Hot answers tagged books
11
I am partial to the appsec side of penetration-testing.
Hunting Security Bugs
The Art of Software Security Assessment
Secure Programming with Static Analysis
Open-Source Fuzzing Tools
Fuzzing for Software Security Testing and Quality Assurance
Gray Hat Hacking, 3rd Edition
Advanced Windows Debugging
How to Break Software
Seven Deadliest Web Application ...
10
I really enjoyed
Erickson's Hacking: The Art of Exploitation
Fyodor's own Nmap Network Scanning
I have also heard heard great things about, but haven't read yet,
The Web Application Hacker's Handbook
A Guide to Kernel Exploitation
6
As a penetration tester I don't think that books are the best medium, because there is no substitute for experience. Hunt for bugs in open source software, obtain CVE's and put that on your resume.
...That being said there are books that I have enjoyed and that i think are relevant to modern systems:
The Tangled Web
Cryptography Engineering ...
6
There is no opposition between "linear algebra" and "discrete math". For instance, a Linear Feedback Shift Register is "linear" in the sense of linear algebra, but also totally discrete. What is seldom encountered in computers is not the "linear" part, but the use of real or complex numbers as base field -- because computers are not good at storing numbers ...
5
Yes, this is feasible, but you will need to study intensively.
I have some recommendations that may help in learning this material:
Learn about TCP/IP. I recommend TCP/IP Illustrated, by Stevens, but any other network book may be a fine alternative. Anotehr useful textbook may be Computer Networking: A Top-Down Approach by Kurose and Ross. Make sure to ...
5
You could do much worse than Hacking Exposed. It's a really good introduction to this side of things, along with the associated series like Hacking Linux Exposed and similar books on Windows, Wireless Security etc.
Update: Should have mentioned the OSSTMM as well - as far as general security testing methodology goes, it's not bad.
5
Yes, not only is linear algebra required in many computer science programs it also has security implications.
Linear Algebra can be used to detect doctored photographs.
Vector Clocks are important in distributed systems and time can play a role in security.
Linear algebra is also used in GPS and Missie Guidance. GPS Spoofing requires Linear Algebra ...
4
If you don't want to read straight from standards, and you are looking something in book form, this is a nice primer, (fairly) entry level into smart card security: http://www.amazon.com/Smart-Cards-Tokens-Security-Applications/dp/1441944265 . It's written by two university professors and is the course book on a msc course about smart cards.
For a more ...
4
Depending on what you are looking for there is a lot of technologies covering the smart card topic. Some of them coming to my mind:
ISO 7816: cards with contact http://www.cardwerk.com/smartcards/smartcard_standard_ISO7816.aspx
ISO 14443: contactless smart cards
http://en.wikipedia.org/wiki/ISO/IEC_14443
PKCS#15: Cryptographic Token Information Format ...
4
To add to some other answers as people have mentioned there's a lot of different areas to security and they're not all suited to book-based learning. That said you could look at Security Engineering by Ross Anderson. This is what popped into my head first when you said you're looking for a security equivalent to SICP.
It's somewhat academic in tone, but ...
4
Understanding how a network actually works is tightly connected to the fact that Computer Networks and how they are integrated into systems, have a hierachichal structure. Learning the rules and behaviours of each level of this structure is fundemental to understanding how computer networks and protocols behave in each and every situation.
I recommend ...
4
I think what the book is saying is that if you can come up with such a specific query that there are only a few results, you can identify one particular target in the database.
For example, if a car dealer had a database of customers, and they "anonymized" the database to include only zip code, make, model, year, color, and salary, you could find your ...
3
To add to the answers provided, some personal favourites -
nmap : a must-have book and tool
SQL Injection Attacks and Defense
Metasploit Pen-Testers Guide
Web Application Hacker's Handbook Edition 2 (there are some good additions to Edition 1 mentioned above)
On a side-note, if you're a beginner and truly want to learn then books won't totally cut it ...
3
To an extent it varies depending on the types of testing that you're looking at. Here's some one's I've liked.
Infrastructure/General
Hacking Exposed 6 - canonical series on infrastructure hacking, and has some good information.
NMAP Network Scanning - If you use nmap (and if you're testing you will) this book is an excellent way to really get to ...
3
Security doesn't have a bible. Security discussion stems from insecure practices, and those are often dependent upon the problem at hand. Because most issues today were minor or not critical a decade ago, there isn't a solid published pragma. The field is just starting to really mature.
Without the concrete truths of computer science, developing such a ...
