The Editorial review claims:

“The book is accompanied with a companion Web site containing both commented and uncommented versions of the source code examples presented throughout the book. In addition to the book source code, the CD also contains a copy of the author-developed Hacker Code Library v1.0.”

Well, sorrily, that’s NOT true.

Perhaps this confusion is due to changes resulting from the merge of Syngress with ORA, but still not fair with buyers.

Otherwise, if you, like me, are a researcher (or just interested) in the “secure code” area, then buy the book in spite of all.

By far it is the very best book written about these issues. Best in the sense of most useful. Well designed organized, with in deep study of vulnerabilities and associated exploit codes. Shellcode is explained in a rich and fresh way and the Why, How and When of shellcode are explained under an integrated framework.

NASL and MSF are explained and used in detailed and useful examples, and IMHO, this book presents the most easy, clear and condensed explanation about the Race Conditions, Format Strings, and Buffer Overflows problems I ever read yet.

Warning: Not an entry level book. You need to be familiar with several software and hardware architecture concepts to obtain full benefits from it.
Rating: 5 / 5

If you work in IT and want to learn about how to keep the hackers out, this text is a worthwhile read for you

**** RECOMMENDED
Rating: 4 / 5

Have you heard of this program that actually send thousands of text messages advertising your business for you, i think the url is w w w . a u t o t e x t s e n d e r . c o m

Nice.

This rox… Thank you very much.

Ajax changes the game in that it moves business logic to the client. In doing so it increases the attack surface of the application. The authors get curious with some real world Ajax frameworks such as Prototype, Dojo, and Microsoft Ajax. They demonstrate with these frameworks how developers might be unknowingly building vulnerabilities into their applications. If you’re home brewing Ajax, the authors cover important security considerations you’ll need to know so that you don’t make the same mistakes the industry leaders have made.

I learned a lot about JavaScript from reading this book. I learned even more about how JavaScript can be used maliciously. The authors describe techniques for function clobbering, JSON hijacking, storage attacks, and presentation layer attacks. One of my favorite parts of the book, not to mention one of the scariest, is an explanation of how to hide malicious JavaScript from signature based anti-virus software.

The authors explain why the Same-Origin Policy is broken and how it can be subverted. Also covered are security considerations for offline applications. An in-depth analysis of Ajax worms is covered. If you are curious about how Ajax is changing web security you should read this book. If your are a web developer or a security professional you should read this book, even if you aren’t using Ajax. If you don’t believe cross-site scripting is a “big deal”, I dare you to read this book and maintain the same opinion.

Rating: 5 / 5

The book gives good attention to a bigger picture: JavaScript’s capabilities and limitations, the impact of the available variety of browsers, development frameworks, social aspects and more. Even QA of JavaScript and Ajax application is mentioned, though, I think that such a topic cannot be sufficiently covered in a single overview chapter (in this book the authors tried to give an overview while presenting a few tools and discussing their advantages and disadvantages), and is well deserved to be covered in detail and with a lot of examples in a separate title.

I especially appreciated the good job that the authors did, in my opinion, to convey, what I think is the most important security related detail about JavaScript and Ajax: Never ever trust anything that is being executed, stored and calculated on the client side!

I found the book to be more than just a source of information, something that will bring me up to speed with the field’s jargon. I found it to be inspiring. I cannot wait for a similar book on browser plug-in security. I hope that the authors have something like that cooking already.

The book, as you might understand already, is highly recommended.
Rating: 5 / 5