When I was reading this book, I kept waiting for the topic to be Linux. The book starts with OSSTMM material. You can tell the OSSTMM folks have become too abstract to be concerned with the work-a-day security industry. This is not what I (or, I'm sure, anyone) will expect from a Hacking Exposed book. Imagine a book of definitions, but no examples; references to techniques, but no tools.



The book features large tracts of discussion about OSSTMM, PSTN, ISDN, X.25, VOIP, Wireless (in general, not really Linux), RFID, web-apps (shouldn't that be its own book?), and C code static analysis. There's a whole chapter on hacking the users, without any real discussion of brute force attacks or tools you'd use to hack a Linux system. I was very disappointed.



Where is discussion of kernel- and user-space? Where are hardware abstraction layer boundaries? What about exploiting stacks and heaps in Linux? What are the security implications of Linux dynamic libraries? What about hacking OpenSSH, Apache, Samba, X11, NFS, Kerberos, NIS and other common Linux services?



If you're looking for hands-on Linux exploitation techniques, look elsewhere.