Practical Hacking

Most Wireshark books teach the interface. This one teaches you to answer questions with it.

Practical Wireshark starts where every investigation starts, with a capture that's too big and a complaint that's too vague, and works toward the packets that explain it. You'll learn where to put the sniffer so it actually sees the traffic, how to capture without drowning, and how to write display filters that find the one conversation that matters. From there the book moves through the protocols you meet every day (ARP, DHCP, DNS, TCP, HTTP/2 and HTTP/3, SIP and RTP), then into harder ground: decrypting TLS and QUIC with session keys, following a Wi-Fi join in monitor mode, and pinning a slow page load to a specific stage of the path.

The security chapters cover what an analyst actually looks for: port scans and how to tell their types apart, malware beacons and their timing, suspicious DNS, and credentials leaking in cleartext. The last part turns everything into automation with tshark one-liners, scheduled reports, Python with pyshark, and a Lua dissector for a protocol Wireshark has never seen.

The book is built on real captures. It works from a set of public sample captures, and where a chapter shows a tool's output from those files, the run is cited like any other source, so you can reproduce it on your own machine. Each of the 20 chapters ends with exercises, and an appendix gives a worked answer to every one, with the command to run.

What's inside

- 20 chapters in six parts, from first capture to traffic forensics

- 80 hands-on exercises with fully worked answers

- Display filter and capture filter quick reference

- Command-line toolkit reference for tshark, dumpcap, capinfos, editcap and mergecap

- Written for Wireshark 4.6, including its current filter semantics

mitmproxy sits between a client and a server and shows you every request and response, including HTTPS. Starting it is easy. Getting a phone, a container or a pinned app to send its traffic through it, and then doing something useful with that traffic, is where most people get stuck.

This book teaches mitmproxy 12 from first capture to automated API testing. Every example runs against the same small lab shop, an HTTPS API with a deliberate price-tampering bug and an IDOR, so the techniques build on each other:

• Install mitmproxy, get clients to trust its CA, and read what the three frontends (mitmproxy, mitmweb, mitmdump) show you.
• Find flows with filter expressions, then modify and replay them: modify_headers, modify_body, map_local, map_remote, client and server replay.
• Write addons in Python: event hooks, options, commands and custom content views.
• Pick the right mode for the client: regular, transparent, reverse, upstream, SOCKS, WireGuard and local capture.
• Intercept Android and iOS apps, and get past certificate pinning with Frida and objection.
• Handle HTTP/2, HTTP/3 and WebSockets, export flows as HAR, curl or OpenAPI, and turn captures into repeatable security tests.

No output in the book is invented or retyped. Each output block comes from a real mitmproxy 12.2.3 run in the lab, and every claim cites its source: the mitmproxy documentation, the v12.2.3 source code, or the captured run.

Researched and drafted with AI assistance by Ground Truth Books. The text was checked against the mitmproxy 12.2.3 documentation and source, and the code examples were run under mitmproxy 12.2.3. "mitmproxy" is used descriptively; this book is not affiliated with or endorsed by the mitmproxy project.

Metasploit is the tool every penetration tester reaches for, and the one most people only half understand. They click through msfconsole, fire a canned exploit, and stop there. This book takes you the rest of the way.

Over nineteen lab-driven chapters you build a purpose-made attack lab, then work through the framework the way a serious operator does: service discovery with db_nmap and auxiliary scanners, payload theory and msfvenom generation, exploitation and session handling, and full Meterpreter mastery — process migration, privilege escalation, pivoting, and tunneling through compromised hosts. From there you move into post-exploitation: credential harvesting, persistence, and lateral movement across SMB, WinRM, and SSH.

The second half is where most books stop and this one keeps going. You write your own auxiliary, scanner, and post modules in Ruby, build a working exploit against a patched CVE, call the Windows API through Railgun, and automate engagements with resource scripts. A closing section covers what encoders and evasion can and can't do, and how to keep your modules alive against the framework's release and deprecation cadence.

Every chapter escalates. You start by running exploits and finish by writing them. If you know your way around a terminal and want to treat Metasploit as something you extend rather than something you click, this is the book.