WRITING SECURE CODE
CHAPTER 1: GETTING STARTED CHAPTER 2: SETTING THE STAGE CHAPTER 3: THE FRAMEWORK CHAPTER 4: THE BUSINESS PERSPECTIVE CHAPTER 5: PLANNING FOR A CONTROLLED ATTACK CHAPTER 6: PREPARING FOR A HACK CHAPTER 7: RECONNAISSANCE CHAPTER 8: ENUMERATION CHAPTER 9: VULNERABILITY ANALYSIS CHAPTER 10: EXPLOITATION CHAPTER 11: THE DELIVERABLE CHAPTER 12: INTEGRATING THE RESULTS CONCLUSION CONTENTS GETTING STARTED HIRING SOMEONE TO HACK YOUR COMPANY GOES BY MANY NAMES, SUCH AS ETHICAL HACKING, PENETRATION TESTING, TIGER TEAMING, INTRUSION TESTING, VULNERABILITY ANALYSIS, AND EVEN SECURITY ASSESSMENT IN ADDITION, EACH TERM HAS DIFFERENT MEANINGS IN DIFFERENT COUNTRIES OR REGIONS THE TERM PENETRATION TESTING DOES NOT GO OVER WELL IN CENTRAL AMERICA AND SOME PLACES IN THE UNITED STATES, WHEREAS THE TERM ETHICAL HACKING IS NOT THE PREFERRED TERM IN WESTERN EUROPE TIGER TEAM IS A DERIVATIVE OF A MILITARY TERM AND I HAVE HEARD IT USED IN TAIWAN AND JAPAN, ANOTHER PLACE THE USE OF THE TERM ETHICAL HACKING, AS THE NAME OF AN ACT, DOES NOT GO OVER WELL NEVERTHELESS, THE MOST PREDOMINANT TERM IS PENETRATION TESTING, MORE COMMONLY REFERRED TO AS PENTESTING THE INTENTION OF THIS BOOK IS SIMPLE: EXPLAIN AND DETAIL THE METHODOLOGIES, FRAMEWORK, AND UNWRITTEN CONVENTIONS PENTESTS SHOULD EXERCISE TO PROVIDE THE MOST VALUE TO ORGANIZATIONS SEEKING TO ENHANCE THEIR SECURITY POSTURE THERE IS A GREAT DEAL OF RESPECT FOR OTHER BOOKS OF SIMILAR TYPE, EXTENSIVE TRAINING ON THE SUBJECT, AND PROFESSIONAL SERVICE ORGANIZATIONS THAT PROVIDE PENTESTING SERVICES ALL THESE CONVEY VALUABLE INFORMATION PERTAINING TO TOOLS AND PROCESSES ON HOW TO USE THEM HOWEVER, IT IS CRITICAL THAT STRUCTURE AND PROCESS COMBINE TO ENSURE ALL PARTIES RECOGNIZE ULTIMATE VALUE AND A COMPANY IS NOT BEING TESTED UNDER POOR ASSUMPTIONS SECURITY IS A LOT OF THINGS COMBINED IN MANY WAYS THAT WILL HAVE VARYING DEGREES OF IMPACT, GOOD AND BAD THIS IS A LESSON IN VALUE AND RISK, AND HOW THEY RELATE TO PENTESTING WITHIN SECURITY, ONE MUST TAKE INTO CONSIDERATION THE HUMAN ELEMENT AS MUCH AS THE TECHNICAL ADDITIONALLY, THERE ARE THE PRAGMATIC ISSUES OF VALUE AND RISK, AND THEIR EFFECTS ON BUSINESS OBJECTIVES THERE ARE SEVERAL AREAS ASSOCIATED WITH PENTESTING THAT HAVE YET TO BE ADDRESSED IN THEIR ENTIRETY FOLLOWING IS A LIST OF CHARACTERISTICS OF PENTESTING AND THE GAP ASSOCIATED WITH EACH THIS BOOK PROVIDES THE FRAMEWORK AND STRUCTURE TO ADDRESS THESE FUNDAMENTAL ISSUES FOCUSING ON TOOLS AND TECHNOLOGY, AND VERY LITTLE ON METHODOLOGY—TODAY, THERE IS A CLEAR UNDERSTANDING OF THE USE AND AVAILABILITY OF TOOLS TO SUPPORT PENTESTING THANKS TO SEVERAL POPULAR REFERENCES, THE PROCESSES OF TECHNICALLY PERFORMING A TEST ARE WELL DOCUMENTED AND REASONABLY WELL ESTABLISHED HOWEVER, ORGANIZATIONS DESPERATELY NEED TO UNDERSTAND THE DETAILS IN THE OVERALL PROCESSES AND HOW TO USE THE TEST AND ITS RESULTS FOR THE BETTERMENT OF THEIR SECURITY POSTURE THIS IS THE ULTIMATE GOAL BEHIND PENTESTING BUT, IRONICALLY, REMAINS ELUSIVE AND A RARITY AMONG THE GREATER POPULATION OF PENTESTING ENGAGEMENTS INTERPRETING THE RESULTS—WHEN A SYSTEM IS DETERMINED “SECURE” BECAUSE IT HAS SURVIVED A CONTROLLED ATTACK, IT DOES NOT NECESSARILY MEAN THAT SYSTEM IS ACTUALLY SECURE THE VAST AMOUNT OF ASSUMPTIONS, LIMITATIONS, AND EXPECTATIONS INHERENT