Hacking: The Next Generation: The Next Generation and over 2 million other books are available for Amazon Kindle . Learn more
  • RRP: £26.50
  • You Save: £5.00 (19%)
FREE Delivery in the UK.
Only 2 left in stock (more on the way).
Dispatched from and sold by Amazon.
Gift-wrap available.
Hacking: The Next Generat... has been added to your Basket
+ £2.80 UK delivery
Used: Good | Details
Condition: Used: Good
Comment: Expedited shipping available on this book. The book has been read but remains in clean condition. All pages are intact and the cover is intact. Some minor wear to the spine.
Trade in your item
Get a £5.37
Gift Card.
Have one to sell?
Flip to back Flip to front
Listen Playing... Paused   You're listening to a sample of the Audible audio edition.
Learn more
See all 2 images

Hacking: The Next Generation Paperback – 1 Oct 2009

See all 3 formats and editions Hide other formats and editions
Amazon Price New from Used from
Kindle Edition
"Please retry"
"Please retry"
£12.99 £11.10
£21.50 FREE Delivery in the UK. Only 2 left in stock (more on the way). Dispatched from and sold by Amazon. Gift-wrap available.

Trade In this Item for up to £5.37
Trade in Hacking: The Next Generation for an Amazon Gift Card of up to £5.37, which you can then spend on millions of items across the site. Trade-in values may vary (terms apply). Learn more

Product details

  • Paperback: 298 pages
  • Publisher: O'Reilly Media; 1 edition (1 Oct. 2009)
  • Language: English
  • ISBN-10: 0596154577
  • ISBN-13: 978-0596154578
  • Product Dimensions: 17.8 x 2 x 23.3 cm
  • Average Customer Review: 3.5 out of 5 stars  See all reviews (2 customer reviews)
  • Amazon Bestsellers Rank: 639,691 in Books (See Top 100 in Books)
  • See Complete Table of Contents

More About the Authors

Discover books, learn about writers, and more.

Product Description

About the Author

Nitesh Dhanjani is a well known security researcher, author, and speaker. Dhanjani is currently Senior Manager at a large consulting firm where he advises some of the largest corporations around the world on how to establish enterprise wide information security programs and solutions. Dhanjani is also responsible for evangelizing brand new technology service lines around emerging technologies and trends such as cloud computing and virtualization.

Prior to his current job, Dhanjani was Senior Director of Application Security and Assessments at a major credit bureau where he spearheaded brand new security efforts into enhancing the enterprise SDLC, created a process for performing source code security reviews & Threat Modeling, and managed the Attack & Penetration team.

Dhanjani is the author of "Network Security Tools: Writing, Hacking, and Modifying Security Tools" (O'Reilly) and "HackNotes: Linux and Unix Security" (Osborne McGraw-Hill). He is also a contributing author to "Hacking Exposed 4" (Osborne McGraw-Hill) and "HackNotes: Network Security". Dhanjani has been invited to talk at various information security events such as the Black Hat Briefings, RSA, Hack in the Box, Microsoft Blue Hat, and OSCON.

Dhanjani graduated from Purdue University with both a Bachelors and Masters degree in Computer Science.

Dhanjani's personal blog is located at dhanjani.com.

Billy Rios is currently a Security Engineer for Microsoft where he studies emerging risks and cutting edge security attacks and defenses. Before his current role as a Security Engineer, Billy was a Senior Security Consultant for various consulting firms including VeriSign and Ernst and Young. As a consultant, Billy performed network, application, and wireless vulnerability assessments as well as tiger team/full impact risk assessments against numerous clients in the Fortune 500.
Before his life as a consultant, Billy helped defend US Department of Defense networks as an Intrusion Detection Analyst for the Defense Information Systems Agency (DISA) and was an active duty Officer in the US Marine Corps (deployed in support of OIF in 2003). Billy s thought leadership includes speaking engagements at numerous security conferences including: Blackhat Briefings, RSA, Microsoft Bluehat, DEFCON, PacSec, HITB, the Annual Symposium on Information Assurance (ASIA), as well as several other security related conferences. Billy holds a Master of Science degree in Information Systems, a Master of Business Administration degree, and an undergraduate degree in Business Administration

Brett Hardin is a Security Research Lead with McAfee. At McAfee, Brett bridges security and business perspectives to aid upper management in understanding security issues. Before joining McAfee, Brett was a penetration tester for Ernst and Young's Advanced Security Center assessing web application and intranet security for Fortune 500 companies.
In addition, Brett also is the author of misc-security.com. A blog dedicated to focusing on security topics from a high-level or business-level perspective.

