Novice,

Odom's CCNA book + TCP/IP Illustrated will teach you a great deal about networking.  I believe both cover the OSI model.  Odom's book will teach you the basics of TCP/IP, but will not teach you all of the low level details you need to understand the techniques used for network mapping, remote OS identification, IDS evasion, or analyzing traffic.  It does, however, teach you about configuring and managing network device.  TCP/IP Illustrated will give you the background needed for those tasks but will not teach you about managing switches and routers or about routing and switching protocols.

With regards to Windows Server:  you need to be able to do more than just run an exploit program against a target.  You need to know how to use the target system so that you can execute local attacks to escalate your privilege and/or use the target system as a foothold into a network so that you can attack other systems from it.  You also need to be able to recommend changes to the system to fix the vulnerabilities that you find.  It's okay to be a Linux/Unix specialist with some Windows skills or vice-versa, but you're selling yourself short if you don't have some proficiency with both.

With regards to Sil's plan: I suggest starting with what I said first.  While Sil's plan does include things such as OSI, it also jumps into the more advanced Cisco material early on.  For someone already working in the field, that could work well. For someone who is just starting out, reading Odom's books and TCP/IP Illustrated first will give  you the background knowledge you need to understand the Cisco network security and routing books.  He suggests something similar to what I did for setting up and OS and playing with it, but he suggest attaining a much higher proficiency than I did.  I don't disagree with him; I'm only saying you can read some of the hacking/security books before becoming a proficient sysadmin.  You still need to learn everything he says and the hacking/security books will make more sense when you do. 

There is no one-size fits all path or plan.  I think what I suggested is probably the best start for someone at your level.  Someone more advanced should just jump into Sil's plan.  Someone already at an advanced level with networking or system administration might do some parts of Sil's plan and skip others that he is already proficient at.  As you go, you need to think about what you want to do, what it takes to get there, and where you're at now.  You can jump ahead a little bit at times, but if you neglect the basics you'll get stuck eventually.  If you're going to be a pen tester, you need a very broad knowledge.  If you're going to specialize in something like web application security, Cisco networking or databases, you will probably end up focusing more and neglecting some of the other areas.

Before you start reading books on hacking and security, you should have basic OS and networking skills.  Sil's link that you posted includes these general IT skills you need but it may be a little fast-going if you're really new.  Take a look at his page again and ask yourself how you feel about what he wrote.  If it seems too difficult, start build some basic skills and come back to it.  If it seems right at your level, then follow it and ignore the rest of my post.

For building basic skills:

I would suggest reading some books and playing around in a lab environment to get comfortable with Windows (Server), Linux, and TCP/IP.  I don't know what a good introductory book on Windows Server is; check reviews on Amazon.  At any rate, setup a VM and install Windows Server 2008 (or '03).  Find a basic book and mess around with it until you feel comforable configuring it and setting up services.  You'll also want to learn a Unix OS.  Most people start with Linux although FreeBSD is also very good and is my first choice.  Pick one, install it, play.  For a Linux book, I think How Linux Works provides a pretty basic introduction.  You can also find tons of tutorials online.  For FreeBSD, get the book Absolute BSD by Michael Lucas.  On the networking side, I recommend starting with the CCNA books by Odom if you want to learn Cisco too or TCP/IP Illustrated vol. I if you want to go deeper with TCP/IP first.  You'll probably read both eventually so if you're not sure, start with Odom.  It's okay if you don't finish the entire books at this point.  It's probably best if you do, but I think it's okay for people to jump around.  If you start getting the hang of networking and want to go play with Linux or read a first security book rather than learn more about routers and switches or more advanced TCP/IP topics, go ahead.

For TCP/IP, you need to understand the OSI layers and the purpose/basic functioning behind Ethernet, IP, TCP, UDP, ICMP, DHCP, ARP, and routing protocols (you don't need to know any specific routing protocols to start, just the concept).  You should know how to subnet and understand how traffic gets from your local network to another network across the Internet.

For Linux/Windows, you should know how to install the OS, add/remove/edit users, move around on the command line, configure basic services (ftp, ssh, mail), and update software.  On Linux, you need to be able to pipe and redirect commands, use tar and gz, and know how to create a shell script.  On Windows, you should know how to join a computer to a domain and how to set something in group policy or the local policy. 

Eventually, you'll need to know a lot more than this, but this is enough for you to start reading security/hacking books and understand most of what is being discussed. This way you can experiment as you read and compare what you're reading with what you're actually seeing on the OS.  This is also enough that you can start working on Sil's plan in earnest.  His plan seems designed to turn you into a competent system or network admin who is starting to focus on security.  The things I've suggested will only bring you to a more basic level assuming you don't have some general IT skills already but are not enough to establish the foundation you'll need as a security (or networking/systems) professional.

Good luck.

I used to do my scripting with Perl, but I switched to Python.  There's nothing wrong with learning both but if someone is only going to learn one I'd suggest Python.

