Tag Info

Hot answers tagged

11

I am partial to the appsec side of penetration-testing. Hunting Security Bugs The Art of Software Security Assessment Secure Programming with Static Analysis Open-Source Fuzzing Tools Fuzzing for Software Security Testing and Quality Assurance Gray Hat Hacking, 3rd Edition Advanced Windows Debugging How to Break Software Seven Deadliest Web Application ...


11

If you're looking for non-language/framework specific stuff, you could start with a pair of books on security engineering Security Engineering by Ross Anderson Engineering Security by Peter Gutmann Usefully both are available for free online. If you're looking for more platform specific stuff, if you haven't already I'd recommend looking through ...


10

I really enjoyed Erickson's Hacking: The Art of Exploitation Fyodor's own Nmap Network Scanning I have also heard heard great things about, but haven't read yet, The Web Application Hacker's Handbook A Guide to Kernel Exploitation


6

As a penetration tester I don't think that books are the best medium, because there is no substitute for experience. Hunt for bugs in open source software, obtain CVE's and put that on your resume. ...That being said there are books that I have enjoyed and that i think are relevant to modern systems: The Tangled Web Cryptography Engineering ...


6

There is no opposition between "linear algebra" and "discrete math". For instance, a Linear Feedback Shift Register is "linear" in the sense of linear algebra, but also totally discrete. What is seldom encountered in computers is not the "linear" part, but the use of real or complex numbers as base field -- because computers are not good at storing numbers ...


5

Yes, this is feasible, but you will need to study intensively. I have some recommendations that may help in learning this material: Learn about TCP/IP. I recommend TCP/IP Illustrated, by Stevens, but any other network book may be a fine alternative. Anotehr useful textbook may be Computer Networking: A Top-Down Approach by Kurose and Ross. Make sure to ...


5

You could do much worse than Hacking Exposed. It's a really good introduction to this side of things, along with the associated series like Hacking Linux Exposed and similar books on Windows, Wireless Security etc. Update: Should have mentioned the OSSTMM as well - as far as general security testing methodology goes, it's not bad.


5

Yes, not only is linear algebra required in many computer science programs it also has security implications. Linear Algebra can be used to detect doctored photographs. Vector Clocks are important in distributed systems and time can play a role in security. Linear algebra is also used in GPS and Missie Guidance. GPS Spoofing requires Linear Algebra ...


4

If you don't want to read straight from standards, and you are looking something in book form, this is a nice primer, (fairly) entry level into smart card security: http://www.amazon.com/Smart-Cards-Tokens-Security-Applications/dp/1441944265 . It's written by two university professors and is the course book on a msc course about smart cards. For a more ...


4

Depending on what you are looking for there is a lot of technologies covering the smart card topic. Some of them coming to my mind: ISO 7816: cards with contact http://www.cardwerk.com/smartcards/smartcard_standard_ISO7816.aspx ISO 14443: contactless smart cards http://en.wikipedia.org/wiki/ISO/IEC_14443 PKCS#15: Cryptographic Token Information Format ...


4

To add to some other answers as people have mentioned there's a lot of different areas to security and they're not all suited to book-based learning. That said you could look at Security Engineering by Ross Anderson. This is what popped into my head first when you said you're looking for a security equivalent to SICP. It's somewhat academic in tone, but ...


4

Understanding how a network actually works is tightly connected to the fact that Computer Networks and how they are integrated into systems, have a hierachichal structure. Learning the rules and behaviours of each level of this structure is fundemental to understanding how computer networks and protocols behave in each and every situation. I recommend ...


4

I think what the book is saying is that if you can come up with such a specific query that there are only a few results, you can identify one particular target in the database. For example, if a car dealer had a database of customers, and they "anonymized" the database to include only zip code, make, model, year, color, and salary, you could find your ...


4

A few things from a Secure OS: https://en.wikipedia.org/wiki/OpenBSD_security_features Exploit Mitigation Techniques: an Update After 10 Years: http://www.openbsd.org/papers/ru13-deraadt/ http://tech.yandex.com/events/ruBSD/2013/talks/103/ http://www.openbsd.org/papers/ or: on Youtube: "passwords^12"


3

To add to the answers provided, some personal favourites - nmap : a must-have book and tool SQL Injection Attacks and Defense Metasploit Pen-Testers Guide Web Application Hacker's Handbook Edition 2 (there are some good additions to Edition 1 mentioned above) On a side-note, if you're a beginner and truly want to learn then books won't totally cut it ...


