A few weeks ago I excitedly opened my latest book review mailing and inside I found “The Basics of Hacking and Penetration Testing – Ethical Hacking and Penetration Testing Made Easy” by Patrick Engebretson. I was gearing up for a business trip to Washington DC and decided that I’d read the book while on my flights and stranded in the hotel at night.
At first glance…
At first glance the book is very inviting and by flipping through the pages I found that there are numerous graphics and there are many “Alert!” callouts with special information and screenshots that visualize the content of the text. To give an idea of length, the meat of the book is 155 pages in paperback form – concise enough to be read in a few sittings but not so long that I felt “lost” in the depth of the book.
The author described the intended purpose of this book to be “a very gentle yet thorough guide to the world of hacking and penetration testing” and the text certainly delivers on that goal. As an IT and security professional with 13 years of experience I have dabbled in the world of scanning and penetration testing but have never had cause to “put it all together” and perform end-to-end exploitation – so I felt that my background was well suited for this book.
The author uses the text as a way to expose those without experience in penetration testing to the tools, techniques and approaches behind various penetration testing activities. The text is understandable for those who might not have deep experience in IT and while some of the navigation of the selected penetration testing platform (BackTrack Linux) might be tough to handle for someone without Linux experience, the author did a very good job of ensuring the book contained sufficient information to help a Linux newbie get started – for example, the author gently outlines the process of booting to the BackTrack Linux live CD, starting up the graphical interface, opening terminal and configuring the Ethernet interfaces. It’s attention to detail like this that makes this book ideal for those who have had either little or no Linux exposure as well as those who already “know the ropes” of Linux.
What makes a penetration tester more effective…
The book not only guides the reader through the use of the tools, but also teaches some of the background behind the process of penetration testing – the concepts of “when to do what” which really make a penetration tester more effective – after all, anyone can pick up a copy of BackTrack Linux and run the tools, but without contextual training those tools are less effective.
A word of advice when reading this book: The reader should set aside time, and a workstation (or VM instance) to allow you to “follow along” with the author as he guides the reader through the standard four-step process of reconnaissance, scanning, exploitation and maintaining access. By having an instance of BackTrack Linux running in front of the reader, it allows more complete immersion into the educational “flow” of the book. Once I had my instance of BackTrack running in VMWare player, I spent two nights reading and executing the penetration testing tools and techniques outlined in the book including (but not at all limited to) Google Hacking, Nmap, Nessus, Medusa, Metasploit, and Wireshark. Since the last step in the process is maintaining access, the book also covers the process of implementing (as well as identifying and mitigating) remote access capabilities and rootkits.
The book wraps up by evaluating the process of writing the penetration testing report – while this section is not long it does provide sufficient detail to convey the idea that a penetration testing report is as important as the testing itself and should be handled seriously and professionally since the report is what will really be seen by management (and therefore reflect on the tester).
For those looking for a basic introduction into penetration testing and hacking using a Linux platform, this book is an ideal starting point and should certainly be considered – in fact I would say that if I was going to teach a one or two-day beginner’s course on the topic I would consider using this text as the basis for the course. But this book is not only for beginners – for those who have exposure to penetration testing and hacking (as well as the tools used for such) but have never really gotten serious about it this book helps “bridge the gap” and teach the reader how to take limited knowledge of a utility like Nmap and turn it into a powerful tool in an IT professional’s toolbox.