Review By: Mickey Epperson
07/09/2010

This book presents a three-step methodology for testing network and computer security through penetration. Section one describes the current state of computer hacking and the motivation for penetration testing. Section two describes the testing methodology and its application in three test scenarios, Internet penetration, dial-in penetration, and internal penetration. Section three describes the tools used to perform penetration testing by group, Discovery Tools, Port Scanners, Sniffers, Password Crackers, Windows NT Tools, and Web-Testing Tools.

This book is a beginner’s guide for penetration testing, and no prior knowledge of penetration testing is needed. However, knowledge of networks, TCP/IP, and network security is needed to perform a successful test.

I found it useful to have this book rather than searching for the information on the Web. There is a list of Web sites where you can find more information and mail lists you can join. The methodology presented for penetration testing is straightforward and produces documented, consistent, and repeatable tests. Much of the book is devoted to tools used to perform penetration testing. A description, use, and pros and cons are provided for each tool along with a reference to more information.

The first section of the book describes the hacker community today, the security consultant roles and responsibilities, and categorizes security vulnerabilities. Hackers range from the first-tier hacker who can find and exploit vulnerabilities, to the third-tier known as script kiddies. The majority of hackers fall into the second-tier, with a skill level equivalent to a system administrator or security team member. The roles, responsibilities, and skill level of a security consultant provide good background information if you are hiring a consultant to perform penetration testing, or you are interested in becoming a security consultant. The last chapter in the section describes each category of vulnerability and possibly counter measures.

Section two presents a methodology for penetrations testing. The three-step process consists of discovering the network topology, identifying possible vulnerabilities, and attempting to exploit the vulnerabilities to compromise the network. This gives the beginner a framework for consistent and repeatable testing. I like the importance the authors give to documenting the testing process. Internet penetration testing, dial-in penetration testing, and internal penetration testing are described along with the tools used in the testing process.

The third section describes the tools you can use, both commercial and noncommercial. The tools are grouped by the categories Discovery Tools, Port Scanners, Sniffers, Password Crackers, Windows NT Tools, and Web-Testing Tools. There is enough information about each tool to get you started and references to more information.