Chapter 6: Cryptography and the Penetration Tester

Julius Caesar is known to have used encryption – a method known today as Caesar’s cipher. You may think the cipher of one of history’s most well-known military generals would be a fine example of security, but the method – a simple alphabet shift substitution cipher – is probably the easiest kind of code to break. It’s said that it was considered secure in his time because most of the people who may have intercepted his messages couldn’t read. Now that you have a fun tidbit of history, let’s be reminded that cryptography has come a very long way since then, and your pen testing clients will not be using Caesar’s cipher.

Cryptography is a funny topic in penetration testing: it’s such a fundamental part of the entire science of information security but is also often neglected in security testing. We’ve explored avoiding the task of attacking encryption by...