xiv

Foreword

or vulnerability assessment would be able to identify. Typical findings include 
shared passwords, cross-connected networks, and troves of sensitive data sit-
ting in the clear. The problems created by sloppy system administration and 
rushed implementations often pose significant threats to an organization, 
while the solutions languish under a dozen items on an administrator’s to-do 
list. Penetration testing highlights these misplaced priorities and identifies 
what an organization needs to do to defend itself from a real intrusion.

Penetration testers handle a company’s most sensitive resources; they 

gain access to areas that can have dire real-world consequences if the wrong 
action is taken. A single misplaced packet can bring a factory floor to a halt, 
with a cost measured in millions of dollars per hour. Failure to notify the 
appropriate personnel can result in an uncomfortable and embarrassing con-
versation with the local police. Medical systems are one area that even the 
most experienced security professionals may hesitate to test; nobody wants 
to be responsible for mixing up a patient’s blood type in an OpenVMS main-
frame or corrupting the memory on an X-ray machine running Windows XP. 
The most critical systems are often the most exposed, and few system admin-
istrators want to risk an outage by bringing down a database server to apply a 
security patch.

Balancing the use of available attack paths and the risk of causing dam-

age is a skill that all penetration testers must hone. This process depends not 
only on a technical knowledge of the tools and the techniques but also on a 
strong understanding of how the organization operates and where the path 
of least resistance may lie.

In this book, you will see penetration testing through the eyes of four 

security professionals with widely divergent backgrounds. The authors include 
folks with experience at the top of the corporate security structure all the way 
down to the Wild West world of underground exploit development and vulner-
ability research. There are a number of books available on penetration test-
ing and security assessments, and there are many that focus entirely on tools. 
This book, however, strives for a balance between the two, covering the fun-
damental tools and techniques while also explaining how they play into the 
overall structure of a successful penetration testing process. Experienced 
penetration testers will benefit from the discussion of the methodology, 
which is based on the recently codified Penetration Test Execution Standard. 
Readers who are new to the field will be presented with a wealth of informa-
tion not only about how to get started but also why those steps matter and 
what they mean in the bigger picture.

This book focuses on the Metasploit Framework. This open source 

platform provides a consistent, reliable library of constantly updated exploits 
and offers a complete development environment for building new tools and 
automating every aspect of a penetration test. Metasploit Express and Meta-
sploit Pro, the commercial siblings of the Framework, are also represented in 
this book. These products provide a different perspective on how to conduct 
and automate large-scale penetration tests.