ABOUT THE BOOK
When I was approached by No Starch Press to write a book it quickly became clear to me that the sort of book I would most like to write was a hands-on beginning security book. There is no greater joy in my life than when I am contacted by someone who has taken one of my classes and the knowledge they gained helped them reach a goal such as landing a security job or passing an exam. The goal of this book is to reach more interested minds with an easy to follow step by step introduction to many facets of information security. No prior knowledge is required to work through the book, and the book begins with the basics of using Linux and programming. As the reader works through the book more advanced topics such as exploit development and client side attacks are covered, but always with the beginner in mind. If you are already a seasoned penetration tester, there may not be much for you here, but perhaps you have friends and family who are interested in learning more about what you do and aren’t sure where to start?
Though I as well as several editors, worked through the book several times, with a book of this size it is inevitable that a mistake or two slipped past me. If you find anything you believe to be an error please do not hesitate to let us know by contacting here so we can update future versions. Thank you in advance for your help and support.
Updates
Kali: Naturally, new versions of Kali Linux have been released. Feel free to use newer versions to work through the book, just keep in mind the versions of some tools will have updated as well. If you prefer to use 1.0.6 to follow along directly with the book a link to the torrent is included in the text. A major change is that there is now a 64-bit version of Kali Linux prebuilt as a virtual machine. For those readers with 64-bit host systems (probably most of you) feel free to use that. If you do not have 64-bit all the VMs used in the book are 32-bit to support those with older systems.
Nessus: As of January 2015 Tenable is again hosting a download for 32-bit Debian Linux based systems including Kali. If that stops being the case again in the future please see below.
Mona.py: Since the release of the book Mona.py’s author has moved the download from Redmine to Github. You can now download the latest Mona.py from: here.
Android ADT: ADT is now called Android Studio. It works the same way, just download the latest Android Studio for your platform rather than ADT.
When you open up Android to install software at the top left click on Packages->Show Obsolete Packages. Android is backwards compatible so when making malicious Android apps as we do in Chapter 20 it makes since to use old version of Android so it can run on everyone’s phones.
Android emulators only 64-bit now by default. .Anyhow, you can again run your emulators on your host machine if it is 64-bit (I recommended running them on the host anyway for performance reasons). There is also a work around to get the emulators to run in 32-bit mode if you prefer to go that route. Add
export ANDROID_EMULATOR_FORCE_32BIT=true
to the file /root/.bashrc and restart the terminal.
Smartphone Pentest Framework: Changes in Android means I had to make some changes to the Kali install script since the book came out. Be sure to get the latest branch of SPF from github and not the book branch. You just leave off the -b in the git clone command.
Hyperion: Hyperion has updated to version 1.2 which you can get at nullsecurity.net. Or to us 1.0 as referenced in the text type wget http://web.archive.org/web/20130514132719/http://nullsecurity.net/tools/binary/Hyperion-1.0.zip at the Kali command line.
As the title implies this book is very hands-on and to get the most out of it I encourage you to set up your virtual lab as detailed in Chapter 1 and follow along with the book. The Kali Linux attack image and a Ubuntu Linux target can be downloaded from the book website. But unfortunately the Windows targets are a bit more complicated. If you are a student your school may give you access to ISOs of Windows operating systems to build your XP and Windows 7 targets. Additionally, your job may have an MSDN subscription through a program such as Bizspark which you can use to work through the book.
Both Windows XP SP3 and Windows 7 SP1 can be used as a 30 day trial without a license key if you are unable to locate one. Options for getting a Windows 7 ISO that were active at the time of the book’s publication are listed in Chapter 1. That said if you are unable to get your hands on ISOs for the Windows operating systems I certainly don’t want that to hold anyone back from being able to work through the book. As a last resort you can contact me and I will build the Windows targets for you. Keep in mind they will be only a trial and will expire after 30 days. I often have a lot on my plate so I may not be able to get them built for you right away. Additionally to maximize your time if I get several requests in succession I will send them out all at once rather than building a new one each day, not a perfect process I realize. I apologize in advance for any delays.
If you are going to run into me and would like for me to sign your book, I would be glad to do so. I even was gifted a special Mont Blanc pen just for signing. Additionally, I have some stickers with a special design just for the book.
At some events I will be having formal book signings. Currently I am scheduled to sign at the Blackhat and Defcon conferences. I will add more events here as they are confirmed.
If you are not likely to run into me and would like your book signed you can send them to me and the next time I am home I will sign them and send them back. I’m currently still researching prices for this with the post office to make it easy for you to know how much it will cost to get it back to you. I’ll add that information here as soon as I get it worked out.
DEDICATION
The book is dedicated to the memory of my good friend from college Jess Hilden. I went to college when I was 14, so you can imagine I was a bit out of sync with a lot of my peers and a bit behind on social development. Jess always went out of her way to include me and probably saved my life a couple times at least. She was a constant inspiration to me, and she always encouraged me to work hard and make the most of my life. I am deeply saddened that she isn’t here to see me publish my first book.