Redefining Hacking
Autor Omar Santos, Savannah Lazzara, Wesley Thurneren Limba Engleză Paperback – 16 apr 2025
Autorii Omar Santos, Savannah Lazzara și Wesley Thurner aduc în acest volum o experiență vastă acumulată în linia întâi a securității cibernetice, oferind o perspectivă tehnică asupra modului în care s-au transformat metodologiile de atac și apărare. Publicată de Pearson Education, lucrarea se distinge prin ancorarea fermă în realitatea curentă a amenințărilor digitale, depășind abordările pur teoretice prin integrarea unor studii de caz și exerciții practice ce pot fi testate utilizând resursele puse la dispoziție pe GitHub. Descoperim aici o structură riguroasă care ghidează cititorul prin procesele complexe de red teaming și bug bounty hunting, punând un accent deosebit pe adaptarea la un ecosistem dominat de inteligența artificială și automatizare. Abordarea diferă de cea din The Basics of Hacking and Penetration Testing de Thomas Wilhelm prin faptul că este mai puțin abstractă și mult mai aplicabilă în contextul noilor tehnologii emergente, precum calculul cuantic. În timp ce alte titluri se concentrează pe pașii fundamentali ai unui test de penetrare, volumul de față extinde orizontul către strategii proactive și metodologii moderne de exploatare. Putem afirma că parcurgerea celor peste 600 de pagini oferă o experiență de învățare intensă, unde tonul este unul tehnic și pragmatic. Fiecare capitol este conceput pentru a echipa profesioniștii cu instrumentele necesare pentru a anticipa mișcările atacatorilor, transformând conceptele complexe în strategii acționabile. Nu este doar un manual de instrucțiuni, ci un ghid strategic pentru securizarea infrastructurilor într-o eră a schimbărilor tehnologice accelerate.
Preț: 324.99 lei
Preț vechi: 406.24 lei
-20%
Puncte Express: 487
Carte disponibilă
Livrare economică 30 octombrie-13 noiembrie
Livrare express 16-22 octombrie pentru 61.10 lei
Livrare prin curier în România Termenul estimat este afișat lângă disponibilitate.
Transport gratuit de la 400.00 lei Plată online sau ramburs, în funcție de opțiunile comenzii.
Retur gratuit în 14 zile Comandă securizată și suport în română.
Specificații
ISBN-13: 9780138363611
ISBN-10: 0138363617
Pagini: 608
Dimensiuni: 189 x 232 x 33 mm
Greutate: 1.12 kg
Ediția:1
Editura: Pearson Education (US)
ISBN-10: 0138363617
Pagini: 608
Dimensiuni: 189 x 232 x 33 mm
Greutate: 1.12 kg
Ediția:1
Editura: Pearson Education (US)
V-ar putea interesa
-
READMEW. Patrick Mccray-20%Preț: 243.01 lei303.76 lei -
Hands-On Ethical Hacking and Network DefenseMichael Simpson-24%Preț: 409.83 lei535.83 lei -
Hacking HumanityLara LewingtonPreț: 123.80 lei -
Little HackersJulie DarlingPreț: 136.75 lei -
Hands on HackingMatthew Hickey-20%Preț: 237.78 lei297.22 lei -
Hacking Multifactor AuthenticationRoger A. Grimes-20%Preț: 203.15 lei253.95 lei -
Hack to the FutureEmily Crose-20%Preț: 165.18 lei206.47 lei -
Human HackedLen Noe-20%Preț: 170.67 lei213.34 lei -
-20%Preț: 134.29 lei167.85 lei -
Cybersecurity For Dummies, 3rd EditionJoseph Steinberg-20%Preț: 142.17 lei177.71 lei -
Hacking For Dummies, 8th EditionKevin Beaver-20%Preț: 120.90 lei151.13 lei -
Coding For Dummies, All New EditionPaul McFedries-20%Preț: 116.94 lei146.18 lei -
Preț: 123.51 lei -
Science Stories: Coding and ComputersLisa ReganPreț: 74.89 lei -
Hacking CollegeNed Scott LaffPreț: 225.90 lei -
Hacking: The Art of Exploitation, 2nd EditionJon Erickson-35%Preț: 254.82 lei394.27 lei -
EnshittificationCory DoctorowPreț: 170.65 lei -
Hunting a HackerSarah EasonPreț: 58.32 lei -
The Scaling EraDwarkesh Patel-20%Preț: 178.11 lei222.64 lei -
Mastering CyberSecurity DefenseSantosh Tripathi i-20%Preț: 254.76 lei318.45 lei
De ce să citești această carte
Recomandăm această carte profesioniștilor IT și specialiștilor în securitate care doresc să treacă de la bazele testării de penetrare la strategii avansate de red teaming. Veți câștiga o înțelegere profundă a modului în care AI-ul influențează hacking-ul modern și veți avea acces la resurse practice care permit simularea atacurilor în medii controlate, esențiale pentru oricine dorește să stăpânească securitatea ofensivă.
