Rather than merely showing how to run existing exploits, author Jon Erickson explains how arcane hacking techniques actually work. To share the art and science of hacking in a way that is accessible to everyone, Hacking: The Art of Exploitation, 2nd Edition introduces the fundamentals of C programming from a hacker's perspective.

The included LiveCD provides a complete Linux programming and debugging environment-all without modifying your current operating system. Use it to follow along with the book's examples as you fill gaps in your knowledge and explore hacking techniques on your own. Get your hands dirty debugging code, overflowing buffers, hijacking network communications, bypassing protections, exploiting cryptographic weaknesses, and perhaps even inventing new exploits. This book will teach you how to:

• Program computers using C, assembly language, and shell scripts



• Corrupt system memory to run arbitrary code using buffer overflows and format strings



• Inspect processor registers and system memory with a debugger to gain a real understanding of what is happening



• Outsmart common security measures like nonexecutable stacks and intrusion detection systems



• Gain access to a remote server using port-binding or connect-back shellcode, and alter a server's logging behavior to hide your presence



• Redirect network traffic, conceal open ports, and hijack TCP connections



• Crack encrypted wireless traffic using the FMS attack, and speed up brute-force attacks using a password probability matrix

Hackers are always pushing the boundaries, investigating the unknown, and evolving their art. Even if you don't already know how to program, Hacking: The Art of Exploitation, 2nd Edition will give you a complete picture of programming, machine architecture, network communications, and existing hacking techniques. Combine this knowledge with the included Linux environment, and all you need is your own creativity.

The techniques in the book are best described by a caption on its back cover, "The fundamental techniques of serious hacking." It includes major sections on programming, networking, and cryptography. All material is covered with an eye towards exploitation. Languages used in the book material consist of C, PERL, and Assembly for X86.

The techniques described in this book are fundamental to any hacker or security professional who takes their work seriously. The book is well worth the discounted amazon.com price. The material in this book is all original and cannot be found elsewhere. Each example in the programming section is truly an eye opener if you are new to code hacking. The examples in the networking and cryptography sections are relevant and fresh as well.


Need to know Assembly   March 5, 2004
 82 out of 92 found this review helpful

You have probably heard of such hacking techniques as buffer overflows. Typically, a book might give only cursory explanation, especially if it is not devoted to hacking. But suppose you write in C. Chances are you've inadvertantly created buffer overflows and then spent hours chasing this down, after your program crashed. So how on earth can a deliberate overflow lead to a breakin?

It is for such matters that Erickson expounds here. Written for you, whether you want to create such exploits or prevent them. In either case, the knowledge is the same.

What the book requires is some knowledge of C and assembly. For the latter, it is the language of the Intel x86 family. But even if you don't know it, so long as you are familiar with any assembly language and the theory of a Neumann machine, then you can follow the text.

This book is not for every programmer. It turns out that a fair number of programmers get into the field by learning a high level language like C, Fortran, Java or Pascal. But they never learn any assembly. To them, anything compiled from source is a black box. Instead, you need some background in assembly.

The book also gives neat coverage of how to sniff network traffic and manipulate it. There is a section on cryptography. But for this, it is so specialised and vital that you should consult texts dedicated to it.


Superbe, thrilling , excellent book   November 14, 2003
 30 out of 36 found this review helpful

This is one of the best books I've ever read. I have read most of the current books in network security, and this is the first one, teaching you how to "think". While most other books on the market will show how to run exploits written by others, this is the first one addressing how to make yourself working exploit code. I am familiar with most papers on this issue (Murat's text, Aleph0' etc), but never before have I seen such clarity and pedagogical approach as in "hacking : the art of exploitation". Besides, I learned new techniques on exploiting an elf binary from this book.
Ever since I started reading it, I could not leave the book apart. The writing style is very clear, precise, making diffcult topics (like shellcode writing, printable shellcodes, heap/stack overflows) accesible and easily understandable for everyone.

The author presents three major topics. The first one addresses in excellent detail how software exploits can be crafted. Here you can learn a methodology on how buffer/heap/format string vulnerabilities are done. A second part of the book discusses network level vulnerabilities, while the last part adddresses cryptography. Even on this last topic, which traditionally looks either to mathematical or to general in other books, "hacking : the art of exploitation" is great and keeps one breathless.
To summarize : If you're interested in network security, or enjoying learning/reading neurons-stimulating stuff, this is the book to read.


A lot better than the rest!   February 10, 2006
 29 out of 31 found this review helpful

After reading more than 12 different books on this subject, finally I came across this, the best book ever on security. This is the kind of book that gives you what it promises on the cover. I was quiet impressed with the contents and style of writing.

I must add that I have learned a lot from this book, enough to help me in protecting my network and any unauthorized attempt to access my information. This is not for entertainment, like the others which I found in this genre (read Ankit Fadia and you will know what I mean here), this is some serious work by done by an author who knows what he his telling to the readers, and what they will understand. However, somewhere in between it get too technical, and one actually has to sit in front a computer to try and see what the author is trying to tell, but I liked it for being so real and accurate about computer security.

The author has done his homework well before writing it. I found almost all the information correct and original. Wonder why some people have given negative reviews for this book? Because, one has to be a technical qualified in computer security to fully understand what author is telling you. It's like me writing a review for a cooking recipe book. Also, I will like to add that buy it for securing your network, but don't expect it to teach you some serious hacking. For that you have to put lots of real efforts than just buying a book and reading it, though this book can always be a firm stepping stone!



Best hacking book in the market   April 17, 2004
 24 out of 26 found this review helpful

This book is 10 times greater than any other hacking book. It gives useful code and examples rather than 250 pages of theory. Stack and heap overflows are explained in detail as well as many other modern types of exploits. The best part of the book is that it teaches the reader how to write his/her own shellcode and teaches some basic Assembly language along the way. Everything you need to know to be a hacker or stop hackers.

Includes detailed explanations and code for:
buffer / stack / heap based overflows
format string vulnerabilities
writing shellcode
sniffing switched and unswitched networks
tcp / ip hijacking
denial of service
port scanning and tricking port scans of your own computer
password cracking
Man in the middle attacks
Wireless internet security / hacking
and more