Search icon CANCEL
Subscription
0
Cart icon
Your Cart (0 item)
Close icon
You have no products in your basket yet
Save more on your purchases now! discount-offer-chevron-icon
Savings automatically calculated. No voucher code required.
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Conferences
Free Learning
Arrow right icon
Kali Linux Web Penetration Testing Cookbook
Kali Linux Web Penetration Testing Cookbook

Kali Linux Web Penetration Testing Cookbook: Over 80 recipes on how to identify, exploit, and test web application security with Kali Linux 2

Arrow left icon
Profile Icon Gilberto Najera-Gutierrez
Arrow right icon
€18.99 per month
Full star icon Full star icon Full star icon Full star icon Half star icon 4.5 (4 Ratings)
Paperback Feb 2016 296 pages 1st Edition
eBook
€22.99 €32.99
Paperback
€41.99
Subscription
Free Trial
Renews at €18.99p/m
Arrow left icon
Profile Icon Gilberto Najera-Gutierrez
Arrow right icon
€18.99 per month
Full star icon Full star icon Full star icon Full star icon Half star icon 4.5 (4 Ratings)
Paperback Feb 2016 296 pages 1st Edition
eBook
€22.99 €32.99
Paperback
€41.99
Subscription
Free Trial
Renews at €18.99p/m
eBook
€22.99 €32.99
Paperback
€41.99
Subscription
Free Trial
Renews at €18.99p/m

What do you get with a Packt Subscription?

Free for first 7 days. $19.99 p/m after that. Cancel any time!
Product feature icon Unlimited ad-free access to the largest independent learning library in tech. Access this title and thousands more!
Product feature icon 50+ new titles added per month, including many first-to-market concepts and exclusive early access to books as they are being written.
Product feature icon Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.
Product feature icon Thousands of reference materials covering every tech concept you need to stay up to date.
Subscribe now
View plans & pricing
Table of content icon View table of contents Preview book icon Preview Book

Kali Linux Web Penetration Testing Cookbook

Chapter 2. Reconnaissance

In this chapter, we will cover:

  • Scanning and identifying services with Nmap
  • Identifying a web application firewall
  • Watching the source code
  • Using Firebug to analyze and alter basic behavior
  • Obtaining and modifying cookies
  • Taking advantage of robots.txt
  • Finding files and folders with DirBuster
  • Password profiling with CeWL
  • Using John the Ripper to generate a dictionary
  • Finding files and folders with ZAP

Introduction

Every penetration test, be it for a network or a web application, has a workflow; it has a series of stages that should be completed in order to increase our chances of finding and exploiting every possible vulnerability affecting our targets, such as:

  • Reconnaissance
  • Enumeration
  • Exploitation
  • Maintaining access
  • Cleaning tracks

In a network penetration testing scenario, reconnaissance is the phase where testers must identify all the assets in the network, firewalls, and intrusion detection systems. They also gather the maximum information about the company, the network, and the employees. In our case, for a web application penetration test, this stage will be all about getting to know the application, the database, the users, the server, and the relation between the application and us.

Reconnaissance is an essential stage in every penetration test; the more information we have about our target, the more options we will have when it comes to finding vulnerabilities and exploiting them...

Scanning and identifying services with Nmap

Nmap is probably the most used port scanner in the world. It can be used to identify live hosts, scan TCP and UDP open ports, detect firewalls, get versions of services running in remote hosts, and even, with the use of scripts, find and exploit vulnerabilities.

In this recipe, we will use Nmap to identify all the services running on our target application's server and their versions. We will do this in several calls to Nmap for learning purposes, but it can be done using a single command.

Getting ready

All we need is to have our vulnerable_vm running.

How to do it...

  1. First, we want to see if the server is answering to a ping or if the host is up:
    nmap -sn 192.168.56.102
    
    How to do it...
  2. Now that we know that it's up, let's see which ports are open:
    nmap 192.168.56.102
    
    How to do it...
  3. Now, we will tell Nmap to ask the server for the versions of services it is running and to guess the operating system based on that.
    nmap -sV -O 192.168.56.102
    
    How to do it...
  4. We can see that our vulnerable_vm...

