Tag Info

Hot answers tagged

16

I am partial to the appsec side of penetration-testing. Hunting Security Bugs The Art of Software Security Assessment Secure Programming with Static Analysis Open-Source Fuzzing Tools Fuzzing for Software Security Testing and Quality Assurance Gray Hat Hacking, 3rd Edition Advanced Windows Debugging How to Break Software Seven Deadliest Web Application ...


14

I really enjoyed Erickson's Hacking: The Art of Exploitation Fyodor's own Nmap Network Scanning I have also heard heard great things about, but haven't read yet, The Web Application Hacker's Handbook A Guide to Kernel Exploitation


11

If you're looking for non-language/framework specific stuff, you could start with a pair of books on security engineering Security Engineering by Ross Anderson Engineering Security by Peter Gutmann Usefully both are available for free online. If you're looking for more platform specific stuff, if you haven't already I'd recommend looking through ...


9

Since it's now out, my answer would be The Tangled Web by Michal Zalewski.


6

For books on how to build web security, Writing Secure Code v2 from MS Press is still a seminal classic, and even though it was written quite a few years ago by Internet standards, it is still very relevant, and relatively up to date (if no longer complete because of new attack techniques). And it's not just for MS platforms (though many of the newer ...


6

As a penetration tester I don't think that books are the best medium, because there is no substitute for experience. Hunt for bugs in open source software, obtain CVE's and put that on your resume. ...That being said there are books that I have enjoyed and that i think are relevant to modern systems: The Tangled Web Cryptography Engineering ...


6

Ross Anderson's Security Engineering is excellent (and the first edition is currently available online. Some sample chapters from the second edition are online at the time of writing).


6

Check out Practical Cryptography: http://www.amazon.com/Practical-Cryptography-Niels-Ferguson/dp/0471223573/ref=sr_1_1?s=books&ie=UTF8&qid=1304454787&sr=1-1 Written by Niels Ferguson, lead cryptographer for Counterpane, Bruce Schneier's security company, and Bruce Schneier himself, this is the much anticipated follow-up book to Schneier's ...


6

There is no opposition between "linear algebra" and "discrete math". For instance, a Linear Feedback Shift Register is "linear" in the sense of linear algebra, but also totally discrete. What is seldom encountered in computers is not the "linear" part, but the use of real or complex numbers as base field -- because computers are not good at storing numbers ...


5

Yes, this is feasible, but you will need to study intensively. I have some recommendations that may help in learning this material: Learn about TCP/IP. I recommend TCP/IP Illustrated, by Stevens, but any other network book may be a fine alternative. Anotehr useful textbook may be Computer Networking: A Top-Down Approach by Kurose and Ross. Make sure to ...


5

I would recommend reading "Gray Hat Hacking" by Harper et al. (3rd ed.) But more importantly, I would recommend doing exercises rather than reading about them. Perhaps start at overthewire.org and do vortex there. The exercises cover all of your areas of interest and they contain links to a lot of on-line reading.


5

I recommend Bruce Schneiers Secrets and Lies, which I read recently. It's a good introduction, but not the same way SICP is an introduction to programming. It does a good job with teaching mentality though.


5

You could do much worse than Hacking Exposed. It's a really good introduction to this side of things, along with the associated series like Hacking Linux Exposed and similar books on Windows, Wireless Security etc. Update: Should have mentioned the OSSTMM as well - as far as general security testing methodology goes, it's not bad.


5

Yes, not only is linear algebra required in many computer science programs it also has security implications. Linear Algebra can be used to detect doctored photographs. Vector Clocks are important in distributed systems and time can play a role in security. Linear algebra is also used in GPS and Missie Guidance. GPS Spoofing requires Linear Algebra ...


4

Your interests are very similar to mine (except reverse engineering); Here is a list of the books I have next to me right now: Understanding the Linux Kernel 3rd ed. Gray Hat Hacking 3rd ed. The Shellcoders Handbook 2nd ed. Linux Kernel Development 3rd ed Hacking: The Art of Exploitation 2nd ed Attacking the Core: A Guide to Kernel Exploitation The Art of ...


4

If you don't want to read straight from standards, and you are looking something in book form, this is a nice primer, (fairly) entry level into smart card security: http://www.amazon.com/Smart-Cards-Tokens-Security-Applications/dp/1441944265 . It's written by two university professors and is the course book on a msc course about smart cards. For a more ...


4

Depending on what you are looking for there is a lot of technologies covering the smart card topic. Some of them coming to my mind: ISO 7816: cards with contact http://www.cardwerk.com/smartcards/smartcard_standard_ISO7816.aspx ISO 14443: contactless smart cards http://en.wikipedia.org/wiki/ISO/IEC_14443 PKCS#15: Cryptographic Token Information Format ...


4

I nice introductionary book to web security I am reading now is Hacking: The Next Generation. It covers a wide range of topics, so maybe it could not be for you if you are looking for something deeper and more focused.


4

I prefer Hunting Security Bugs to The Web Application Hacker's Handbook, but fortunately, you can have more than one book in your life. I have about 40,000.


4

Understanding how a network actually works is tightly connected to the fact that Computer Networks and how they are integrated into systems, have a hierachichal structure. Learning the rules and behaviours of each level of this structure is fundemental to understanding how computer networks and protocols behave in each and every situation. I recommend ...


4

I think what the book is saying is that if you can come up with such a specific query that there are only a few results, you can identify one particular target in the database. For example, if a car dealer had a database of customers, and they "anonymized" the database to include only zip code, make, model, year, color, and salary, you could find your ...


4

To add to the answers provided, some personal favourites - nmap : a must-have book and tool SQL Injection Attacks and Defense Metasploit Pen-Testers Guide Web Application Hacker's Handbook Edition 2 (there are some good additions to Edition 1 mentioned above) On a side-note, if you're a beginner and truly want to learn then books won't totally cut it ...


4

To add to some other answers as people have mentioned there's a lot of different areas to security and they're not all suited to book-based learning. That said you could look at Security Engineering by Ross Anderson. This is what popped into my head first when you said you're looking for a security equivalent to SICP. It's somewhat academic in tone, but ...


4

A few things from a Secure OS: https://en.wikipedia.org/wiki/OpenBSD_security_features Exploit Mitigation Techniques: an Update After 10 Years: http://www.openbsd.org/papers/ru13-deraadt/ http://tech.yandex.com/events/ruBSD/2013/talks/103/ http://www.openbsd.org/papers/ or: on Youtube: "passwords^12"


3

OpenSC project has also lots of information and further pointers. And you're most welcome to ask for help on the mailing list as well. http://www.opensc-project.org


3

To an extent it varies depending on the types of testing that you're looking at. Here's some one's I've liked. Infrastructure/General Hacking Exposed 6 - canonical series on infrastructure hacking, and has some good information. NMAP Network Scanning - If you use nmap (and if you're testing you will) this book is an excellent way to really get to ...


3

I am missing the following excellent book from the list. Highly recommended The Basics of Hacking and Penetration Testing: Ethical Hacking and Penetration Testing Made Easy


3

My Pick: Penetration Tester’s Open Source Toolkit, Vol. 2 Dissecting the Hack: The F0rb1dd3n Network, Revised Edition Ninja Hacking: Unconventional Penetration Testing Tactics and Techniques Hacking: The Next Generation (Animal Guide) Gray Hat Hacking, Second Edition: The Ethical Hacker’s Handbook Google Hacking for Penetration Testers Professional Pen ...


3

Your question is too broad in scope for an answer. 'Security' covers such a vast scope. Network security, OS security, application security, device security, physical security, human security. These are all topics that an IT security professional needs to have experience and knowledge in, and there can be no single point of reference to spring from. Sources ...



Only top voted, non community-wiki answers of a minimum length are eligible