Technical accuracy escapes them.

This book contains some okay level of steering, but that's about it. The technical accuracy I see exhibited here can only be rivaled by your grandma explaining Windows system internals. It doesn't end at just the author's confusion of C and C++ (classic "strcpy() and other C++ functions" babble); the very explanation of why a program crashes, or how an attack works, or how variables and buffers get created is flat wrong.

I had to stop reading this in the buffer overflow chapter. Highlights include the flawed interpretation of the error message from when bigmac() returned (it returned to non-mapped memory, the book says it read past the end of a string); the horrible explanation of how buffers work (buffers are not simple variables, and variables do not allocate multiple chunks of memory for themselves as explained); and the incorrect description of the return-to-text attack (returned to existing code, but the book says it's run code you injected onto the stack). After reading a stream of these such inaccuracies, I stopped looking for something that actually came out right.

The buffer overflow chapter can easily be replaced with Hacking: The Art of Exploitation. Read that instead. It's also got better networking and WEP attack explanations.

Other Reviews

• Good book for the Security Professional
• Security Warrior
• Technical accuracy escapes them.
• Essential read for any web-based application developer