tools and exploit frameworks. The second section is expanded by explaining social engineering, physical, and insider attacks and the latest trends in hacking (Voice over IP and SCADA attacks). The book then explains, from both a code and machine-level perspective, how exploits work and guides you through writing simple exploits. Finally, the authors provide a comprehensive description of vulnerability research and reverse engineering.
Gray Hat Hacking, Third Edition features eight new chapters, covering:
- Social engineering
- Physical attacks
- Insider attacks
- VoIP attacks
- SCADA attacks
- Dradis framework and information sharing
- Client content-based attacks
- Web server attacks
Detailed, authoritative coverage Introduction to Ethical Disclosure; Ethics of Ethical Hacking; Ethical Hacking and the Legal System; Proper and Ethical Disclosure; Penetration Testing and Tools; Social Engineering Attacks; Physical Attacks; Insider Attacks; Using BackTrack LiveCD Linux Distribution; Using Metasploit; Dradis and Managing a Pen Test; Exploiting; Progamming SProgrammingills; Basic Linux Exploits; Advanced Linux Exploits; Shellcode Strategies; Writing Linux Shell Code; Basic Windows Exploits; Client Content Based Attacks; Web Server Attacks; VoIP Attacks; SCADA Attacks; Vulnerability Analysis; Passive Analysis; Advanced Static Analysis with IDA Pro; Advanced Reverse Engineering; Client-Side Browser Exploits; Exploiting Windows Access Control Model; Intelligent Fuzzing with Sulley; From Vulnerability to Exploit; Closing the Holes: Mitigation Techniques; Malware Analysis; Collecting Malware and Initial Analysis; Hacking Malware
Fully expanded to cover the latest devious hacking methods, the third edition of this bestselling ethical hacking and security testing book provides in-depth, advanced coverage of vulnerability discovery and reverse engineering.
THE LATEST STRATEGIES FOR UNCOVERING TODAY'S MOST DEVASTATING ATTACKS
Thwart malicious network intrusion by using cutting-edge techniques for finding and fixing security flaws. Fully updated and expanded with nine new chapters, Gray Hat Hacking: The Ethical Hacker's Handbook, Third Edition details the most recent vulnerabilities and remedies along with legal disclosure methods. Learn from the experts how hackers target systems, defeat production schemes, write malicious code, and exploit flaws in Windows and Linux systems. Malware analysis, penetration testing, SCADA, VoIP, and Web security are also covered in this comprehensive resource.
- Develop and launch exploits using BackTrack and Metasploit
- Employ physical, social engineering, and insider attack techniques
- Build Perl, Python, and Ruby scripts that initiate stack buffer overflows
- Understand and prevent malicious content in Adobe, Office, and multimedia files
- Detect and block client-side, Web server, VoIP, and SCADA attacks
- Reverse engineer, fuzz, and decompile Windows and Linux software
- Develop SQL injection, cross-site scripting, and forgery exploits
- Trap malware and rootkits using honeypots and SandBoxes
About the Author
Allen Harper, CISSP,
a retired Marine Corps Major, is the president and founder of N2NetSecurity, Inc., and a faculty member for the Institute for Applied Network Security, He has worked as a security consultant for the Internal Revenue Service and for Logical Security, LLC.
Shon Harris, CISSP, MCSE, is the president of Logical Security, a security consultant, a former engineer in the Air Forces Information Warfare unit, an instructor, and a bestselling author. She was recognized as one of the top 25 women in the Information Security field by Information Security Magazine.
Jonathan Ness is a software security engineer at Microsoft. He is a member of an Air National Guard unit where he leads network penetration tests against military facilities across the country and helps define the information warfare aggressor mission for the Air Force.
Chris Eagle is a senior lecturer in the Computer Science Department at the Naval Postgraduate School (NPS) in Monterey, California. A computer engineer/scientist for 25 years, his research interests include computer network attack and defense, computer forensics, and reverse/anti-reverse engineering. He can often be found teaching at Black Hat or spending late nights working on capture the flag at Defcon
Gideon J. Lenkey, CISSP co-founded Ra Security Systems, a network security monitoring and consultancy. He has provided advanced training to the FBI and is the sitting president of the FBI's InfraGard chapter in New Jersey.
Terron Williams, NSA IAM-IEM, CEH, CSSLP, works for Elster Electricity as a Senior Test Engineer with his primary focus on Smart Grid Security. He has served on the editorial board for Hakin9 Magazine.
Table of Contents
Part I: Introduction to Ethical Disclosure
Chapter 1 Ethics of Ethical Hacking
Chapter 2 Ethical Hacking and the Legal System
Chapter 3 Proper and Ethical Disclosure
Part II: Penetration Testing and Tools
Chapter 4 Social Engineering Attacks
Chapter 5 Physical Penetration Attacks
Chapter 6 Insider Attacks
Chapter 7 Using the BackTrack Linux Distribution
Chapter 8 Using Metasploit
Chapter 9 Managing a Penetration Test
Part III: Exploiting
Chapter 10 Programming Survival Skills
Chapter 11 Basic Linux Exploits
Chapter 12 Advanced Linux Exploits
Chapter 13 Shellcode Strategies
Chapter 14 Writing Linux Shellcode
Chapter 15 Windows Exploits
Chapter 16 Understanding and Detecting Content-Type Attacks
Chapter 17 Web Application Security Vulnerabilities
Chapter 18 VoIP Attacks
Chapter 19 SCADA Attacks
Part IV: Vulnerability Analysis
Chapter 20 Passive Analysis
Chapter 21 Advanced Static Analysis with IDA Pro
Chapter 22 Advanced Reverse Engineering
Chapter 23 Client-Side Browser Exploits
Chapter 24 Exploiting the Windows Access Control Model
Chapter 25 Intelligent Fuzzing with Sulley
Chapter 26 From Vulnerability to Exploit
Chapter 27 Closing the Holes: Mitigation
Part V: Malware Analysis
Chapter 28 Collecting Malware and Initial Analysis
Chapter 29 Hacking Malware