Identifying a web application firewall

A web application firewall (WAF) is a device or a piece of software that checks packages sent to a web server in order to identify and block those that might be malicious, usually based on signatures or regular expressions.

We can end up dealing with a lot of problems in our penetration test if an undetected WAF blocks our requests or bans our IP address. When performing a penetration test, the reconnaissance phase must include the detection and identification of a WAF, intrusion detection system (IDS), or intrusion prevention system (IPS). This is required in order to take the necessary measures to prevent being blocked or banned.

In this recipe, we will use different methods, along with the tools included in Kali Linux, to detect and identify the presence of a web application firewall between our target and us.

How to do it...

  1. Nmap includes a couple of scripts to test for the presence of a WAF. Let's try some on our vulnerable-vm:
    nmap -p 80,443...

Watching the source code

Looking into a web page's source code allows us to understand some of the programming logic, detect the obvious vulnerabilities, and also have a reference when testing, as we will be able to compare the code before and after a test and use that comparison to modify our next attempt.

In this recipe, we will view the source code of an application and arrive at some conclusions from that.

Getting ready

For this recipe, start the vulnerable_vm.

How to do it...

  1. Browse to http://192.168.56.102.
  2. Select the WackoPicko application.
  3. Right-click on the page and select View Page Source. A new window with the source code of the page will open:
    How to do it...

    With the source code we can discover the libraries or external files that the page is using and where the links go. Also, as can be seen in the preceding image, this page has some hidden input fields. The selected one is MAX_FILE_SIZE; this means that, when we are uploading a file, this field determines the maximum size allowed for the file...

Using Firebug to analyze and alter basic behavior

Firebug is a browser add-on that allows us to analyze the inner components of a web page, such as table elements, cascading style sheets (CSS) classes, frames, and so on. It also has the ability to show us DOM objects, error codes, and request-response communication between the browser and server.

In the previous recipe, we saw how to look into a web page's HTML source code and found a hidden input field that established some default values for the maximum size of a file. In this recipe, we will see how to use the browser's debugging extensions, in this particular case, Firebug for Firefox or OWASP-Mantra.

Getting ready

With vulnerable_vm running, browse to http://192.168.56.102/WackoPicko.

How to do it...

  1. Right-click on Check this file and then select Inspect Element with Firebug.
    How to do it...
  2. There is a type="hidden" parameter on the first input of the form; double-click on hidden.
  3. Replace hidden by text and hit Enter.
    How to do it...
  4. Now double-click...

Introduction


Every penetration test, be it for a network or a web application, has a workflow; it has a series of stages that should be completed in order to increase our chances of finding and exploiting every possible vulnerability affecting our targets, such as:

  • Reconnaissance

  • Enumeration

  • Exploitation

  • Maintaining access

  • Cleaning tracks

In a network penetration testing scenario, reconnaissance is the phase where testers must identify all the assets in the network, firewalls, and intrusion detection systems. They also gather the maximum information about the company, the network, and the employees. In our case, for a web application penetration test, this stage will be all about getting to know the application, the database, the users, the server, and the relation between the application and us.

Reconnaissance is an essential stage in every penetration test; the more information we have about our target, the more options we will have when it comes to finding vulnerabilities and exploiting them...

Scanning and identifying services with Nmap


Nmap is probably the most used port scanner in the world. It can be used to identify live hosts, scan TCP and UDP open ports, detect firewalls, get versions of services running in remote hosts, and even, with the use of scripts, find and exploit vulnerabilities.

In this recipe, we will use Nmap to identify all the services running on our target application's server and their versions. We will do this in several calls to Nmap for learning purposes, but it can be done using a single command.

Getting ready

All we need is to have our vulnerable_vm running.

How to do it...

