- This much-anticipated revision, written by the ultimate group of top security experts in the world, features 40 percent new content on how to find security holes in any operating system or application
- New material addresses the many new exploitation techniques that have been discovered since the first edition, including attacking "unbreakable" software packages such as McAfee's Entercept, Mac OS X, XP, Office 2003, and Vista
- Also features the first-ever published information on exploiting Cisco's IOS, with content that has never before been explored
- The companion Web site features downloadable code files
The Shellcoder's Handbook
and over one million other books are available for Amazon Kindle.
Learn more
FREE Two-Day Shipping for students on millions of items. Learn more |
| |||||||||||||||
 Sell Back Your Copy for $15.72
Whether you buy it used on Amazon for $24.99 or somewhere else, you can sell it back through our Book Trade-In Program at the current price of $15.72.
Used Price$24.99
Trade-in Price$15.72
Price after
Trade-in$9.27 |
Book Description
Frequently Bought Together
Editorial Reviews
From the Back Cover
The black hats have kept up with security enhancements. Have you?
In the technological arena, three years is a lifetime. Since the first edition of this book was published in 2004, built-in security measures on compilers and operating systems have become commonplace, but are still far from perfect. Arbitrary-code execution vulnerabilities still allow attackers to run code of their choice on your system—with disastrous results.
In a nutshell, this book is about code and data and what happens when the two become confused. You'll work with the basic building blocks of security bugs—assembler, source code, the stack, the heap, and so on. You'll experiment, explore, and understand the systems you're running—and how to better protect them.
- Become familiar with security holes in Windows, Linux, Solaris, Mac OS X, and Cisco's IOS
Learn how to write customized tools to protect your systems, not just how to use ready-made ones
Use a working exploit to verify your assessment when auditing a network
Use proof-of-concept exploits to rate the significance of bugs in software you're developing
Assess the quality of purchased security products by performing penetration tests based on the information in this book
Understand how bugs are found and how exploits work at the lowest level
About the Author
Chris Anley is a founder and director of NGSSoftware, a security software, consultancy, and research company based in London, England. He is actively involved in vulnerability research and has discovered security flaws in a wide variety of platforms including Microsoft Windows, Oracle, SQL Server, IBM DB2, Sybase ASE, MySQL, and PGP.
John Heasman is the Director of Research at NGSSoftware. He is a prolific security researcher and has published many security advisories in enterprise level software. He has a particular interest in rootkits and has authored papers on malware persistence via device firmware and the BIOS. He is also a co-author of The Database Hacker’s Handbook: Defending Database Servers (Wiley 2005).
Felix “FX” Linder leads SABRE Labs GmbH, a Berlin-based professional consulting company specializing in security analysis, system design creation, and verification work. Felix looks back at 18 years of programming and over a decade of computer security consulting for enterprise, carrier, and software vendor clients. This experience allows him to rapidly dive into complex systems and evaluate them from a security and robustness point of view, even in atypical scenarios and on arcane platforms. In his spare time, FX works with his friends from the Phenoelit hacking group on different topics, which have included Cisco IOS, SAP, HP printers, and RIM BlackBerry in the past.
Gerardo Richarte has been doing reverse engineering and exploit development for more than 15 years non-stop. In the past 10 years he helped build the technical arm of Core Security Technologies, where he works today. His current duties include developing exploits for Core IMPACT, researching new exploitation techniques and other low-level subjects, helping other exploit writers when things get hairy, and teaching internal and external classes on assembly and exploit writing. As result of his research and as a humble thank you to the community, he has published some technical papers and open source projects, presented in a few conferences, and released part of his training material. He really enjoys solving tough problems and reverse engineering any piece of code that falls in his reach just for the fun of doing it.
Product Details
Would you like to update product info or give feedback on images?
|
More About the Authors
Discover books, learn about writers, read author blogs, and more.
Customer Reviews
|
Share your thoughts with other customers:
|
||||||||||||||||||||||
|
Most Helpful Customer Reviews
1 of 1 people found the following review helpful:
4.0 out of 5 stars
Very good, explaing the basic, but... (read my review),
Amazon Verified Purchase(What's this?)
This review is from: The Shellcoder's Handbook: Discovering and Exploiting Security Holes (Paperback)
Basically this book is very good. It goes through the basic to some advanced techniques. The author tried to cover a lot of Operating Systems, from x86 (Windows and Linux) to Mac, Sparks and Cisco, so you should be aware whether this is your focus or not, if not you will take advantage of a few chapters of the book. In my case, I was interested just in x86 shellcode programming, so I should paid half of the price (just kidding). Also, it does not explain advanced techniques (such as code obfuscation, self-modification, etc), but it's very good for intermediate coders. Recommended.