Descriere
Redefining Hacking: A Comprehensive Guide to Red Teaming and Bug Bounty Hunting in an AI-Driven World equips cybersecurity professionals, students, and tech enthusiasts with modern hacking methodologies and the tools to combat evolving threats. Written by industry experts Omar Santos, Savannah Lazzara, and Wesley Thurner, this book blends real-world insights with forward-looking perspectives on AI, automation, and quantum computing. Packed with hands-on exercises, actionable strategies, and case studies, it empowers readers to think like attackers while proactively strengthening their defenses. Gain practical knowledge to master red teaming, bug bounty hunting, and prepare for an AI-influenced cybersecurity landscape. This practical forward-thinking book provides: Holistic Coverage: Comprehensive insights into red teaming and bug bounty hunting Future Trends: Explore AI, automation, and quantum computing's impact on security Hands-On Learning: Includes exercises, review questions, and GitHub resources Expert Guidance: Authored by seasoned cybersecurity professionals with diverse expertise
Notă biografică
Omar Santos is a Distinguished Engineer at Cisco who pioneers advancements in artificial intelligence security, cybersecurity research, ethical hacking, incident response, and vulnerability disclosure. As co-chair of the Coalition for Secure AI (CoSAI) and board member of the OASIS Open standards organization, he shapes the future of secure technology adoption across industries.
Omar drives innovation through multiple leadership roles, including as founder of OpenEoX and co-chair of the Forum of Incident Response and Security Teams (FIRST) PSIRT Special Interest Group. His commitment to cybersecurity education and community building is evident in his role as the co-founder and one of the leaders of the DEF CON Red Team Village and the chair of the Common Security Advisory Framework (CSAF) technical committee.
Omar has published over 20 books, created over 20 video courses, and contributed more than 40 academic research papers to the field. Omar's work in cybersecurity is also recognized through multiple granted patents. You can follow Omar in X at https://x.com/santosomar and LinkedIn at https://www.linkedin.com/in/santosomar.
Savannah Lazzara is a Security Engineer specializing in red teaming at a tech company. Savannah has multiple years of experience in security consulting working with many Fortune 500 corporations and has experience in carrying out security assessments, which include network assessments, social engineering exercises, physical facility penetration tests, and wireless assessments. Savannah also has experience in performing adversary simulation assessments, which include remote red team simulations, insider threat assessments, and onsite red team assessments. Savannahs area of expertise is focused on social engineering and physical security.
Savannah is the co-lead of Red Team Village. Additionally, Savannah has spoken at various cybersecurity conferences, including Source Zero Con, BSides, and others. Savannah has also spoken on multiple podcast shows including The Hacker Factor and Hackerz and Haecksen.
Wesley Thurner is a Principal Security Engineer on the Intuit Red Team, designing and leading transformative security initiatives across the organization. He accomplishes this through multiple internal roles. Wesley leaders the internal Purple Team, is an Ambassador for cybersecurity education throughout the workforce and leads working groups to define security policies.
Prior to Intuit, Wesley served as an exploitation operator in the U.S. Department of Defense's most elite computer network exploitation (CNE) unit. There he led and developed multiple teams across a variety of roles in the U.S. Air Force's premier selectively manned cyberattack squadron. Wesley is also a co-lead for the Red Team Village, a community-driven village bridging the gap between penetration testers and offensive operations. He has spoken at various cybersecurity conferences and authored numerous training courses as well as white papers.
Omar drives innovation through multiple leadership roles, including as founder of OpenEoX and co-chair of the Forum of Incident Response and Security Teams (FIRST) PSIRT Special Interest Group. His commitment to cybersecurity education and community building is evident in his role as the co-founder and one of the leaders of the DEF CON Red Team Village and the chair of the Common Security Advisory Framework (CSAF) technical committee.
