Pen Testing from Contract to Report

Foreword viii
 
Preface ix
 
Acknowledgement x
 
List of Abbreviations xi
 
Companion Website xiii
 
1 Introduction to Penetration Testing 1
 
2 The Contract 19
 
3 Law and Legislation 39
 
4 Footprinting and Reconnaissance 53
 
5 Scanning Networks 81
 
6 Enumeration 111
 
7 Vulnerability Analysis 137
 
8 System Hacking 183
 
9 Malware Threats 239
 
10 Sniffing 265
 
11 Social Engineering 283
 
12 Denial of Service 315
 
13 Session Hijacking 343
 
14 Evading IDS, Firewalls, and Honeypots 363
 
15 Web Servers 389
 
16 Web Application Hacking 413
 
17 SQL Injection 481
 
18 Hacking Wireless Networks 517
 
19 Mobile Platforms 549
 
20 Internet of Things (IoT) 581
 
21 Cloud Computing 601
 
22 The Report 623
 
Index 639

Alfred Basta, PhD, CCP (CMMC), CISM, CPENT, LPT, OSCP, PMP, CRTO, CHPSE, CRISC, CISA, CGEIT, CASP+, CYSA+, is a professor of mathematics, cryptography, and information security as well as a professional speaker on internet security, networking, and cryptography. He is a member of many associations, including ISACA, ECE, and the Mathematical Association of America. Dr. Basta's other publications include Computer Security and Penetration Testing, Mathematics for Information Technology, Linux Operations and Administration, and Database Security. In addition, Dr. Basta is the chair of EC-Council's CPENT Scheme Committee. He has worked as a faculty member and curriculum advisor for programming and cyber security programs at numerous colleges and universities.
 
Nadine Basta, MSc., CEH, is a professor of computer science, cybersecurity, mathematics, and information technology. Her numerous certifications include CEH, MCSE, MSDBA, CCDP, NCSE, NCTE, and CCA. A security consultant and auditor, she combines strong "in the field" experience with her academic background. She is also the author of Computer Security and Penetration Testing, Mathematics for Information Technology, and Linux Operations and Administration. Nadine has extensive teaching and research experience in computer science and cybersecurity.
 
Waqar Anwar is a Cybersecurity Curriculum Specialist with over 10 years of experience in the field. He also develops and delivers training to faculty and staff on cybersecurity topics and conducts research on cybersecurity topics. Mr. Anwar is a frequent speaker at industry conferences. He is also a member of several cybersecurity organizations including SysAdmin, Audit, Network and Security SANS, CYBRARY, and Information Systems Security Association International ISSA.