3
Your question is too broad in scope for an answer. 'Security' covers such a vast scope. Network security, OS security, application security, device security, physical security, human security. These are all topics that an IT security professional needs to have experience and knowledge in, and there can be no single point of reference to spring from.
Sources ...
2
My Pick:
Penetration Tester’s Open Source Toolkit, Vol. 2
Dissecting the Hack: The F0rb1dd3n Network, Revised Edition
Ninja Hacking: Unconventional Penetration Testing Tactics and Techniques
Hacking: The Next Generation (Animal Guide)
Gray Hat Hacking, Second Edition: The Ethical Hacker’s Handbook
Google Hacking for Penetration Testers
Professional Pen ...
2
"Security Power Tools" (O'Reilly Media, 2007) has a chapter on Scapy.
"Python for Unix and Linux System Administration" (O'Reilly Media, 2008) also has a short section on Scapy
Both of those books are available on Safari Books Online.
But, it looks like the various online documentation sources are the best bet.
2
The content CEHv7 exam is very similar to the CEHv6 one. So if you have any resources for the v6, definitely use it, or get some CEH related books from Amazon. CEH is focused on tools and details, so pay special attention to port numbers, frequently mentioned tools, attack types, ...
2
You seem to want something specific, so I'm going to take a different approach than the others and offer a single solution to your constraints.
One word: Wireshark.
The Tool
The tool is free and is in the top 3 tools network pros use regularly. It is possibly the best tool for packet analysis. I taught networking and protocols as a Department Head for a ...
2
Selecting it through a SQL query only, you could check suggestion to this question. Both answers there are more or less equal (JOIN, when it's type is not specified, defaults to INNER JOIN in most RDBMS anyway).
This is however highly inefficient way of producing results with a minimum number of records. A lot easier, but also faster, would be to check for ...
1
Reversing: Secrets of Reverse Engineering (2005)
Disassembling Code: IDA Pro & SoftICE Book/CD Package: IDA Pro and SoftICE (2006)
Hacking: The Art of Exploitation Book/CD Package 2nd Edition (2007)
Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code (2008)
Personally I really liked the Reversing: Secrets of..
A must ...
1
Network related:
Books:
Computer Networking: A Top-Down Approach
Internetworking with TCP/IP
Security related:
Certified Ethical Hacking(CEH) gives you a good approach on
network security. It gives good guidelines & reviews most important tools aswell, such as Snort, wireshark and more.
- Some of what the course covers:(Also, there are video ...
1
A lot of really good answers here with some great resources. Consider another approach if you have a budget.
https://www.sans.org/security-training/security-essentials-bootcamp-style-61-mid
This is a really great foundation of security knowledge. I'm not affiliated with SANS but I have taken and certified in 3 of their courses.
1
Depending on your level of knowledge, this may be of interest...
Recently I learned that a professor at RIT has been making a series of youtube videos going over basic network protocols and packet analysis. He calls it The Chicken Protocol and it seems to be meant for beginners. He even has a "Packet of the Week" (PoW) which he goes over. So if you're ...
1
One thing I should point about this question is:
if you want to learn and stick something in your mind, just CODE it !
I think with this method you can understand complex concepts more thoroughly. In networking, keep using Java,C or C++ or some useful application as a helper method besides books or papers. One of these useful applications is Wireshark. ...
1
I'm trying to pick up networking security within a reasonable amount of time... Is this feasible?
Yes, it most certainly is. But with two caveats:
You'll need to spend a good amount of time each day studying (not just reading a chapter a day and calling it good).
You'll need to invest a lot more time applying what you've learned. Applying your ...
1
I agree the request is far too vague.
But to get you started here is an older but still applicable general security practices overview from sans:
http://www.sans.org/reading_room/whitepapers/bestprac/system-administrator-security-practices_657
And here is a book that should be exactly what you're looking for, as I feel you should look more towards the ...
1
you can check this website http://www.windowsecurity.com/ , and also there are videos from pluralsight about windows security but they are a bit outdated ,sans institute also offers a good course and it can be found here https://www.sans.org/security-training/securing-windows-77-mid , search amazon for this book .NET-Developers-Guide-Windows-Security it is ...
1
I recommend the Security Now podcast especially if you have some commute time. There is over 400 hours of of security information.
http://www.grc.com/securitynow.htm For an episode guide and transcripts.
GRC also has some good security tools and info.
http://twit.tv/sn Is the main site.
Only top voted, non community-wiki answers of a minimum length are eligible