  1. First, we want to see if the server is answering to a ping or if the host is up:

    nmap -sn 192.168.56.102
    
  2. Now that we know that it's up, let's see which ports are open:

    nmap 192.168.56.102
    
  3. Now, we will tell Nmap to ask the server for the versions of services it is running and to guess the operating system based on that.

    nmap -sV -O 192.168.56.102
    
  4. We can see that our vulnerable_vm has Linux...

Left arrow icon Right arrow icon

Key benefits

  • Familiarize yourself with the most common web vulnerabilities a web application faces, and understand how attackers take advantage of them
  • Set up a penetration testing lab to conduct a preliminary assessment of attack surfaces and run exploits
  • Learn how to prevent vulnerabilities in web applications before an attacker can make the most of it

Description

Web applications are a huge point of attack for malicious hackers and a critical area for security professionals and penetration testers to lock down and secure. Kali Linux is a Linux-based penetration testing platform and operating system that provides a huge array of testing tools, many of which can be used specifically to execute web penetration testing. This book will teach you, in the form step-by-step recipes, how to detect a wide array of vulnerabilities, exploit them to analyze their consequences, and ultimately buffer attackable surfaces so applications are more secure, for you and your users. Starting from the setup of a testing laboratory, this book will give you the skills you need to cover every stage of a penetration test: from gathering information about the system and the application to identifying vulnerabilities through manual testing and the use of vulnerability scanners to both basic and advanced exploitation techniques that may lead to a full system compromise. Finally, we will put this into the context of OWASP and the top 10 web application vulnerabilities you are most likely to encounter, equipping you with the ability to combat them effectively. By the end of the book, you will have the required skills to identify, exploit, and prevent web application vulnerabilities.

Who is this book for?

This book is for IT professionals, web developers, security enthusiasts, and security professionals who want an accessible reference on how to find, exploit, and prevent security vulnerabilities in web applications. You should know the basics of operating a Linux environment and have some exposure to security technologies and tools.

What you will learn

  • Set up a penetration testing laboratory in a secure way
  • Find out what information is useful to gather when performing penetration tests and where to look for it
  • Use crawlers and spiders to investigate an entire website in minutes
  • Discover security vulnerabilities in web applications in the web browser and using command-line tools
  • Improve your testing efficiency with the use of automated vulnerability scanners
  • Exploit vulnerabilities that require a complex setup, run custom-made exploits, and prepare for extraordinary scenarios
  • Set up Man in the Middle attacks and use them to identify and exploit security flaws within the communication between users and the web server
  • Create a malicious site that will find and exploit vulnerabilities in the user s web browser
  • Repair the most common web vulnerabilities and understand how to prevent them becoming a threat to a site s security

Product Details

Country selected
Publication date, Length, Edition, Language, ISBN-13
Publication date : Feb 29, 2016
Length: 296 pages
Edition : 1st
Language : English
ISBN-13 : 9781784392918
Vendor :
Offensive Security
Tools :

What do you get with a Packt Subscription?

Free for first 7 days. $19.99 p/m after that. Cancel any time!
Product feature icon Unlimited ad-free access to the largest independent learning library in tech. Access this title and thousands more!
Product feature icon 50+ new titles added per month, including many first-to-market concepts and exclusive early access to books as they are being written.
Product feature icon Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.
Product feature icon Thousands of reference materials covering every tech concept you need to stay up to date.
Subscribe now
View plans & pricing

Product Details

Publication date : Feb 29, 2016
Length: 296 pages
Edition : 1st
Language : English
ISBN-13 : 9781784392918
Vendor :
Offensive Security
Tools :

Packt Subscriptions

See our plans and pricing
Modal Close icon
€18.99 billed monthly
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Simple pricing, no contract
€189.99 billed annually
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Choose a DRM-free eBook or Video every month to keep
Feature tick icon PLUS own as many other DRM-free eBooks or Videos as you like for just €5 each
Feature tick icon Exclusive print discounts
€264.99 billed in 18 months
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Choose a DRM-free eBook or Video every month to keep
Feature tick icon PLUS own as many other DRM-free eBooks or Videos as you like for just €5 each
Feature tick icon Exclusive print discounts