Omar has published over 20 books, created over 20 video courses, and contributed more than 40 academic research papers to the field. Omar's work in cybersecurity is also recognized through multiple granted patents. You can follow Omar in X at https://x.com/santosomar and LinkedIn at https://www.linkedin.com/in/santosomar.
Savannah Lazzara is a Security Engineer specializing in red teaming at a tech company. Savannah has multiple years of experience in security consulting working with many Fortune 500 corporations and has experience in carrying out security assessments, which include network assessments, social engineering exercises, physical facility penetration tests, and wireless assessments. Savannah also has experience in performing adversary simulation assessments, which include remote red team simulations, insider threat assessments, and onsite red team assessments. Savannahs area of expertise is focused on social engineering and physical security.
Savannah is the co-lead of Red Team Village. Additionally, Savannah has spoken at various cybersecurity conferences, including Source Zero Con, BSides, and others. Savannah has also spoken on multiple podcast shows including The Hacker Factor and Hackerz and Haecksen.
Wesley Thurner is a Principal Security Engineer on the Intuit Red Team, designing and leading transformative security initiatives across the organization. He accomplishes this through multiple internal roles. Wesley leaders the internal Purple Team, is an Ambassador for cybersecurity education throughout the workforce and leads working groups to define security policies.
Prior to Intuit, Wesley served as an exploitation operator in the U.S. Department of Defense's most elite computer network exploitation (CNE) unit. There he led and developed multiple teams across a variety of roles in the U.S. Air Force's premier selectively manned cyberattack squadron. Wesley is also a co-lead for the Red Team Village, a community-driven village bridging the gap between penetration testers and offensive operations. He has spoken at various cybersecurity conferences and authored numerous training courses as well as white papers.
Cuprins
Chapter 1:The Evolution of Penetration Testing, Red Teaming, and Bug Bounties.. . . . . . . 1
Into the Abyss.. . . . . . . 1
Industry Overview. . . . . . . 5
The Early Days and Evolution of Penetration Testing.. . . 7
The Rise of Red Teaming. . . . . . 9
The Emergence of Bug Bounty Programs.. . . . 10
The Convergence of Penetration Testing, Red Teaming, and Bug Bounties.. 11
The Future of Penetration Testing, Red Teaming, and Bug Bounties. . 12
The Increasing Use of AI and ML in Penetration Testing,
Red Teaming, and Bug Bounties.. . . . . 13
Test Your Skills. . . . . . . 15
Chapter 2 Introduction to Red Teaming.. . . . . 17
What Is Red Teaming?. . . . . . 17
The Importance of Red Teaming. . . . . 18
Red Team Frameworks and Methodologies.. . . . 20
Red Team Engagements.. . . . . . 22
Red Team Challenges.. . . . . . 26
References. . . . . . . 28
Test Your Skills. . . . . . . 30
Chapter 3 Red Team Infrastructure.. . . . . . 33
An Overview of Red Team Infrastructure.. . . . 34
Command and Control.. . . . . . 34
Test Your Skills. . . . . . . 60
Chapter 4 Modern Red Team Methodology and Tools.. . . . 63
Planning.. . . . . . . 64
Reconnaissance. . . . . . . 65
Initial Access.. . . . . . . 81
Persistence.. . . . . . . 96
Lateral Movement. . . . . . . 97
Post-Exploitation. . . . . . . 105
Reporting.. . . . . . . 105
Test Your Skills. . . . . . . 107
Chapter 5 Social Engineering and Physical Assessments. . . 109
Phone Pretexting: Lets Dial into Your Target. . . . 110
Spear Phishing: Time to Reel In Your Target.. . . . 115
Infrastructure.. . . . . . . 116
Formulating Your Email or Instant Message. . . . 128
Execution.. . . . . . . 130
Can You Hear Us from the Inside?. . . . . 131
Test Your Skills. . . . . . . 144
Chapter 6 Advanced Post-Exploitation Techniques.. . . . 147
An Overview of Post-Exploitation. . . . . 148
How to Maintain Access, Use Persistence Mechanisms, and
Create Backdoors.. . . . . . 152
Command and Control (C2) and Covert Channels.. . . 180
How to Perform Lateral Movement. . . . . 186
Legitimate Utilities and Living Off the Land.. . . . 189
Post-Exploitation Privilege Escalation. . . . . 197
Test Your Skills. . . . . . . 202
Chapter 7 Active Directory and Linux Environments.. . . . 207
Active Directory Fundamentals. . . . . 208
Microsoft Entra ID and Azure.. . . . . 223
Active Directory Attack Techniques. . . . . 229
Advanced Linux Environment Attack Techniques. . . 267
Test Your Skills. . . . . . . 277
Chapter 8 The Future of Red Teaming Beyond the AI Revolution.. . 281
Understanding the Current State of AI in Red Teaming.. . . 282
Creating AI-Powered Offensive Security Tools.. . . . 283
Examining Fine-Tuned Uncensored AI Models.. . . . 297
Understanding Retrieval-Augmented Generation (RAG) for Red Teaming.. 299
Red Teaming AI and Autonomous Systems. . . . 313
Keeping Pace with Rapidly Evolving Technologies. . . 322
Test Your Skills. . . . . . . 324
Chapter 9 Introduction to Bug Bounty and Effective Reconnaissance. . 327
Understanding Bug Bounty Programs.. . . . 328
Exploring Effective Reconnaisance.. . . . . 336
Performing Active Reconnaissance. . . . . 377
Understanding the Art of Performing Vulnerability Scans.. . . 396
Performing Web Application and API Recon. . . . 401
Communicating Your Findings and Creating Effective
Bug Bounty Reports.. . . . . . 407
Test Your Skills. . . . . . . 410
Exercises.. . . . . . . 412
Chapter 10 Hacking Modern Web Applications and APIs. . . . 415
Overview of Web Application-Based Attacks, the OWASP
Top 10 for Web Applications, and OWASP Top 10 for LLM Applications. 416
Building Your Own Web Application Lab.. . . . 429
Understanding Business Logic Flaws.. . . . . 430
Understanding Injection-Based Vulnerabilities. . . . 432
Exploiting Authentication-Based Vulnerabilities. . . . 451
Exploiting Authorization-Based Vulnerabilities. . . . 461
Understanding Cross-Site Scripting (XSS) Vulnerabilities.. . . 463
Understanding Cross-Site Request Forgery and Server-Side
Request Forgery Attacks.. . . . . . 472
Understanding Clickjacking.. . . . . 480
Exploiting Security Misconfigurations. . . . . 480
Exploiting File Inclusion Vulnerabilities. . . . 482
Exploiting Insecure Code Practices. . . . . 484
Using Additional Web Application Hacking Tools. . . 488
Test Your Skills. . . . . . . 493
Chapter 11 Automating a Bug Hunt and Leveraging the Power of AI.. . 497
Traditional Bug Hunting Methods. . . . . 498
AI-Powered Automation in Bug Hunting.. . . . 500
AI Model Training, Fine-Tuning, and RAG for Bug Bounties. . . 516
Challenges of Using AI for Bug Bounty Hunting. . . . 521
Test Your Skills. . . . . . . 523
Appendix Answers to Multiple-Choice Questions.. . . . . 527
9780138363611, TOC, 2/18/2025
Into the Abyss.. . . . . . . 1
Industry Overview. . . . . . . 5
The Early Days and Evolution of Penetration Testing.. . . 7
The Rise of Red Teaming. . . . . . 9
The Emergence of Bug Bounty Programs.. . . . 10
The Convergence of Penetration Testing, Red Teaming, and Bug Bounties.. 11
The Future of Penetration Testing, Red Teaming, and Bug Bounties. . 12
The Increasing Use of AI and ML in Penetration Testing,
Red Teaming, and Bug Bounties.. . . . . 13
Test Your Skills. . . . . . . 15
Chapter 2 Introduction to Red Teaming.. . . . . 17
What Is Red Teaming?. . . . . . 17
The Importance of Red Teaming. . . . . 18
Red Team Frameworks and Methodologies.. . . . 20
Red Team Engagements.. . . . . . 22
Red Team Challenges.. . . . . . 26
References. . . . . . . 28
Test Your Skills. . . . . . . 30
Chapter 3 Red Team Infrastructure.. . . . . . 33
An Overview of Red Team Infrastructure.. . . . 34
Command and Control.. . . . . . 34
Test Your Skills. . . . . . . 60
Chapter 4 Modern Red Team Methodology and Tools.. . . . 63
Planning.. . . . . . . 64
Reconnaissance. . . . . . . 65
Initial Access.. . . . . . . 81
Persistence.. . . . . . . 96
Lateral Movement. . . . . . . 97
Post-Exploitation. . . . . . . 105
Reporting.. . . . . . . 105
Test Your Skills. . . . . . . 107
Chapter 5 Social Engineering and Physical Assessments. . . 109
Phone Pretexting: Lets Dial into Your Target. . . . 110
Spear Phishing: Time to Reel In Your Target.. . . . 115
Infrastructure.. . . . . . . 116
Formulating Your Email or Instant Message. . . . 128
Execution.. . . . . . . 130
Can You Hear Us from the Inside?. . . . . 131
Test Your Skills. . . . . . . 144
Chapter 6 Advanced Post-Exploitation Techniques.. . . . 147
An Overview of Post-Exploitation. . . . . 148
How to Maintain Access, Use Persistence Mechanisms, and
Create Backdoors.. . . . . . 152
Command and Control (C2) and Covert Channels.. . . 180
How to Perform Lateral Movement. . . . . 186
Legitimate Utilities and Living Off the Land.. . . . 189
Post-Exploitation Privilege Escalation. . . . . 197
Test Your Skills. . . . . . . 202
Chapter 7 Active Directory and Linux Environments.. . . . 207
Active Directory Fundamentals. . . . . 208
Microsoft Entra ID and Azure.. . . . . 223
Active Directory Attack Techniques. . . . . 229
Advanced Linux Environment Attack Techniques. . . 267
Test Your Skills. . . . . . . 277
Chapter 8 The Future of Red Teaming Beyond the AI Revolution.. . 281
Understanding the Current State of AI in Red Teaming.. . . 282
Creating AI-Powered Offensive Security Tools.. . . . 283
Examining Fine-Tuned Uncensored AI Models.. . . . 297
Understanding Retrieval-Augmented Generation (RAG) for Red Teaming.. 299
Red Teaming AI and Autonomous Systems. . . . 313
Keeping Pace with Rapidly Evolving Technologies. . . 322
Test Your Skills. . . . . . . 324
Chapter 9 Introduction to Bug Bounty and Effective Reconnaissance. . 327
Understanding Bug Bounty Programs.. . . . 328
Exploring Effective Reconnaisance.. . . . . 336
Performing Active Reconnaissance. . . . . 377
Understanding the Art of Performing Vulnerability Scans.. . . 396
Performing Web Application and API Recon. . . . 401
Communicating Your Findings and Creating Effective
Bug Bounty Reports.. . . . . . 407
Test Your Skills. . . . . . . 410
Exercises.. . . . . . . 412
Chapter 10 Hacking Modern Web Applications and APIs. . . . 415
Overview of Web Application-Based Attacks, the OWASP
Top 10 for Web Applications, and OWASP Top 10 for LLM Applications. 416
Building Your Own Web Application Lab.. . . . 429
Understanding Business Logic Flaws.. . . . . 430
Understanding Injection-Based Vulnerabilities. . . . 432
Exploiting Authentication-Based Vulnerabilities. . . . 451
Exploiting Authorization-Based Vulnerabilities. . . . 461
Understanding Cross-Site Scripting (XSS) Vulnerabilities.. . . 463
Understanding Cross-Site Request Forgery and Server-Side
Request Forgery Attacks.. . . . . . 472
Understanding Clickjacking.. . . . . 480
Exploiting Security Misconfigurations. . . . . 480
Exploiting File Inclusion Vulnerabilities. . . . 482
Exploiting Insecure Code Practices. . . . . 484
Using Additional Web Application Hacking Tools. . . 488
Test Your Skills. . . . . . . 493
Chapter 11 Automating a Bug Hunt and Leveraging the Power of AI.. . 497
Traditional Bug Hunting Methods. . . . . 498
AI-Powered Automation in Bug Hunting.. . . . 500
AI Model Training, Fine-Tuning, and RAG for Bug Bounties. . . 516
Challenges of Using AI for Bug Bounty Hunting. . . . 521
Test Your Skills. . . . . . . 523
Appendix Answers to Multiple-Choice Questions.. . . . . 527
9780138363611, TOC, 2/18/2025