1 of 1 people found the following review helpful:
3.0 out of 5 stars
Good, but not ideal,
Amazon Verified Purchase(What's this?)
This review is from: The Shellcoder's Handbook: Discovering and Exploiting Security Holes (Kindle Edition)
This book serves as a good introduction to shell coding. The first 6 chapters on linux are reasonably complete; if you read the material and take the time to learn the concepts you will be happy with your progress. However, as the book dives into other operating systems I feel that some of this completeness and solidarity are vanishing. As I get deeper and deeper into the text, there are more and more words and concepts which are prerequisite yet the authors never explained. It feels like they were very comprehensive and diligent in the first chapters, but got lazy and impatient as it progressed.
1 of 3 people found the following review helpful:
5.0 out of 5 stars
The best out there, but not so different from the first edition,
By Mario Vilas (Argentina) - See all my reviews
This review is from: The Shellcoder's Handbook: Discovering and Exploiting Security Holes (Paperback)
Loved it, I think this is the best book on shellcode out there. The only downside is, there isn't so much new content compared to the first edition. Other than that, this book is definitely a must if you're after low-level knowledge on computer security.
Share your thoughts with other customers: Create your own review
|
|
Inside This Book
(learn more)
Key Phrases - Statistically Improbable Phrases (SIPs):
(learn more)
unhandled exception filter, stack overflows, windows shellcode, binary auditing, source code auditing, process environment block, heap protections, structured exception handling, exception registration structure, saved register window, syscall proxies, payload strategies, add byte ptr, heap block header, kernel overflows, fault injection component, heap management structures, saved return address, kernel vulnerabilities, default process heap, auditing binaries, arbitrary memory overwrite, unsigned char shellcode, fake chunk, push dword ptr Key Phrases - Capitalized Phrases (CAPs): (learn more)
Other Platforms-Windows, Advanced Materials, Solaris Exploitation, Protection Mechanisms, Windows Overflows, Windows Vista, Service Pack, Exploiting Unix Kernel Vulnerabilities, Visual Studio, Alternative Payload Strategies, Hacking the Windows Kernel, David Litchfield, Manual Approach, Hacking Closed Source Software, Check Heaps, Attacking Database Software, The Art of Fuzzing, Unix Kernel Overflows, Load Configuration Directory, Dave Aitel, Working Environment, Venetian Method, Code Red, Thread Environment Block, General Public License New!
Concordance | Text Stats Browse Sample Pages:
Front Cover | Table of Contents | First Pages | Index | Back Cover | Surprise Me!
unhandled exception filter, stack overflows, windows shellcode, binary auditing, source code auditing, process environment block, heap protections, structured exception handling, exception registration structure, saved register window, syscall proxies, payload strategies, add byte ptr, heap block header, kernel overflows, fault injection component, heap management structures, saved return address, kernel vulnerabilities, default process heap, auditing binaries, arbitrary memory overwrite, unsigned char shellcode, fake chunk, push dword ptr Key Phrases - Capitalized Phrases (CAPs): (learn more)
Other Platforms-Windows, Advanced Materials, Solaris Exploitation, Protection Mechanisms, Windows Overflows, Windows Vista, Service Pack, Exploiting Unix Kernel Vulnerabilities, Visual Studio, Alternative Payload Strategies, Hacking the Windows Kernel, David Litchfield, Manual Approach, Hacking Closed Source Software, Check Heaps, Attacking Database Software, The Art of Fuzzing, Unix Kernel Overflows, Load Configuration Directory, Dave Aitel, Working Environment, Venetian Method, Code Red, Thread Environment Block, General Public License New!
Concordance | Text Stats Browse Sample Pages:
Front Cover | Table of Contents | First Pages | Index | Back Cover | Surprise Me!
What Other Items Do Customers Buy After Viewing This Item?
Tags Customers Associate with This Product(What's this?)Click on a tag to find related items, discussions, and people.
|
Customer Discussions
|
This product's forum
Active discussions in related forums
Search Customer Discussions
|
Related forums
|
![[Start the discussion]](http://g-ecx.images-amazon.com/images/G/01/x-locale/communities/discussion_boards/start-new-discussion-sec._V192250339_.gif){kind=small}