Frequently bought together


Stars icon
Total 125.97
Web Penetration Testing with Kali Linux 2.0, Second Edition
€41.99
Kali Linux Web Penetration Testing Cookbook
€41.99
Mastering Kali Linux Wireless Pentesting
€41.99
Total 125.97 Stars icon

Table of Contents

11 Chapters
1. Setting Up Kali Linux Chevron down icon Chevron up icon
2. Reconnaissance Chevron down icon Chevron up icon
3. Crawlers and Spiders Chevron down icon Chevron up icon
4. Finding Vulnerabilities Chevron down icon Chevron up icon
5. Automated Scanners Chevron down icon Chevron up icon
6. Exploitation – Low Hanging Fruits Chevron down icon Chevron up icon
7. Advanced Exploitation Chevron down icon Chevron up icon
8. Man in the Middle Attacks Chevron down icon Chevron up icon
9. Client-Side Attacks and Social Engineering Chevron down icon Chevron up icon
10. Mitigation of OWASP Top 10 Chevron down icon Chevron up icon
Index Chevron down icon Chevron up icon

Customer reviews

Rating distribution
Full star icon Full star icon Full star icon Full star icon Half star icon 4.5
(4 Ratings)
5 star 50%
4 star 50%
3 star 0%
2 star 0%
1 star 0%
jfranz Dec 08, 2016
Full star icon Full star icon Full star icon Full star icon Full star icon 5
The book is a great example of a seasoned Web Pentester and his methodologies for auditing web applications. The chapters examples are clearly outlined with corresponding modules that "walk" the user through all phases of a web pentest. He makes web pentesting available to anyone with a little bit of time, a Kali VM and OWASP project VM. If your a novice looking for a solid foundation intro into web pentesting then I would highly recommend this book.
Amazon Verified review Amazon
alicia bianca carew Mar 17, 2018
Full star icon Full star icon Full star icon Full star icon Full star icon 5
Great Kali Linux Book Step By Step
Amazon Verified review Amazon
Beau Bullock Mar 30, 2016
Full star icon Full star icon Full star icon Full star icon Empty star icon 4
I perform pentests against web applications on a regular basis amongst other types of pentesting including internal network assessments, external network assessments, phishing, wireless, C2, pivot tests and more. In the past two years I've pentested around 40 different web applications for various organizations. I read the Kali Linux Web Penetration Testing Cookbook, and wanted to share my thoughts on the book.TL;DRThis is a great book for introducing webapp attack vectors to new pentesters. There might be a section or two that seasoned pentesters find useful. I felt the author did a great job describing the tools and techniques in the book. The book lacks details into the underlying web protocols so don't expect to be an "expert" of all the intricacies involved in web applications after reading this book. I also feel there were a few items included that were a bit off topic and probably should not have been included in this book. That said, I give this book a 4 out of 5.-----------Ok... the longer version is next. I've provided a brief outline of what is included in each chapter below, as well as what I felt was either awesome about the chapter or what I felt was missing in the "Comments" section.PREFACE-The author describes the book as being designed for many types of readers including those who want to go beyond general computer science study, application developers, and even seasoned security pros.-States the book will include some possible intermediate or advanced exploitation by chaining attacks together.Chapter 1 - Setting Up Kali-Downlading Kali, and updating it-Using OWASP Mantra - firefox plugin-Setup Iceweasal with addons (tamperdata etc.)-Using Owasp-bwa vm and BWapp Bee-box as target vuln machines-Download Windows 7 IE8 VM as client for MitM attacksComments:There were no instructions on installing Kali. The book jumps straight from downloading it to updating it. Some readers might have trouble installing it. Also, the book is focused on installing Kali as the host OS. I would bet that the majority of readers who are jumping into web application pentesting will probably want to install Kali as VM. I was very happy to see that the author is putting the modern.ie VM's to good use.Chapter 2 - Reconnaissance-Nmap - shows basic network scan-WAF detection with Nmap script http-waf-detect, http-waf-fingerprint, and wafw00f-Looking at the source code of a page to identify vulnerabilities. Locating hidden fields that might be alterable-Cookies manager+ to edit cookie values-Looking in robots.txt for hidden dirs.