Most Helpful Customer Reviews
11 of 12 people found the following review helpful:
5.0 out of 5 stars
"Metasploit - The Penetration Tester's Guide" by Mati Aharoni, Devon Kearns, Jim O'Gorman, David Kennedy; No Starch Press, December 5, 2011
This review is from: Metasploit: The Penetration Tester's Guide (Paperback)
I'm an accomplished test automation/performance engineer, but one area of testing that I'm pretty green at is penetration testing. Luckily, I came across Metasploit: The Penetration Tester's Guide, which is a book about penetration testing using the opensource Metasploit Framework testing and is a great introduction to security testing in general. Since I'm a complete novice when it comes to Metasploit, the book was great for getting me started with the basics of the framework. (A more experience Metasploit user, however, will probably want to read something a bit more advanced.)
The book assumes the reader has zero experience, and begins with a brief history of Metasploit and how to install it. Although you don't need to be a programmer to read it, most of the examples are written in Ruby and Python. You should also be familiar with Linux and how to set up VMs.
Overall, the book is written with a hands-on, tutorial-like style that is great for people like me who prefer to learn by doing. The book is a progression, beginning by establishing the methodologies/phases and terminology of penetration testing and an intro to the utilities and functions within the Metasploit framework. The first few chapters are a great help in getting up to speed on what penetration testing is and provide a nice overview of the different phases of a penetration test. The author then walks you through how to identify different types of vulnerabilities and how to exploit them using the tool. I really liked the sections on how to attack MS SQL, Browser-Based & File exploits and Social Engineering attacks. Many different modules of the framework are covered, as well as how to create a module. The book ends with a realistic simulation of an actual penetration test.
The author states that the book is "designed to teach you everything from the fundamentals of the Framework to advanced techniques in exploitation," and I believe the author excels in fulfilling that goal.
Note: I received a free copy of this book as part of the O'Reilly Blogger Review program.
Joe Colantonio
[...]
Help other customers find the most helpful reviews
Was this review helpful to you? Yes
No
4 of 4 people found the following review helpful:
5.0 out of 5 stars
Definitive Metasploit reference, January 3, 2012
This review is from: Metasploit: The Penetration Tester's Guide (Paperback)
People who design networks or build software applications are often oblivious to security faults that their designs may have. Those serious about information security will perform or will have an outside firm perform a penetration test--which is a way to evaluate how effective the security of a network or application is. Those performing a penetration test will imitate what an attacker would do in an adversarial situation to see how the system holds up. The Metasploit Project is an open-source security project that provides information about security vulnerabilities and assists those performing the penetration tests in building a framework in which to carry out the testing. For those looking to use the Metasploit to its fullest, Metasploit: The Penetration Tester's Guide is a valuable aid. Metasploit itself is an extremely powerful tool, but it is not an intui-tive piece of software. While there's documentation on Metasploit available at the project Web site, the authors use the book to help the reader become more fluent in how to use the base Metasploit methodology to be an effective penetration tester. The first two chapters provide an introduction to penetration testing and Metasploit. By chapter four, the reader is deep in the waters of penetration testing. The book progressively advances in complexity. And by the time the reader finishes chapter 17, he or she should have a high comfort level on how to use Metasploit. The book is meant for someone who is technical and needs to be hands-on with Metasploit and really understand it. For firms that are looking to do their own penetration testing, Metasploit is a free open-source tool, also used by firms that charge for the service. For those looking to jump on the Metasploit bandwagon, this book is a great way to do that.
Help other customers find the most helpful reviews
Was this review helpful to you? Yes
No
27 of 39 people found the following review helpful:
3.0 out of 5 stars
Good to a certain point, August 3, 2011
This review is from: Metasploit: The Penetration Tester's Guide (Paperback)
I really enjoyed reading the Metasploit book. I would have to agree with one of the readers that most of the information can be found on the Metasploit Unleashed website. My only problem is that it did not push the envelope on the advance features of Metasploit. But over all this is still one hell of a book.
Help other customers find the most helpful reviews
Was this review helpful to you? Yes
No
|
