Author: Patrick Engebretson
Pages: 180
Publisher: Syngress
ISBN: 1597496553



Introduction

Have you always wondered about how penetration testing is performed, but never had the opportunity to ask a professional about it to witness him (or her) at work? If that's the case, this book is definitely for you. Simple and to the point, written in a very free and easy manner, it effectively explains all the phases of the pentesting process and introduces a great variety of helpful tools used by the great majority of professionals in this field.

About the author

Dr. Patrick Engebretson obtained his Doctor of Science degree with a specialization in Information Security from Dakota State University. He currently serves as an Assistant Professor of Information Assurance and also works as a Senior Penetration Tester for a security firm in the Midwest.

His research interests include penetration testing, hacking, intrusion detection, exploitation, honey pots, and malware. He regularly attends advanced exploitation and penetration testing trainings from industry recognized professionals and holds several certifications. He teaches graduate and undergraduate courses in penetration testing, wireless security, and intrusion detection, and advanced exploitation.

Inside the book

The book is aimed at novices in the penetration testing field, and at all those who don't intend to work in it, but would like to know what the whole process entails. It also functions as a guide into all the things that hackers can attempt to gain access to systems, effectively becoming a way of building knowledge about offensive security.

The initial chapter gives a great overview of the various and equally important stages of the pentesting effort, and introduces Backtrack, the Linux distribution that comes preloaded with hundreds of security tools, making it the weapon of choice of many pentesters.

Although the author doesn't force you to use this distribution, he strongly recommends it. Any other Linux version would do fine, except for the fact that one is then required to collect and install a great number of tools already bundled with Backtrack.

Throughout all the chapters, Engebretson slowly and organically introduces Linux commands and tools that you need to use during all the phases, and he helpfully explains the commands (in the "Additional Resources" text boxes) in such a way as to make the reader learn the logic behind them and make it more unlikely for him to forget.

According to him, the penetration testing process can be divided into four distinct phases: reconnaissance, scanning, exploitation, and maintaining access, and he dedicates a chapter to each.

Explaining the cyclic nature of the process, he points out that all the phases should be performed as perfectly as they can be. Quality reconnaissance leads to intelligent scanning, which leads to effective exploitation, which leads to an easier maintaining of access.

He says that in their eagerness to begin the actual hacking, budding penetration testers often tend to overlook and underutilize the first phase. "Perhaps they are never formally introduced to the concept, its rewards, or how the results of good information gathering can be vital in later steps," he speculates, and proceeds to effectively point out all the helpful and sometimes crucial things one can learn through passive and active reconnaissance.

Given the number of pages and the primary aim of the book, it's natural that no phase has been covered excessively in-depth. Luckily for the readers, Engebretson has included short but extremely handy "Where Do I Go From Here?" texts at the end of each chapter that are guaranteed to push the reader in the right direction if they want to learn more about each subject and additional tools.

As this is a book mainly for penetration testers, the author peppers the chapters with alerts that often point out the critical differences between a hacker and a penetration tester, and what the latter are not allowed to do if they want to remain on the "good" side.

Final thoughts

If you are searching for a book to get you started with penetration testing, "The Basics of Hacking and Penetration Testing" is the right one. It assumes little and gives a lot, and doesn't require huge amounts of technical knowledge in order to be read or understood.

As complex the subject may sound to novices, the author does a great job explaining it. He eschews techno-babble and when he repeatedly returns to some issues, it's because he has more to say about them, not because he can't think about what to right next.