-Dirbuster to find hidden dirs - demos a basic wordlist but doesn't mention Dirbuster's wordlists (mentioned later when demoing Zap proxy forced browse)-Cewl for creating wordlists from site content.-Using John and the wordlist generated by Cewl to mangle a more complex wordlist with John's rules.-Zap forced browseComments:This chapter does a decent job of covering recon for a webapp but I might add that during recon for a webapp Google can be your best friend. I discuss that in more detail in the next comments section. Also, Builtwith.com is a good resource for finding what technologies a webapp is utilizing.Chapter 3 - Crawlers and Spiders-Use wget and HTTrack to download website for offline analysis-Using Zap and Burp to spider a site-Burp's repeater to repeat requests-Using webscarab to spiderComments:Three different tools were demonstrated to perform the same task of spidering a site. Two tools were demonstrated to make a local copy of the site. The author did not mention what the purpose of creating a copy of the site was for or why this is useful. This section could be improved by spending less time on separate tools and more on focusing the spider engine. There are times where sites are so big that you may want to limit the spider's scope to only a certain directory and to only recurse a certain depth.I would also add that Google has already done a good job of this. Using "Google hacking" techniques a pentester can find sensitive directories, and files without spidering at all. This can be a most valuable technique when the goal is to be stealthy.Chapter 4 - Finding Vulnerabilities-Hackbar Firefox addon - second address bar that is not affected by redirections, and allows POST modification-TamperData to modify requests-Using Zap and Burp to intercept and modify requests-Identifying XSS-Uses DVWA XSS reflection exercise with basic alert script-Error based SQLi with DVWA-Blind SQLi-Session cookie vulns - Mentions secure and httponly flag-Using sslscan to get SSL info from a site-Testing for LFI and RFI-Detecting Poodle with Nmap scriptComments:While some more demonstrative examples are included later on in the book there was no information about why XSS is bad in this section. It could have provided a test case to demonstrate risk. There are a number of vulnerabilities that could be discovered through manual testing that were left out from this section. None of the following vulnerabilities were covered: CSRF (covered in advanced exploit chapter later on, but how to discover it), username harvesting, account lockout controls, session fixation, weak session token entropy, privilege escalation across access roles, insecure direct object reference (again, included later on in the book), etc.I really like how the author is demonstrating some manual techniques prior to jumping into automated scanning.Chapter 5 - Automated Scanners-Nikto scanner-Wapiti scanner-Zap automated scanner-Using w3af scanner-w3af has command line interface in addition to GUI-vega vulnerability scanner - has ability to do auth to webapp but lacks reporting-Using wmap as a scannerComments:Automated scanners can help speed up the process of a pentest. Being familiar with different types of scanners can help in various situations so I appreciate the inclusion of multiple tools. Although many tools were listed, I didn't feel that any real insight into what to do with the output of the scans was given.Chapter 6 - Exploitation - Low Hanging Fruits-Uploading a PHP webshell to execute commands on the server-Command injection - appending system commands to get Netcat shell is demonstrated-XML External Entity Injection - very nice description and example of XXE. Also, the author demonstrates how it can be used to run commands when combined with a webshell upload vuln.