PoC or GTFO, Volume 3


Book Description

Volume 3 of the PoC || GTFO collection--read as Proof of Concept or Get the Fuck Out--continues the series of wildly popular collections of this hacker journal. Contributions range from humorous poems to deeply technical essays bound in the form of a bible. The International Journal of Proof-of-Concept or Get The Fuck Out is a celebrated collection of short essays on computer security, reverse engineering and retrocomputing topics by many of the world's most famous hackers. This third volume contains all articles from releases 14 to 18 in the form of an actual, bound bible. Topics include how to dump the ROM from one of the most secure Sega Genesis games ever created; how to create a PDF that is also a Git repository; how to extract the Game Boy Advance BIOS ROM; how to sniff Bluetooth Low Energy communications with the BCC Micro:Bit; how to conceal ZIP Files in NES Cartridges; how to remotely exploit a TetriNET Server; and more. The journal exists to remind us of what a clever engineer can build from a box of parts and a bit of free time. Not to showcase what others have done, but to explain how they did it so that readers can do these and other clever things themselves.




PoC or GTFO, Volume 3


Book Description

Volume 3 of the PoC || GTFO collection--read as Proof of Concept or Get the Fuck Out--continues the series of wildly popular collections of this hacker journal. Contributions range from humorous poems to deeply technical essays bound in the form of a bible. The International Journal of Proof-of-Concept or Get The Fuck Out is a celebrated collection of short essays on computer security, reverse engineering and retrocomputing topics by many of the world's most famous hackers. This third volume contains all articles from releases 14 to 18 in the form of an actual, bound bible. Topics include how to dump the ROM from one of the most secure Sega Genesis games ever created; how to create a PDF that is also a Git repository; how to extract the Game Boy Advance BIOS ROM; how to sniff Bluetooth Low Energy communications with the BCC Micro:Bit; how to conceal ZIP Files in NES Cartridges; how to remotely exploit a TetriNET Server; and more. The journal exists to remind us of what a clever engineer can build from a box of parts and a bit of free time. Not to showcase what others have done, but to explain how they did it so that readers can do these and other clever things themselves.




The YouTube Formula


Book Description

The Wall Street Journal bestseller! Comes with free online companion course Learn the secrets to getting dramatic results on YouTube Derral Eves has generated over 60 billion views on YouTube and helped 24 channels grow to one million subscribers from zero. In The YouTube Formula: How Anyone Can Unlock the Algorithm to Drive Views, Build an Audience, and Grow Revenue, the owner of the largest YouTube how-to channel provides the secrets to getting the results that every YouTube creator and strategist wants. Eves will reveal what readers can't get anywhere else: the inner workings of the YouTube algorithm that's responsible for determining success on the platform, and how creators can use it to their advantage. Full of actionable advice and concrete strategies, this book teaches readers how to: Launch a channel Create life-changing content Drive rapid view and subscriber growth Build a brand and increase engagement Improve searchability Monetize content and audience Replete with case studies and information from successful YouTube creators, The YouTube Formula is perfect for any creator, entrepreneur, social media strategist, and brand manager who hopes to see real commercial results from their work on the platform.




The Hardware Hacking Handbook


Book Description

The Hardware Hacking Handbook takes you deep inside embedded devices to show how different kinds of attacks work, then guides you through each hack on real hardware. Embedded devices are chip-size microcomputers small enough to be included in the structure of the object they control, and they’re everywhere—in phones, cars, credit cards, laptops, medical equipment, even critical infrastructure. This means understanding their security is critical. The Hardware Hacking Handbook takes you deep inside different types of embedded systems, revealing the designs, components, security limits, and reverse-engineering challenges you need to know for executing effective hardware attacks. Written with wit and infused with hands-on lab experiments, this handbook puts you in the role of an attacker interested in breaking security to do good. Starting with a crash course on the architecture of embedded devices, threat modeling, and attack trees, you’ll go on to explore hardware interfaces, ports and communication protocols, electrical signaling, tips for analyzing firmware images, and more. Along the way, you’ll use a home testing lab to perform fault-injection, side-channel (SCA), and simple and differential power analysis (SPA/DPA) attacks on a variety of real devices, such as a crypto wallet. The authors also share insights into real-life attacks on embedded systems, including Sony’s PlayStation 3, the Xbox 360, and Philips Hue lights, and provide an appendix of the equipment needed for your hardware hacking lab – like a multimeter and an oscilloscope – with options for every type of budget. You’ll learn: How to model security threats, using attacker profiles, assets, objectives, and countermeasures Electrical basics that will help you understand communication interfaces, signaling, and measurement How to identify injection points for executing clock, voltage, electromagnetic, laser, and body-biasing fault attacks, as well as practical injection tips How to use timing and power analysis attacks to extract passwords and cryptographic keys Techniques for leveling up both simple and differential power analysis, from practical measurement tips to filtering, processing, and visualization Whether you’re an industry engineer tasked with understanding these attacks, a student starting out in the field, or an electronics hobbyist curious about replicating existing work, The Hardware Hacking Handbook is an indispensable resource – one you’ll always want to have onhand.




Spam Kings


Book Description

Looks at a variety of spam entrepreneurs and how anti-spam activists are trying to stop their activities.




Pentesting Azure Applications


Book Description

A comprehensive guide to penetration testing cloud services deployed with Microsoft Azure, the popular cloud computing service provider used by companies like Warner Brothers and Apple. Pentesting Azure Applications is a comprehensive guide to penetration testing cloud services deployed in Microsoft Azure, the popular cloud computing service provider used by numerous companies. You'll start by learning how to approach a cloud-focused penetration test and how to obtain the proper permissions to execute it; then, you'll learn to perform reconnaissance on an Azure subscription, gain access to Azure Storage accounts, and dig into Azure's Infrastructure as a Service (IaaS). You'll also learn how to: - Uncover weaknesses in virtual machine settings that enable you to acquire passwords, binaries, code, and settings files - Use PowerShell commands to find IP addresses, administrative users, and resource details - Find security issues related to multi-factor authentication and management certificates - Penetrate networks by enumerating firewall rules - Investigate specialized services like Azure Key Vault, Azure Web Apps, and Azure Automation - View logs and security events to find out when you've been caught Packed with sample pentesting scripts, practical advice for completing security assessments, and tips that explain how companies can configure Azure to foil common attacks, Pentesting Azure Applications is a clear overview of how to effectively perform cloud-focused security tests and provide accurate findings and recommendations.




Crypto Dictionary


Book Description

Rigorous in its definitions yet easy to read, Crypto Dictionary covers the field of cryptography in an approachable, and sometimes humorous way. Expand your mind and your crypto knowledge with the ultimate desktop dictionary for all things cryptography. Written by a renowned cryptographer for experts and novices alike, Crypto Dictionary is rigorous in its definitions, yet easy to read and laced with humor. Flip to any random page to find something new, interesting, or mind-boggling, such as: • A survey of crypto algorithms both widespread and niche, from RSA and DES to the USSR’s GOST cipher • Trivia from the history of cryptography, such as the MINERVA backdoor in Crypto AG’s encryption algorithms • An explanation of why the reference to the Blowfish cipher in the TV show 24 makes absolutely no sense • Types of cryptographic protocols like zero-knowledge; security; and proofs of work, stake, and resource • A polemic against referring to cryptocurrency as “crypto” • Discussions of numerous cryptographic attacks, including slide and biclique The book also looks toward the future of cryptography, with discussions of the threat quantum computing poses to current cryptosystems and a nod to post-quantum algorithms, such as lattice-based cryptographic schemes. With hundreds of incisive entries organized alphabetically, Crypto Dictionary is the crypto go-to guide you’ll always want within reach.




Gray Hat C#


Book Description

Learn to use C#'s powerful set of core libraries to automate tedious yet important tasks like performing vulnerability scans, malware analysis, and incident response. With some help from Mono, you can write your own practical security tools that will run on Mac, Linux, and even mobile devices. Following a crash course in C# and some of its advanced features, you’ll learn how to: –Write fuzzers that use the HTTP and XML libraries to scan for SQL and XSS injection –Generate shellcode in Metasploit to create cross-platform and cross-architecture payloads –Automate Nessus, OpenVAS, and sqlmap to scan for vulnerabilities and exploit SQL injections –Write a .NET decompiler for Mac and Linux –Parse and read offline registry hives to dump system information –Automate the security tools Arachni and Metasploit using their MSGPACK RPCs Streamline and simplify your work day with Gray Hat C# and C#’s extensive repertoire of powerful tools and libraries.




A Bug Hunter's Diary


Book Description

Klein tracks down and exploits bugs in some of the world's most popular programs. Whether by browsing source code, poring over disassembly, or fuzzing live programs, readers get an over-the-shoulder glimpse into the world of a bug hunter as Klein unearths security flaws and uses them to take control of affected systems.




Bug Bounty Bootcamp


Book Description

Bug Bounty Bootcamp teaches you how to hack web applications. You will learn how to perform reconnaissance on a target, how to identify vulnerabilities, and how to exploit them. You’ll also learn how to navigate bug bounty programs set up by companies to reward security professionals for finding bugs in their web applications. Bug bounty programs are company-sponsored programs that invite researchers to search for vulnerabilities on their applications and reward them for their findings. This book is designed to help beginners with little to no security experience learn web hacking, find bugs, and stay competitive in this booming and lucrative industry. You’ll start by learning how to choose a program, write quality bug reports, and maintain professional relationships in the industry. Then you’ll learn how to set up a web hacking lab and use a proxy to capture traffic. In Part 3 of the book, you’ll explore the mechanisms of common web vulnerabilities, like XSS, SQL injection, and template injection, and receive detailed advice on how to find them and bypass common protections. You’ll also learn how to chain multiple bugs to maximize the impact of your vulnerabilities. Finally, the book touches on advanced techniques rarely covered in introductory hacking books but that are crucial to understand to hack web applications. You’ll learn how to hack mobile apps, review an application’s source code for security issues, find vulnerabilities in APIs, and automate your hacking process. By the end of the book, you’ll have learned the tools and techniques necessary to be a competent web hacker and find bugs on a bug bounty program.