Read everything you can.  Read other hacking books--Hacking Exposed, Counter Hack, Hacking: The Art of Exploitation.  Read networking books--TCP/IP Illustrated, Odom's CCNA guides.  Read programming books (pick a language).  Read other security books--The Web Application Hacker's Handbook, The Shellcoder's Handbook, Inside Network Perimeter Security, Network Intrusion Detection by Northcutt and Novak, The Tao of Network Security Monitoring, Applied Cryptography, Understanding Cryptography by Paar and Pelzl. 

For certs, the CISSP is required/desired for a lot of positions, especially if you push toward management but it requires five years of experience so it's something to look at down the road but not now.  Many postings ask for the CEH so it's worth getting for that reason alone.  The SANS certifications probably don't show up in as many postings as the CEH but they are generally more respected by tech folks.  Look at GSEC, GCIH, and GPEN.  The OSCP is one of the most respected certs among pen testers as far as I can tell, but it won't help you much with HR/business folks since they don't seem to know what it is.

Learn Python to start with.  It's easy to learn, powerful, and great for developing small scripts, automating tasks, and parsing data.  You'll also need to develop some knowledge of Javascript and C, at least to be able to read code snippets.  You should know how to do basic SQL queries.  It's hard to be proficient in multiple languages unless you program a lot.  Focus on getting good with one (again, Python) and then learn to read and make small tweaks in others.  If you get to where you feel like you're really good with Python and want to start working on a second language in earnest, go ahead.

The hash you pasted in is too long for SHA-1 and too short for SHA-256.  Please double-check it and let me know if it's right.  I'm curious.

Keep your head up and keep applying.  Take a job outside of security if you have to; it doesn't mean giving up on security.  Take any job you have to to pay the bills.

Be sure to tailor your resume for different jobs.  Don't submit your security resume for a help desk job.  Emphasize the skills that are right for the job you're applying for. 

The economy sucks.  Lots of people are out of work and many of them have been out for six months or longer.  You'll get back in the game and hopefully it will be soon, but try to keep your spirits up even if it takes a while. 

Good luck.

You need to know what hash algorithm was used.  Once you know that you can brute force it with something like this:

String realhash = \    
    "S(aGd0ci0jNG9wc2d1dmRmaSY7MCswLURpaXV6Yik=)";
for (Integer x=0; x<1000000; x++)
{
    String mypass = String.format(%06d", x);
    String myhash = hash(mypass);
    if myhash.equals(realhash)
    {
        System.out.println("The password is " + mypass);
    }
}

My syntax may be a little off (I'm not a Java programmer), but that code shows essentially what you need to do.

Congratulations on the pass.  You say you're not aspiring to be a pentester, so...what is your goal?  Just curious.

Very nice write-up.

OSCP is $750 or more depending on how much lab time you want.

http://www.offensive-security.com/information-security-training/penetration-testing-with-backtrack/

For appsec, certs may help a little, but they aren't as valued as in pen testing and network security.  A lot of senior level appsec jobs ask for the CISSP, but other than that, most job descriptions don't ask for certs.  Most of the top appsec guys either don't have certs or don't advertise them.  GSEC or GWAPT may be helpful, but you should check out the companies you want to work for and see if they ask for them or for any certs at all.  Plan to get the CISSP eventually, but I don't know that I'd recommend investing in any others for the cert itself.  If you want to take a SANS course to learn, that's fine, just a little pricey. But don't expect the cert to carry that weight that a Cisco cert would in networking.

You need to know at least one language really well and should have experience with several.  You need to be familiar with the OWASP top ten and should also check out ESAPI.  To get started learning about the various application security issues from a bug-hunters perspective, check out this book list by Dino Dai Zovi (he wrote a couple of them):

http://www.amazon.com/A-Bug-Hunters-Reading-List/lm/R21POHD6Y2DOLQ

You should start reading Bugtraq and Full-Disclosure to see the bugs that are posted there.  Don't worry about trying to remember which bugs are in which products, you need to understand what the bug is and how the poster found it.  Every time you see something you don't understand, go research it.  If an exploit is included, make sure you understand how it works.

You have your degree already which is important.  Now, you need to start gaining experience in software development or in appsec directly.  Where to start depends on what you want to do.  If you want to be a security architect at a software company or actually build security solutions, start out as a developer and work on your appsec knowledge along the way.  Make sure you learn some crypto as well; you won't be designing your own algorithms/protocols, but you should understand the ones that are out there.  I recommend reading Understanding Cryptography by Paar and Pelzl and Cryptography Engineering by Ferguson and Schneier.

If you want to be a bug hunter/researcher, you should try to get into a junior role that is somehow related to appsec.  With your degree and a little knowledge, you may be able to get a position analyzing security bug reports at a software company, testing software, or analyzing malware.  To be a bug hunter, you'll need to be able to program and should have a reading knowledge of multiple languages but you don't have to be a primo developer.  You need to learn to debug software and, if you're working with compiled programs, to reverse engineer as well.  Your networking experience won't count for a lot unless there is an actual networking focus to the appsec work you're doing (e.g. doing appsec at Cisco).

