I guess there is a misconception in the field of pentesting that everything is about tools. People started considering pentesting as mere collection of tools. This books is not about that. This book does not only help with knowing the various tools, it helps you to understand them, to tune them according to your need or your customer's need. The real skill is not to write a tool of your own when you already have the same tool out there. The real skill in this field is to take an existing tool and modify it based on your need.

Security Power Tools (SPT) is O'Reilly Publishing's sister manual to their popular Unix Power Tools […]. It is written as a primer to various security tools, organized within seven sections, covering Legal and Ethics, Reconnaissance, Penetration, Control, Defense, Monitoring, and Discovery. While the target audience of SPT is security professionals, the book weighs in at just over 800 pages and probably has something for everyone working in a technical facet of IT. Having said that, I really enjoyed reading this book. I read it nearly cover-to-cover, and while I was at least familiar with most of the material in the book, I was still able to find gems of knowledge, even in tools that I work with on a daily basis. Expect to read about some tools that you may already know about, like Nmap, Nessus, and The Metasploit Framework, but keep reading for a heap of other useful applications that you may not be familiar with. One of the strengths of the book is the varying backgrounds of its contributing authors; just as the book covers a diverse tool set, the expertise of the authors is also diverse. The book was written collaboratively by twelve individuals, made up primarily of Juniper Networks' J-Security team […]. Despite an opportunity for vendor-bias towards Juniper products, the book remained vendor-neutral. The majority of the book focuses on open-source and free-ware applications, although there is commercial software covered as well. In fact, Chapter 9 - Exploitation Framework Applications covers Canvas […] and Core Impact […] exclusively; both commercial applications. One of the chapters that makes this book unique is the chapter on Law and Ethics, written by Jennifer Stisa Granick. You may recognize Ms Granick from her representation of Michael Lynn in during the Cisco Gate ordeal at Black Hat 2005 (coincidentally, Michael Lynn is also one of the contributing authors of this book). She provides an insightful discussion on not only the legal implications of security work, but also the role that ethics plays in some of those "gray" areas that security professionals may find themselves in. Another chapter that sets this book apart is Chapter 6 - Custom Packet Generation, which primarily focuses on the use of Scapy. The chapter is written by Phillipe Biondi, the author of Scapy, and he provides an excellent argument to "Decode, Do Not Interpret". He discusses the advantages of writing tools that will provide you with raw decoded information, without an interpretation of that information. For instance, if you scanned a port on a remote host, Biondi would argue that it would be better for your tool to tell you that the remote host returned a RST packet rather than telling you that the port is closed. Beyond this valuable discussion, Biondi provides a very thorough discussion of the uses of Scapy, along with several good examples. This chapter alone makes this book worth buying. While I liked this book, there were also some problems that prevented me from giving it a 5-star rating. For starters, the preface describes the overwhelming amount of content that was edited out of this book to keep it within size constraints, yet there was quite a bit of content that detracted from the value-density of the book. As I mentioned previously, the majority of SPT is a security primer and should not be considered a reference. Given this position, I believe that there was too much step-by-step installation and setup content. As an example, Chapter 16 - E-Mail Security and Anti-Spam covered the installation and management of the Norton Anti-Virus client. I can appreciate the security-related value of anti-virus software, but I felt that a step-by-step walk through of a Norton product was irrelevant. Additionally, while I previously stated that the diverse expertise of the authors was a benefit, the varied writing style detracted from the readability of the book. Content aside, I found some chapters to be fun to read while others were boring, due to a particular author's writing style. In summary, I would recommend this book to anyone interested in an overview of where to get started in researching security tools for a particular purpose. While none of the discussions in the book are exhaustive, they will definitely get you started and arm you with enough information to know what you want and where to get it.

I am very pleased with this purchase. The explanations and how-to directions are helping me get up to speed on a variety of powerful tools to assess security of a given environment. I recommend this book to others interested in finding out how secure their networked environments really are.

I haven't quite digested all 800+ pages yet, but I've found this book to be a useful reference and I believe this book is useful for beginners and experts alike. Beginners will like the logical structure, beginning with ethical issues and progressing through Reconnaissance, Penetration, Control, Defense, Monitoring and Discovery. This is a logical sequence that closely follows how a new security analyst would actually learn security topics. In particular I thought part II, Reconnaissance, was well-written and clear, covering all the major tools and explaining the complex topics in a way that should be very clear to the newbie. Experts will like it as a good, and very up-to-date, survey of all the major tools and techniques. I learned quite a bit in the Penetration section that I didn't know before, such as the section on MOSDEF and Canvas. The index is very good, so even if you don't read through this cover-to-cover it's a good reference on tools and common techniques. The book is edited well and meets my high expectations for an O'Reilly book. Graphics and screenshots are liberally shown throughout, and callout boxes explain advanced topics in many sections. Although there are a bunch of authors the editorial style is pretty consistent and it doesn't feel like a mishmash. Overall this is a great book for security researchers at any level, and it compares well with my favorite O'Reilly security book, the venerable Building Internet Firewalls. If you like this book you'd probably also like the excellent by Gary Donahue. This book is a good general survey of everything in security, while Gary's book is a more of a personal testimonial from a professional security researcher about how he does his job. Both are useful in their own way.

Not very organized. It seems like putting together some manuals and usage docs? It's unclear who this book is for. I lost interest after reading 3 chapters. I wish I could return this book!