3

To an extent it varies depending on the types of testing that you're looking at. Here's some one's I've liked. Infrastructure/General Hacking Exposed 6 - canonical series on infrastructure hacking, and has some good information. NMAP Network Scanning - If you use nmap (and if you're testing you will) this book is an excellent way to really get to ...


3

Security doesn't have a bible. Security discussion stems from insecure practices, and those are often dependent upon the problem at hand. Because most issues today were minor or not critical a decade ago, there isn't a solid published pragma. The field is just starting to really mature. Without the concrete truths of computer science, developing such a ...


3

Your question is too broad in scope for an answer. 'Security' covers such a vast scope. Network security, OS security, application security, device security, physical security, human security. These are all topics that an IT security professional needs to have experience and knowledge in, and there can be no single point of reference to spring from. Sources ...


3

All the apps on an Android device have their own updates, which are then fed to the devices through the normal app channels (say, Google Play). This covers not only the apps you have downloaded, but also the apps which were provided with your device (I know that my phone regularly nags me about an update for the Facebook app which came with the device OS). ...


2

My Pick: Penetration Tester’s Open Source Toolkit, Vol. 2 Dissecting the Hack: The F0rb1dd3n Network, Revised Edition Ninja Hacking: Unconventional Penetration Testing Tactics and Techniques Hacking: The Next Generation (Animal Guide) Gray Hat Hacking, Second Edition: The Ethical Hacker’s Handbook Google Hacking for Penetration Testers Professional Pen ...


2

"Security Power Tools" (O'Reilly Media, 2007) has a chapter on Scapy. "Python for Unix and Linux System Administration" (O'Reilly Media, 2008) also has a short section on Scapy Both of those books are available on Safari Books Online. But, it looks like the various online documentation sources are the best bet.


2

The content CEHv7 exam is very similar to the CEHv6 one. So if you have any resources for the v6, definitely use it, or get some CEH related books from Amazon. CEH is focused on tools and details, so pay special attention to port numbers, frequently mentioned tools, attack types, ...


2

You seem to want something specific, so I'm going to take a different approach than the others and offer a single solution to your constraints. One word: Wireshark. The Tool The tool is free and is in the top 3 tools network pros use regularly. It is possibly the best tool for packet analysis. I taught networking and protocols as a Department Head for a ...


2

Selecting it through a SQL query only, you could check suggestion to this question. Both answers there are more or less equal (JOIN, when it's type is not specified, defaults to INNER JOIN in most RDBMS anyway). This is however highly inefficient way of producing results with a minimum number of records. A lot easier, but also faster, would be to check for ...


2

There are many avenues of exploitation, and as you're noticing, they constantly evolve. Your best bet is to attend a major conference like Black Hat, take copious notes from the briefings, and learn from the people who are actively exploiting systems today. The speakers know that by the time they finish writing a book it's likely going to be out of date, ...


1

Reversing: Secrets of Reverse Engineering (2005) Disassembling Code: IDA Pro & SoftICE Book/CD Package: IDA Pro and SoftICE (2006) Hacking: The Art of Exploitation Book/CD Package 2nd Edition (2007) Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code (2008) Personally I really liked the Reversing: Secrets of.. A must ...


1

Network related: Books: Computer Networking: A Top-Down Approach Internetworking with TCP/IP Security related: Certified Ethical Hacking(CEH) gives you a good approach on network security. It gives good guidelines & reviews most important tools aswell, such as Snort, wireshark and more. - Some of what the course covers:(Also, there are video ...


1

A lot of really good answers here with some great resources. Consider another approach if you have a budget. https://www.sans.org/security-training/security-essentials-bootcamp-style-61-mid This is a really great foundation of security knowledge. I'm not affiliated with SANS but I have taken and certified in 3 of their courses.


1

Depending on your level of knowledge, this may be of interest... Recently I learned that a professor at RIT has been making a series of youtube videos going over basic network protocols and packet analysis. He calls it The Chicken Protocol and it seems to be meant for beginners. He even has a "Packet of the Week" (PoW) which he goes over. So if you're ...


1

One thing I should point about this question is: if you want to learn and stick something in your mind, just CODE it ! I think with this method you can understand complex concepts more thoroughly. In networking, keep using Java,C or C++ or some useful application as a helper method besides books or papers. One of these useful applications is Wireshark. ...



Only top voted, non community-wiki answers of a minimum length are eligible