-Brute forcing passwords with THC-HYDRA-Brute forcing passwords with Burp Intruder and wordlists-Exploiting stored XSS to get a victims browser to visit an attacker hosted webserver with a PHP script to store cookies-Nice manual SQLi walkthrough-SQLMap for automated sqli-Bruteforcing Tomcat logins with Metasploit module-Tomcat war file upload with Laudanum web shellComments:I thought this section was probably the most valuable of the entire book with the next chapter being second. Good examples of some common exploit vectors were provided. Later on in the book the author dives into man-in-the-middle attacks and social engineering. I feel that these sections could have been left out and the author could have expanded chapters 6 and 7 as these two are truly the core of webapp testing. Having real world scenarios and potential exploit techniques really can help demonstrate to a reader what the risk is with certain vulnerabilities. I think the author did a fantastic job here.Chapter 7 - Advanced Exploitation-Using Searchsploit to locate exploits in ExploitDB-Exploiting Heartbleed-Hooking a browser with Beef-Manual blind SQL injection-Using Sqlmap to gather data like current DB user and password hashes-Decent CSRF walkthrough-Decent Shellshock walkthrough-Cracking passwords with John and oclHashcatComments:More good examples were provided as in chapter 6. I think more information could have been provided regarding discovering particular vulnerabilities such as ShellShock, and CSRF.Chapter 8 - MitM attacks-Using Ettercap to arp poison the network to MitM two systems-Capturing packets with Wireshark-Ettercap filters to replace data in web requests-Use sslsplit to decrypt traffic after mitm (victim gets cert error)-Spoofing dns to redirect requestsComments:I'm not sure that I feel this chapter was necessary in this book. When approaching a web application pentest it is rare that the tester would need to demonstrate the risk of a MitM attack. The fact a user system can be attacked to create a MitM situation does not mean a vulnerability in the web application being tested exists. These are really "Network Pentest" techniques.Chapter 9 - Client Side Attacks and Social Engineering-Harvesting login credentials with a scraped site using SET-Creating a login harvester that actually logs the user into the real site.-Creating a reverse shell Meterpreter exe-Browser autopwn Metasploit module-Social engineering a user to run a malicious beef hookComments:Again, I'm not sure this chapter belongs here. There is a section in this chapter that explains how to create a Meterpreter payload, host the payload on an attacker's webserver, and then get a target to download it via social engineering. What does this have to do with webapp testing? I think between this chapter and the last the author could have expanded quite a bit on both webapp attack vectors, and the underlying protocols at use.Chapter 10 - Fixing OWASP Top 10-This chapter walks through the OWASP top 10 vulnerabilities and how to fix them.Comments: This chapter redeemed chapters 8 and 9 for me. It is rare that a "pentesting" book includes a very detailed chapter on actually fixing the vulnerabilities discovered through the techniques presented in the book. This chapter does this. As penetration testers we need to not only find the vulnerabilities, but also provide the best recommendations we can to fix them to the clients we are working with.Conclusion -The Good:-The author portrays each concept taught in the book very well. His teaching style is very easy to understand and I think anyone can pick this book up and start learning.-Many tools related to webapp pentesting that are built into Kali Linux are demonstrated.-The majority of common vulnerabilities found in web applications are demonstrated.-New web application testers will learn a ton!-Seasoned web application testers might find a new trick or two.-Great demonstrations of manual exploit techniques.-For each of the tools demonstrated the author provides a number of additional options that may be useful.-Chapter on fixing OWASP top 10 vulnerabilities is awesome. More pentesting books should include recommendations for fixing the vulnerabilities we find.The Bad:-No steps to install Kali-No mention of Google Hacking-Some common vulnerabilities were left out of the vulnerability discovery section including username harvesting, account lockout controls, session fixation, etc.-No WPScan (Wordpress attack tool)-MitM and Social Engineering chapters could have been replaced by more web application testing content
Amazon Verified review Amazon
Amazon Customer Jul 07, 2016
Full star icon Full star icon Full star icon Full star icon Empty star icon 4
not bad
Amazon Verified review Amazon
Get free access to Packt library with over 7500+ books and video courses for 7 days!
Start Free Trial