Brett holds a bachelor of science in Computer Science from California State University at Chico.

Inside This Book (Learn More)
Browse Sample Pages
Front Cover | Copyright | Table of Contents | Excerpt | Index | Back Cover
Search inside this book:

What Other Items Do Customers Buy After Viewing This Item?

Customer Reviews

3.5 out of 5 stars
5 star
4 star
3 star
2 star
1 star
See both customer reviews
Share your thoughts with other customers

Most Helpful Customer Reviews

2 of 2 people found the following review helpful By Siraj A. Shaikh on 9 Dec. 2009
Format: Paperback
The next generation of hackers will not simply port-scan your network and plan an attack on an unpatched machine. They will be far more sophisticated. They will target individuals, extract details from social network profiles, and manipulate communications to convince your colleagues to reveal sensitive corporate information. This is essentially what this book is about: the set of modern tools and tactics to focus on advanced reconnaissance approaches to using cross-site scripting for stealing sessions.

The authors present this fascinating new world of hackers, and explain how they use web 2.0 to their advantage. While the title of the book is more general, the content is far more focused on the social engineering aspects of hacking.

Chapter 1 sets the scene by delving into various reconnaissance techniques, with a focus on social networks and modern web services. Rarely is the first chapter of a book so revealing of what is to follow in subsequent chapters. From dumpster-diving to overhearing conversations, from Google Earth to web searching, from Facebook to Twitter, and from email harvesting to job postings. It has it all to tempt the reader into this intriguing world of hacking.

The following three chapters present a technical journey into various recent techniques to compromise web and other services. While some of the ideas on cross-site aspects are interesting, some others (such as ARP poisoning) are already much-trodden.

Chapter 7 was most interesting. Phishing is an understudied phenomena, and the attention paid to it in this book is much deserved. The last three chapters focus on social networks, and delve into the specifics of hypothetical attack scenarios. Some themes are repetitive and lose sight of reality.
Read more ›
Comment Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback. If this review is inappropriate, please let us know.
Sorry, we failed to record your vote. Please try again
1 of 1 people found the following review helpful By earthgecko on 16 Dec. 2009
Format: Paperback
Good read. Very informative, not your average hack tome. Very informative, disects and discusses the new "hacks" with readable and understandable examples. Very useful to gain some insight into what is happening now.

If you are a technical person with any interest in security this is a great overview of the current playing/minefield, chances are you'll learn something.
Comment Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback. If this review is inappropriate, please let us know.
Sorry, we failed to record your vote. Please try again

Most Helpful Customer Reviews on Amazon.com (beta)

Amazon.com: 21 reviews
22 of 22 people found the following review helpful
birds eye view...with a sufficient level of detail. 7 Oct. 2009
By N. Povoa - Published on Amazon.com
Format: Paperback
I'm always skeptical about books that propose to cover such a vast spectrum of subjects, the book in question however does a wonderful job at explaining in plain english what is happening behind an attack, it unveils the possible motives and end result, and I personally found it a superb manuscript on what is happening today in the fields of hacking and social engineering.

On a more technical side it covers XSS attacks and blended exploits, again in plain english. Though the authors also throw some code in there to keep the techiest of us entertained, personally I found the inclusion of code somewhat unnecessary. 'Plain english' would suffice especially because I found that this would otherwise be the perfect book to hand to someone less techy who wants to know what is happening out there in the wild and to some extent what they need to look out for if they intend to be security conscious. Could they ignore the code? sure! will they? depends on the individual and his/her aversion to programming. It still keeps its five stars though, I cant fault a book for having too much information. The book also covers phishing attacks, that chapter was a very worth wile read. I hold no interest or curiosity in phishing attacks and after reading it I was surprised on what I had learned.

