One of the early entries into books on penetration testing (pen test), Hack I.T. takes the next step from hacking tools to a systematic approach to discovering vulnerabilities. This is not a theoretical book, the authors have engaged in pen testing for clients and are sharing their expertise. They cover both Unix and Windows systems, with examples for each that start with deciding on a target and go to achieving the objective. The objective may be root, file access or some other permission which was not allowed.

Defining the hacker levels right away helps to put them in perspective. Often, we only think about the "real" hackers/crackers and the script kiddies. Hack I. T. divides them into three levels, then also illuminates the security professional in the same light. There is a broad range of skills that are necessary to be competent in the pen test environment as well as a depth of knowledge for certain areas.

The book is quite comprehensive in its coverage, which makes it useful for someone who is considering hiring a pen test professional or group. It is also valuable for someone who might be interested becoming a professional or doing their own work. One chapter of note is the tool kit chapter. More than just a list of software, the rationale for a tool kit is given so that you can adjust your tool kit to specific situations. It is up to date enough to include VMWare, a virtual machine that allows several operating systems on one machine without the need for dual booting.

Although it may seem a bit old fashion, war dialing is included. Software which dials a series of phone numbers looking for modems, and possibly open ports, still turns out to be useful. In many organizations, for example, some employees have modems attached to their desktop. The managers of this example company might want the pen tester to check all the phone numbers within the company to see who has a live modem attached. The modems could be a security problem or simply against company policy. In addition to this example, many, if not most, network users connect to their ISP using a phone line.

A more modern chapter deals with web server testing. A web server is generally susceptible to operating systems vulnerabilities. If you can break into a system and escalate your privileges, it does not matter that it was a web server. You still have access to everything. However, web servers have CGI (Common Gateway Interface) vulnerabilities which are specific to the web server. This chapter presents the concepts and tools for this environment.

This book is welcome addition to the security library. It goes beyond the idea of simply hacking into systems to the world on pen testing. It is an excellent book for anyone interested in providing security beyond the firewall.