构建专业渗透测试全攻略：从零到精通

需积分: 0 124 浏览量更新于2024-07-28 收藏 8.86MB PDF 举报

"《精通渗透测试：创建与运营正式黑客实验室》是一本与众不同的IT专业书籍，它不仅深入探讨了渗透测试的全过程，从构思到完成，而是全方位地剖析了专业渗透测试的各个方面。作者将焦点放在了项目管理、组织结构、团队建设、职业发展、指标衡量、报告编写、测试数据存档、风险管理，以及培训等多个关键环节。书中强调，渗透测试不仅仅是识别和利用信息系统漏洞，还包括信息收集、漏洞识别、漏洞利用、权限提升、持续访问保持以及掩盖踪迹等一系列技术技能。读者将通过本书了解到如何构建一个正式的黑客实验室，以及如何将其应用于实际工作场景中，确保测试的专业性和有效性。此外，作者还特别提到了版权问题，尊重知识产权是学术和实践的重要原则，任何对作品的复制或传播都必须得到出版商的书面许可。该书由Elsevier出版社发行，并提供了关于版权许可政策的详细信息，可通过出版社网站www.elsevier.com/permissions查询获取更多授权和合作细节。《精通渗透测试》对于那些希望在信息安全领域提升专业技能，尤其是渗透测试领域的从业人员来说，是一本不可或缺的参考书，它既提供了理论知识，也注重实践操作的指导，帮助读者建立完整的渗透测试流程并提升个人职业发展路径。"

CHAPTER 18 Planni ng for Your Next PenTest ............................................ 465

Introduction .................................................................... 465

Risk Management Register ...... .......................................... 466

Creating a Risk Management Register ............................. 466

Prioritization of Risks and Responses ............................. 467

Knowledge Database ........................................................ 468

Creating a Knowledge Database ..................................... 468

Sanitization of Findings ....................................... ......... 469

Project Management Knowledge Database ....................... 469

After-Action Review ......................................................... 470

Project Assessments ..................................................... 470

Team Assessments ....................................................... 471

Training Proposals ....................................................... 471

Summary ........................................................................ 473

Solutions Fast Track ......................................................... 473

Risk Management Register ............................................ 473

Knowledge Database .................................................... 474

After-Action Review ..................................................... 474

Frequently Asked Questions .............................................. 474

Expand Your Skills ........................................... ............... 475

Reference ....................................................................... 476

Appendix A: Acronyms ............................................................................. 477

Appendix B: Definitions ........................................................................... 489

Index .................................................................................................. 495

Contents xv

Acknowledgments

Most people look at a book and see one or two names on the cover and never

realize the numerous people involved behind the scenes. Here is my feeble

attempt to recognize a few of those who have contributed to developing the book

or the online training program.

FAMILY

Without doubt, the most helpful and supportive members of the book-

development cast is my family. All the time spent working and in education

would never have been possible without the unwavering support of my wife,

Crystal. Her ability to work behind the scenes to support the family, including our

two daughters while I’ve been occupied deserves to be recognized. The fact that

our eldest daughter is autistic has complicated life; yet Crystal has continued to

provide unwavering support. For all she has done, this book is dedicated to her.

My parents have also been very influential in my progress throughout my life.

Without their support and care, none of this would have been possible. I will

constantly strive to be half the man as my father, and a fraction as caring as my

mother – they have set the bar very high, and I appreciate all they have done.

HEOROT.NET

The materi al in this book was not originally destined for a book. The courses

included in the DVD were developed as online courses, but this book is the direct

result of the success of the online training programs. This success would never

have been possible without the support of two very talented individuals – Aaron

Follette and Jason Rohman. These two individuals deserve more recognition for

their hard work in developing the online courses than I can give them credit for in

this short section of the book. Not only have they been my great friends, they have

worked diligently to help make Heorot.net successful.

ON THE SIDE

Two people have helped influence the book development – Jeff Langr and Nathan

Farrar. Jeff Langr is by far the best project manager and programmer I have come

across. His knowledge and innate desire to help others learn have been

inspirational, and I cannot speak highly enough of his published contributions

to programming and hands-on help with my own career and writing. Nathan was

an integral part of the writing process, and I deeply appreciate his help and

enthusiasm. A recent college graduate who has moved on to better endeavors,

xvii

Foreword

This book is a divergence from most books as it discusses professional penetration

testing from conception to completion. Rather than focusing solely on information

system vulnerability identification and exploitation, by the end of this book we will

have examined all aspects of a professional penetration test, including project

management, organizational structures, team building, career development,

metrics, reporting, test-data archival methods, risk management, and training . . .

in addition to . . . information gathering, vulnerability identification, vulnerability

exploitation, privilege escalation, maintaining access, and covering our tracks.

The second factor that makes this book unique is the inclusion of two video

courses, designed to teach fundamental and intermediate information system

penetration testing techniques. These courses were developed as online training

classes and offered through Heorot.net and targeted both experienced and novice

penetration test practitioners. The course provided the learner with hands-on

experience, so they could translate the theoretical knowledge of PenTesting into

real-world skills.

The third advantage of this book is the above-mentioned hands-on experience.

The accompanying DVD includes everything needed to create a penetration test

lab, including target systems that mimic real-world servers. The target systems

were developed specifically to be attacked and hacked within a PenTest lab, and

offer different levels of complexity and difficulty. For those who are unfamiliar

with penetration testing techniques, the target systems included in this book

provide a gradual learning curve, which will challenge both novices and experts

alike.

The Heorot.net Web site should be considered as an extension of this book. The

forum section has numerous discussions on all the topics presented in this book as

well as the De-ICE challenges. New LiveCDs are in development to challenge skills,

and how-to videos are being added. Take advantage of the shared knowledge. If

you have any questions or comments about the book, its contents, or the Heorot.

net site, please don’t hesitate to contact me directly at twilhelm@heorot.net.

Enjoy!

xix

剩余524页未读，继续阅读

zhxiong

粉丝: 0
资源: 1

构建专业渗透测试全攻略：从零到精通

使用Burpsuite精通Web渗透测试-英文版 非常好

epub格式.rar

2信息搜集-DNS-IP踩点 Metasploit渗透测试从入门到精通配套上课课件.zip

怎么快速的精通软件测试

两个月内如何精通软件测试

软件测试从入门到精通

sqlmap从入门到精通.pdf

2021 最新jmeter接口测试入门到精通实战

kali linux 书籍在线阅读

python自动化测试从入门到精通

最新资源

使用Burpsuite精通Web渗透测试-英文版非常好