The chapters on social engineering and information gathering were very interesting as well. The authors made a clear effort to mention current online tools that attackers can use to acquire information on a target (may that be a person or a corporate entity) and go into deeper detail on how such an attack can develop into face to face contact with a target. The way the book is written makes it feel like a story, like one attack unfolds into another and that is really why this book is such good fun to read.

If there's something I can fault in this book its really its life span. You have to get it now for it to matter. In 2 years time all this will be old, stale news and at the speed things change in the IT/IS world its really quite inevitable. Social engineering will always be social engineering but the tools used to gather information will surely change.
23 of 25 people found the following review helpful
An excellent book that deals with many new attack vectors you may not have considered... 17 Oct. 2009
By Thomas Duff - Published on Amazon.com
Format: Paperback
I've read my share of hacking books over the years, and usually most of the books focus on the same topics... pointer overflows, brute force password hacks, etc. But with all the movement towards Web 2.0, the Cloud, and social networks, is it possible that hacking vectors have shifted somewhat into areas we don't normally worry about? After reading Hacking: The Next Generation by Nitesh Dhanjani, Billy Rios, and Brett Hardin, the answer is definitely yes. There's a whole new series of things to worry about, both from a corporate and a personal level.

Intelligence Gathering: Peering Through the Windows to Your Organization
Inside-Out Attacks: The Attacker Is the Insider
The Way It Works: There Is No Patch
Blended Threats: When Applications Exploit Each Other
Cloud Insecurity: Sharing the Cloud with Your Enemy
Abusing Mobile Devices: Targeting Your Mobile Workforce
Infiltrating the Phishing Underground: Learning from Online Criminals?
Influencing Your Victims: Do What We Tell You, Please
Hacking Executives: Can Your CEO Spot a Targeted Attack?
Case Studies: Different Perspectives
Chapter 2 Source Code Samples

Yes, the deeply technical hacks still exist, the ones that rely on badly coded software to gain privileges you aren't granted. But in some ways, the hacks are getting easier, or at least more available to those who are not hardcore techheads. Take for instance, blended threats. This is an interesting concepts that shows how interconnected software environments have become. In the example they use, Microsoft had a minor vulnerability in XP and Vista, while Apple had a minor vulnerability in their Safari browser. Both vendors didn't feel that either item was critical. That changed (at least for Microsoft) when someone used the behavior in Safari running on Windows to place a dll file on the Windows desktop. This dll file was then used by IE7 when starting up, overriding the use of the real dll in the proper Window directories. You can imagine how this would lead to "undesirable consequences."

And if that's not enough, imagine the potential of hacks in the Cloud. The authors show how one could hack an administration console to a Cloud provider, allowing someone to modify a number of parameters of a Cloud account. Or... if your attack target runs on the Cloud and is charged based on bandwidth and CPU, imagine what you could do to this target if you were to launch a distributed denial of service attack using the Cloud as the attacking client. The resources are almost limitless, and the target will get hit with charges that escalate at an incredible rate. Not a comforting thought if you've trusted your business to "the Cloud"...

I also noticed that more and more, hacking is not so much about taking over hardware as it is about getting a pipeline to timely information. For instance, more and more people are using shared and public calendars to manage their daily work. It's not uncommon to be able to search and find conference call details that aren't removed from the entry. If you find this info, it's very possible that you can call in to the number, remain on mute, and pick up vital information that can be of value to you or other companies. This type of hack isn't technical in the least. It's just a mix of Google searching and ignorant/non-cautious users.

I'd really recommend Hacking: The Next Generation to my fellow techies. More important than learning new ways to mess with each other's minds, it will expose you to a number of new attack vectors that you may not have considered. And in most cases, simple awareness of those new vectors is enough to allow you to start to defend against them.

