Metaspoit: A Penetration Tester's Guide (MAPTG) from David Kennedy (@Dave_Rel1k), Jim O'Gorman (@_Elwood_), Devon Kearns (@dookie2000ca), and Mati Aharoni (@backtracklinux) is probably the foremost resource one can obtain for learning the basics of the Metasploit framework. The book is for those behind the curve a little bit and haven't used Metasploit yet. I feel like the book does a great job of delivering on what it promises, a foundation knowledge of the ins and outs of the great framework. By the time you finish the book you should understand how to use the framework; you most likely will not understand all of it, but it gives you great information on how you can figure it out really through utilizing the many utilities within the tool.
Let me start this review off by stating my personal opinion on how you should utilize this book: build a test penetration lab and follow the books instructions as you go along. Take advantage of the appendices! Appendix A will tell you how to setup your test environments, both your attack machines and your victim machines. Appendix B is your cheat sheet and quick reference for the numerous commands you'll be using. I suggest starting here and just familiarize yourself here before you begin. This is not what I did, but in retrospect I really wish I had.
The book doesn't waste time, after going into the basics of what will occur in a standard penetration test. The authors state that this book is not the best source for understanding all that can occur in a Pen Test and refer to the Penetration Test Execution Standard as a better source of gaining better insight on the subject if you're looking for it. Next the book cover's the basics of metasploit so you can get around the console with better familiarity, or options you have if you want more information. These chapters are small and cover the essentials of what you'll need to know to get through the book if you have no prior knowledge about the tool. The following chapters, which I will not cover in depth, go step-by-step through a basic Pen Test outline. They start and information gathering and go all the way into creating your own exploits to automating your process with scripts within the framework.
Every chapter covers it's subject very well. They're very concise and to the point, which I enjoy a whole lot. Also, most of the chapters include examples of how to run the tools, and what output should look like (which is why I suggest you set up a lab environment and run the commands as your read them). At times, I wish the chapters were a bit more in-depth, especially the creation of exploits chapter; however, that is probably a bit outside the scope of this particular book. I especially enjoyed the chapters on creating exploits and the power of the Social-Engineering Toolkit. The final chapter uniquely summarized what was learned in the book by explaining how to simulate a penetration test, and if completed properly will have you exploiting your vulnerable test lab in no time.
I highly would recommend this book to anyone who is looking to get into Metasploit a lot more. It gives you a great base to learn the tool, and if nothing else spawn even more of a desire to learn more (I know it did for me). I started this book with very base knowledge of the Metasploit framework, and after some testing and the guidance of this book I feel a lot more comfortable with using the amazing power behind Metasploit. You can pick this book up for about $28 dollars on Amazon, this is an amazing value! I would suggest if you even have an interest in penetration testing that you pick up this book and read it.
No comments:
Post a Comment