Metasploit: The Penetration Tester's Guide
by Zeljka Zorz - Wednesday, 28 March 2012.
Author: David Kennedy, Jim O’Gorman, Devon Kearns and Mati Aharoni
Pages: 328
Publisher: No Starch Press
ISBN: 159327288X



Introduction

Metasploit Framework (MF), the open source tool for launching exploits against remote machines, is a well-loved instrument that allows penetration testers to automate routine and complex tasks. This book explains how to use it and other assorted tools and will have you up and running your own exploits in a flash.

About the authors

David Kennedy is CISO at Diebold Incorporated and creator of the Social-Engineer Toolkit, Fast-Track, and other open source tools.

Jim O'Gorman (Elwood) is a professional penetration tester, an instructor at Offensive Security, and manages Offensive Security’s consulting services.

Devon Kearns is an instructor at Offensive-Security, a BackTrack developer, and administrator of The Exploit Database.

Mati Aharoni is the creator of BackTrack and founder of Offensive-Security.

Inside the book

The book starts with two very short chapters about basic penetration testing and introduces the tools within the MF.

As it continues through the various phases of a penetration test (pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post exploitation and reporting), the authors slowly introduce various tools (the Meterpreter, the Social-Engineering Toolkit, Fast-Track, Karmetasploit, and Metasploit's modules) and concepts such as antivirus evasion techniques, browser bugs and client-side exploitation, social-engineering attacks, fuzzing, the creation of one's own exploitation modules, and more.

Each chapter builds upon the knowledge shared in the previous one in a very organic and seamless way. The language is as technical as it needs to be and the explanations clear.

All the chapters are a finely balanced combination of text, code, screenshots and tips, and coupled with a machine on which the reader can try out everything he reads about, this book is the perfect guide for those beginning to work with Metasploit. Experienced penetration testers and MF users will likely skip a lot of the content, but could find it useful as a reference.

In order to understand the things shared in it, the reader should be familiar with Ruby and/or Python, as many of the examples shown are written in one of those two programming languages.

Final thoughts

HD Moore, the founder of the Metasploit Project, wholeheartedly recommends the book - and who am I to say otherwise?

But, in all seriousness, it is a very helpful and interesting book for beginners, especially those who like to learn by doing - every chapter is like a thoroughly documented project covered from beginning to end.



Spotlight

The synergy of hackers and tools at the Black Hat Arsenal

Posted on 27 August 2014.  |  Tucked away from the glamour of the vendor booths and the large presentation rooms filled with rockstar sessions, was the Arsenal - a place where developers were able to present their security tools and grow their community.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Mon, Sep 1st
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //