دانلود کتاب ارزیابی امنیت شبکه – ویرایش سوم

This book tackles a single area of computer security in detail—undertaking network-based penetration testing in a structured manner. The methodology I present describes how determined attackers scour Internet-based networks in search of vulnerable components and how you can perform similar exercises to assess your environment. Assessment is the first step any organization should take to manage its risk. By testing your networks in the same way that a determined adversary does, you proactively identify weaknesses within them. In this book, I pair offensive content with bulleted checklists of countermeasures to help you devise a clear technical strategy and fortify your environment accordingly. This book assumes that you have familiarity with networking protocols and Unix-based operating system administration. If you are an experienced network engineer or security consultant, you should be comfortable with the contents of each chapter. To get the most out of this book, you should be familiar with:
OSI Layer 2 network operation (primarily ARP and 802.1Q VLAN tagging)
The IPv4 protocol suite, including TCP, UDP, and ICMP
The operation of popular network protocols (e.g., FTP, SMTP, and HTTP)
Basic runtime memory layout and Intel x86 processor registers
Cryptographic primitives (e.g., Diffie-Hellman and RSA key exchange)
Common web application flaws (XSS, CSRF, command injection, etc.)
Configuring and building Unix-based tools in your environment