Obtained From: Publisher
Payment: Free
18 of 19 people found the following review helpful
Great Book! 12 Dec. 2009
By David Chazin - Published on Amazon.com
Format: Paperback Verified Purchase
This is a great read if you are interested in understanding what types of things make your systems and identity vulnerable to hacking. I basically read it cover to cover in a single sitting, I could not put it down. This is not a book that tells you how to secure your systems against various threats, but rather explains in detail how threats arise and how they are exploited. If you are a software professional interested in building secure systems or just interested in how to protect yourself online I highly recommend this book.
5 of 5 people found the following review helpful
Introductory and probably most suitable to the masses who won't read it because of all the code, jargon and assumed knowledge 19 April 2011
By Christian R. Unger - Published on Amazon.com
Format: Paperback Verified Purchase
This is quite a strange book, because on the one hand it is quite technical in listing sample code, and assuming base knowledge. On the other hand it covers some really basic things in great deal, while glossing over some things with phrases to the effect of "the attacker now has access to the entire organisation's mail", when really, they wouldn't.

So there is a fair bit of fear mongering, but not because they are wrong so much as because they are skipping some steps. That, to me, seems a fatal flaw, because the technical people would say "yeah ... ok, if I assume you are as good as you claim to be", and the non-technical people are thinking this is Harry Potter, because there were some arcane script(ure)s and then stuff went very bad.

I'd say that to most technical people with a slight security focus there is nothing new in here. To the non-technical or non-security people though, who the text (not the code) is (should be) aimed at, various bits will be very off-putting. Especially the code and the jargon.

Also, this title fails to appreciate that successful attacks are not just down to people being in a rush and warning messages not being user friendly. Granted, their analysis of phishers is a great read, but I don't think it will be read by the right people. Technical aware people already know they are mostly muppets, and non-technical people won't get the joke because it is buried in php code.

One saving grace, which sadly is too little (one short chapter) and too late (last chapter), are the two case studies that conclude the book. The two case studies highlight first a very effective but non technical attack, and then rather technical attack which does feature a bit of code, but not terribly so. I guess the prior chapters were needed to lay the foundation, but even then, I fear that non-technical readers would be put of by the technical attack's code. Though in this case the code dumps are much more illustrative and far less technical. Problem is though, most non-technical reads would probably not have made it this far.

In the end, this is a very light read to security/IT aware that reminds one of the basic techniques and a missed opportunity to become aware to the unaware. Who then benefits from this book in its current form? Probably junior IT staff and Security researchers for a good introduction ... to junior IT staff. Non-IT staff are probably better off with Secrets and Lies: Digital Security in a Networked World which is aimed at managers more than anything, technical people probably already know where to look (if not check out Bruce Schneier's free news letter at [...] ).
6 of 7 people found the following review helpful
Everything you would expect from the title 26 Oct. 2009
By Wayne M. Gipson - Published on Amazon.com
Format: Paperback
Hacking The Next Generation

This was a very well written book. The authors did a great job of mixing technical and non-technical attack vectors. I felt the flow of the book was very well done, keeping the reader engaged the entire time. The authors gave enough information on each topic to get you started, but did not inundate you with the minute details that can get overwhelming. In many chapters of the book the authors use scenarios to relate the reader to a topic. This method helped me grasp a few of the concepts that may have otherwise taken a second or third read.

In most of the sections that described technical attack vectors the authors gave links to tools that would help the reader perform that specific attack. Not only is this a great way to help the reader increase their tool set, it allows the reader to put into practice what was just read.

Chapter 2: Inside-Out-Attacks is an example of how every technical topic should be taught. The authors used scenario based writing mixed with technical details that really help the reader grasp the concept. Again, these are not littered with enough technical detail to understand in-depth how these attacks work, but they will give you a general understanding of each topic.

Chapter 7: Infiltrating the Phishing Underground was my favorite in the book. The author did a great job of relating how the underground works, how you get in contact with people, and how the act of phishing transpires. I was amazed to read how templates are shared, how they are put in place, and how the phishing crowd feel about each other.

Chapter 5: Sharing the Cloud with Your Enemy was not really what I expected. I was hoping to hear of some new attack vectors, but didn't seem to get that. It was a great reminder of the risks to companies that use shared resources, and allow other administrators to control those resources, but this all seemed like common knowledge.

Overall this book was great. The content seemed very fresh, and where it was overlap from previous readings the authors seemed to put a new spin on old ideas. If you are looking for a book that will teach you step by step how to hack a website, or steal some credit cards, this book is not for you. This book is a great overview of multiple attack vectors, giving broad overviews of each one.

Wayne Gipson, CISSP, CISA
Were these reviews helpful? Let us know