FAQs

What is included in a Packt subscription? Chevron down icon Chevron up icon

A subscription provides you with full access to view all Packt and licnesed content online, this includes exclusive access to Early Access titles. Depending on the tier chosen you can also earn credits and discounts to use for owning content

How can I cancel my subscription? Chevron down icon Chevron up icon

To cancel your subscription with us simply go to the account page - found in the top right of the page or at https://subscription.packtpub.com/my-account/subscription - From here you will see the ‘cancel subscription’ button in the grey box with your subscription information in.

What are credits? Chevron down icon Chevron up icon

Credits can be earned from reading 40 section of any title within the payment cycle - a month starting from the day of subscription payment. You also earn a Credit every month if you subscribe to our annual or 18 month plans. Credits can be used to buy books DRM free, the same way that you would pay for a book. Your credits can be found in the subscription homepage - subscription.packtpub.com - clicking on ‘the my’ library dropdown and selecting ‘credits’.

What happens if an Early Access Course is cancelled? Chevron down icon Chevron up icon

Projects are rarely cancelled, but sometimes it's unavoidable. If an Early Access course is cancelled or excessively delayed, you can exchange your purchase for another course. For further details, please contact us here.

Where can I send feedback about an Early Access title? Chevron down icon Chevron up icon

If you have any feedback about the product you're reading, or Early Access in general, then please fill out a contact form here and we'll make sure the feedback gets to the right team. 

Can I download the code files for Early Access titles? Chevron down icon Chevron up icon

We try to ensure that all books in Early Access have code available to use, download, and fork on GitHub. This helps us be more agile in the development of the book, and helps keep the often changing code base of new versions and new technologies as up to date as possible. Unfortunately, however, there will be rare cases when it is not possible for us to have downloadable code samples available until publication.

When we publish the book, the code files will also be available to download from the Packt website.

How accurate is the publication date? Chevron down icon Chevron up icon

The publication date is as accurate as we can be at any point in the project. Unfortunately, delays can happen. Often those delays are out of our control, such as changes to the technology code base or delays in the tech release. We do our best to give you an accurate estimate of the publication date at any given time, and as more chapters are delivered, the more accurate the delivery date will become.

How will I know when new chapters are ready? Chevron down icon Chevron up icon

We'll let you know every time there has been an update to a course that you've bought in Early Access. You'll get an email to let you know there has been a new chapter, or a change to a previous chapter. The new chapters are automatically added to your account, so you can also check back there any time you're ready and download or read them online.

I am a Packt subscriber, do I get Early Access? Chevron down icon Chevron up icon

Yes, all Early Access content is fully available through your subscription. You will need to have a paid for or active trial subscription in order to access all titles.

How is Early Access delivered? Chevron down icon Chevron up icon

Early Access is currently only available as a PDF or through our online reader. As we make changes or add new chapters, the files in your Packt account will be updated so you can download them again or view them online immediately.

How do I buy Early Access content? Chevron down icon Chevron up icon

Early Access is a way of us getting our content to you quicker, but the method of buying the Early Access course is still the same. Just find the course you want to buy, go through the check-out steps, and you’ll get a confirmation email from us with information and a link to the relevant Early Access courses.

What is Early Access? Chevron down icon Chevron up icon

Keeping up to date with the latest technology is difficult; new versions, new frameworks, new techniques. This feature gives you a head-start to our content, as it's being created. With Early Access you'll receive each chapter as it's written, and get regular updates throughout the product's development, as well as the final course as soon as it's ready.We created Early Access as a means of giving you the information you need, as soon as it's available. As we go through the process of developing a course, 99% of it can be ready but we can't publish until that last 1% falls in to place. Early Access helps to unlock the potential of our content early, to help you start your learning when you need it most. You not only get access to every chapter as it's delivered, edited, and updated, but you'll also get the finalized, DRM-free product to download in any format you want when it's published. As a member of Packt, you'll also be eligible for our exclusive offers, including a free course every day, and discounts on new and popular titles.