Metasploit: The Penetration Tester's Guide
by Zeljka Zorz - Wednesday, 28 March 2012.
Author: David Kennedy, Jim O’Gorman, Devon Kearns and Mati Aharoni
Pages: 328
Publisher: No Starch Press
ISBN: 159327288X



Introduction

Metasploit Framework (MF), the open source tool for launching exploits against remote machines, is a well-loved instrument that allows penetration testers to automate routine and complex tasks. This book explains how to use it and other assorted tools and will have you up and running your own exploits in a flash.

About the authors

David Kennedy is CISO at Diebold Incorporated and creator of the Social-Engineer Toolkit, Fast-Track, and other open source tools.

Jim O'Gorman (Elwood) is a professional penetration tester, an instructor at Offensive Security, and manages Offensive Security’s consulting services.

Devon Kearns is an instructor at Offensive-Security, a BackTrack developer, and administrator of The Exploit Database.

Mati Aharoni is the creator of BackTrack and founder of Offensive-Security.

Inside the book

The book starts with two very short chapters about basic penetration testing and introduces the tools within the MF.

As it continues through the various phases of a penetration test (pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post exploitation and reporting), the authors slowly introduce various tools (the Meterpreter, the Social-Engineering Toolkit, Fast-Track, Karmetasploit, and Metasploit's modules) and concepts such as antivirus evasion techniques, browser bugs and client-side exploitation, social-engineering attacks, fuzzing, the creation of one's own exploitation modules, and more.

Each chapter builds upon the knowledge shared in the previous one in a very organic and seamless way. The language is as technical as it needs to be and the explanations clear.

All the chapters are a finely balanced combination of text, code, screenshots and tips, and coupled with a machine on which the reader can try out everything he reads about, this book is the perfect guide for those beginning to work with Metasploit. Experienced penetration testers and MF users will likely skip a lot of the content, but could find it useful as a reference.

In order to understand the things shared in it, the reader should be familiar with Ruby and/or Python, as many of the examples shown are written in one of those two programming languages.

Final thoughts

HD Moore, the founder of the Metasploit Project, wholeheartedly recommends the book - and who am I to say otherwise?

But, in all seriousness, it is a very helpful and interesting book for beginners, especially those who like to learn by doing - every chapter is like a thoroughly documented project covered from beginning to end.



Spotlight

The role of the cloud in the modern security architecture

Posted on 31 July 2014.  |  Stephen Pao, General Manager, Security Business at Barracuda Networks, offers advice to CISOs concerned about moving the secure storage of their documents into the cloud and discusses how the cloud shaping the modern security architecture.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Aug 1st
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //