Rating: 
Summary: Refreshinly honest, though a few too many topics
Review: With all the literature on network security, I really found this book a refreshing change of pace. Security experts will tell you that it is not enough to just know how to update patches and turn off unnecessary services. One must understand the mindset of a hacker, know the tools they like to use, and how they see your network from their perspective.I really liked the approach of this book. It obscures nothing, and gives the would-be security person an in-depth view of how one can penetrate a system given time and a little know-how. The blunt honesty of this book can be surprising, as it gives default passwords for routers and switches among other things, but its this sort of wake-up call that turns network admins into security -conscious ones. I am definitely this book is in print. I did have to give 4 starts to the book because it covers so many topics that it cannot devote as much as I would like on any one. Sections on Unix and Windows hacking are better left in the other books in the "Hacking Exposed" series. However, the information contained in those sections is no less useful. All in all, this is a very worthwhile investment for admins and security guys who want to see things from the other side of the firewall, so to speak. :)
Rating:
Summary: Still the best for vulnerability assessment and pen testing
Review: I am a senior engineer for managed network security operations, which includes conducting vulnerability assessments against client networks. I read this second edition to gain insights into ways to better assess a client's security posture, and also to understand some of the attacks I see while monitoring intrusion detection systems. Of the books I've read, Hacking Exposed remains the best guide to systematically assess and (if necessary) compromise hosts. By understanding black hat methods, defenders can better prepare for the tidal wave of exploits washing upon the networking shore. Parts I (Casing the Establishment), II (System Hacking), and III (Network Hacking) are a tour-de-force of attacker tools and techniques. While explaining how to penetrate systems, the authors spend a fair amount of time explaining how those systems work. From a system administration standpoint, these descriptions are pure gold. Since the authors are fairly operating system-agnostic, they show the pros and cons of Microsoft, UNIX, and Novell products in the harsh light of improved security. For example, the discussion of file handles, file descriptors, and signals in chapter 8 ("Hacking UNIX") helped me understand a little bit of UNIX's guts, while giving a security spin to file system operations. Thankfully, Hacking Exposed gives Microsoft operating systems plenty of attention. While recognizing that many of us dislike administering these systems, the authors provide helpful and solid chapters on Windows NT and Windows 2000. They also demonstrate many ways to use Windows as an attack platform. They convincingly show that if a scan can be performed in Linux, someone has developed a similar tool for Windows. My favorite issues in the book involved describing Windows rootkits (a recent development) and UNIX loadable kernel modules. On the negative side, I felt the book lost steam in section IV (Software Hacking), spending too much time repeating earlier material. Also, unless you're a relative newbie to security, you may become bored with the litany of historic deficiencies and required patches discussed in section IV. Overall, the second edition of Hacking Exposed remains a must-read book for security professionals. I recommend it as the sort of book one reads after gaining an overall sense of the security field and learning about TCP/IP. With those foundations in place, it's time to learn how black hats operate. If you're a system administrator, you'll learn how to fortify your network assets. If you're an intrusion detector, you'll learn what to watch for. If you're a pen-tester, you'll learn how to compromise hosts. Who could ask for more?
Rating: 
Summary: RUBBISH
Review: A lot of twaddle - worst book on the subject - no secrets, out of date solutions - a complete waste of time and money
Rating:
Summary: Time to reposition the "Hacking Exposed" series?
Review: I am a senior engineer for network security operations. I've read and reviewed every edition of the "Hacking Exposed" series since the 1999 original. "Hacking Exposed" is a winner; the authors' powerful example-driven style teaches the tools and tactics of vulnerability assessment and penetration testing. Nevertheless, I've compared this third edition to its "Hacking Linux" and "Hacking Windows 2000" cousins, and I believe the authors should rethink their goals for the "Hacking Exposed" series.
"Hacking Exposed, Third Edition" (HE:3E) describes techniques to attack and defend a wide variety of network assets: Microsoft products (9x, ME, NT, 2000, XP), UNIX variants, Novell's NOS, routers, PBXs, firewalls, and so on. Weaknesses in individual applications are explained, with attention given to remote control tools (VNC, Windows Terminal Server, PCAnywhere), Web technologies (IIS, ColdFusion, ActiveX, Java), and file sharing/chat systems (Napster, IRC). Readers are unlikely to find so many topics given fairly thorough coverage in a single volume.
Unfortunately, at 727 pages, HE:3E has gained too much weight. The 1999 first edition offered 484 pages, and the 2001 (yes, 2001) second edition gave 703 pages. While the authors should be credited for not simply copying and pasting material from their 2001 edition of "Hacking Exposed: Windows 2000," many of the same topics appear in both books. Furthermore, some subjects are redundantly described within HE:3E. For example, why rehash port redirection and rootkits in chapter 14 when they were adequately covered in earlier sections?
I strongly recommend the authors remove the UNIX- and Windows-specific material from a future fourth edition of "Hacking Exposed," directing readers to "Hacking Linux" and "Hacking Windows" when necessary. The authors should briefly describe general UNIX and Windows vulnerabilities in "HE:4E," and devote most of the book to their methodology and systems not covered in other books. This overhaul will give the authors a chance to remove some dated material from "Hacking Exposed," like a reference to ISS RealSecure v3.0 (6.0 is now in use).
I recommend readers who have not read previous "Hacking Exposed" titles buy this book. Despite my concerns, I still learned something new (wireless issues, format string vulnerabilities) and re-acquainted myself with material mentioned in earlier editions (RIP spoofing, enumeration techniques). If you've read "Hacking Exposed, Second Edition," wait for a revamped fourth edition.
(Disclaimer: I received a free review copy from the publisher.)
Rating: 
Summary: This is the book to use for penetration testing and analysis
Review: Hardly a week goes by that CNN does not report a high-profile Web site being defiled or an e-commerce site being penetrated. While most people know why these incidents occurred, Hacking Exposed explains how they occurred and, more important, how to prevent them from occurring. The cover of Hacking Exposed announces that "Network security is Y2K without the deadline." That alarmist statement, however, is the only hype in the book. The work is packed with real-world examples and links to tools needed to assess the security of any type of client/server and Web system. As they detail the myriad vulnerabilities in different types of systems, the authors provide countermeasures for each of them. Well organized, the book progresses in an orderly fashion. It methodically goes through the process of exploiting a target to penetrate a system--from identification and enumeration to actual penetration. The authors provide detailed instructions and explanations for many security features and flaws in Unix, Linux, Windows, NetWare, routers, firewalls, and more. Topics covered include state-of-the-art computer and network penetration, as viewed by both the attacker and the defender; remote system identification; vulnerability identification; war dialers; firewall circumvention; and denial-of-service attacks. An appendix explores the security characteristics of Windows 2000. Some may argue that books such as this one only serve to motivate and educate hackers. The truth is that hackers are already aware of the book's contents. This book is designed for system administrators and managers who need to know their systems' risks and vulnerabilities and how to address them. When they are done with this book, system administrators and managers will be familiar with such critical topics as back channels, port redirection, banner grabbing, and buffer overflows. Hacking Exposed is a must-read for anyone who wants to know what is really happening on their network....
Rating:
Summary: Save Your Money
Review: I have plenty of experience with computers and have been hacking since the term Hacker wasn't a dirty word. Anyway, a friend of mine that is very interested in Hacking purchased this book and a few other titles from these authors. He showed me the books and asked me to give him my opinion of them. As I was looking thru these books I started to laugh and told my friend to get his money back. I was shocked to see that all the info in these books can be obtained just by doing a search on SecurityFocus and Google and most of the info in this and the other books where outdated exploits that have been patched already. The IT industry moves at the speed of light and the most important aspect when it comes to securing your networks is having the newest attack and exploit information, which no book can ever provide... including this lousy book that is nothing but a compilation of what can be found for free online. Don't waste your money! I wish I could give this book zero stars.
Rating:
Summary: BAD BOOK
Review: This book will not enhance your knowledge of computer security.
Rating:
Summary: Fun and educational
Review: I had so much fun hacking my own servers, and exploiting all the lesser known security flaws. I highly recommend this book even for the experienced administrator.
Rating:
Summary: what, are you kidding me?
Review: no, i didn't buy this crap, i got a free copy at the blackhat conference in vegas, and left it there in my hotel room. every book like this is a joke, the sad thing is the guys who write this crap are actually getting a lot of money writing. it's an old, tired, subject and the author has no clue, just tries to cram it with useless "hacking" info. my friend had the source code to one of his exploits published in one of these books, it was easy for them to do since they didn't have this real name.. but why do they include exploits in the actual book? they don't explain them, and they are just printed on the pages... anyone who would buy the dumb book sure isn't gonna be able to understand.. what are people supposed to do? type it up in ms word? if you're reading the reviews to this book for any purpose other than to laugh, i pity you.
Rating:
Summary: Lots of good, organized information
Review: There are a lot of 'hacking' books out there, but none better than Hacking Exposed. The information is organized and to the point. Read this and you will be a better systems administrator for it.
|