If you're interested in buffer overflows in C/C++ code, check out the list of papers I posted a while back:

http://www.ethicalhacker.net/component/option,com_smf/Itemid,54/topic,2897.msg13502/#msg13502

You may want to read a book on pentesting/hacking such as Hacking Exposed or Counter Hack just to get some perspective, but pentesting is a different skillset so don't worry about being proficient.

What is your goal exactly?  What job do you want to have and in what timeframe?

If you're planning to stay focused on networking, the CCIE Security is tremendously valuable and you could supplement it with GSEC, GCIH, etc.  If you plan to go into management, a CISSP would be worth a lot more (you'll probably need a 4-year degree also).  If you're looking to do penetration testing, a lot of companies ask for the CEH but most of the people here prefer more difficult certifications like the OSCP.  So, again, what is your goal?

There are several recent threads on getting started with penetration testing/ethical hacking.  You should check out Sil's guide to learning pen testing:

http://www.infiltrated.net/pentesting101.html

You also mention an interest in security more generally and that you're in a MS environment.  There are a lot of good books (I list some below), but since you've already done a BS in security you really need to find some projects (at work or at home) that will allow you to apply your skills.

There are tons of books available on Windows security such as Hacking Exposed: Windows, Rootkits: Subverting the Windows Kernel, Hacking Exposed: Malware & Rootkits, Windows Forensic Analysis DVD, and several more recent titles.  At some point, you'll also want to read Windows Internals by Mark Russinovich.

For other topics:


For IDS, I recommend Network Intrusion Detection by Stephen Northcutt and Judy Novak.  Also read The Tao of Network Security Monitoring.

For network security protocols, I recommend Network Security: Private Communication in a Public World by Charlie Kaufman. 

The best introductory cryptography book I've read is Understanding Cryptography by Christof Paar and Jan Pelzl.  If you don't remember math up through about Algebra II or higher, or have some background in Discrete math, read Applied Crypography and/or Cryptography Engineering instead.

I don't have a favorite book on firewalls.  Inside Network Perimeter Security was okay to me, but not great.

You do need to understand networking and TCP/P very well.  I like the CCNA study books by Wendel Odom.  I'm also a huge fan of TCP/IP Illustrated Vol. I but I have not read the new version.  The older version is now dated, but the author passed away and the publisher finally had a new author update the book.

For a general book on security, Ross Anderson's Security Engineering is excellent.

For web application security, I recommend the Web Application Hacker's Handbook.

For learning buffer overflows, check out the list of papers I posted a while back:
http://www.ethicalhacker.net/component/option,com_smf/Itemid,54/topic,2897.msg13502/#msg13502

Again, it sounds like you've already done some reading years back for school.  Pick a book or two, but start doing something hands on.

Do you have any specific interests within security other than ethical hacking?

Good luck.

You say that you have permission from others to hack/pen-test their sites yet you have no idea how to do so.  I strongly suggest setting up a home lab, reading some books/articles, playing with the tools and trying to figure out what you are doing before you play with someone else's network.  Without understanding what you are doing, you won't be able to produce anything of value for your target and you may inadvertently break something because you didn't understand the consequences of a tool (e.g. an exploit that kills the targeted service).  If you can practice/learn at home, read books, maybe take a training class or two, you may be able to work your way into a junior position where you can carry out actual penetration testing under the watchful eye of more senior people who can provide some guidance.  Are you working in IT now?  Does your company have a security department or security staff?

There is no specific tool that you use for hacking/pen-testing.  It's all about context.  You'll use different tools depending on whether the target is a specific system/web app or an enterprise network.  You'll probably have some favorite tools for various common tasks (e.g. nmap for port scanning), but you'll need to know which tools to use depending on what you find.  What services can you access?  What versions?  What is the underlying OS?  Can you connect directly to your target or do you have to gain a foothold on another system first?  The number of questions/variables that will come up is infinite.  The more you know and the more experience you have, the better prepared you will be to find the answers.

If you want a book on hacking, try Hacking Exposed, Counter Hack, or Professional Pen Testing Vol. I.  For web applications, the Web Application Hackers Handbook is very good.  I have the 2nd edition, but a new one came out recently.   Heck, read everything you can get your hands on. 

You should also check out this guide by Sil, another member of this site:

http://www.infiltrated.net/pentesting101.html

Do everything Sil says in his tutorial.  Plan to learn networking, programming, and how to manage Windows and one or more variants of Unix/Linux.

Learning a couple of tricks to hack into undefended sites is easy, but if you want to operate at a high level you need to understand networking, system administration, and some programming in addition to understanding a wide variety of security tools and the concepts behind them.  You'll have to move beyond using canned tools to building your own and, especially with web apps, learning to find new vulnerabilities and exploit them.

Anyone who wants to learn Python should also consider Learn Python the Hard Way by Zed Shaw.  The online version of his book is free, there is also a PDF version for $3 and an online course for $29. 

I haven't taken his course, but I have read some of his writing and he's both a good programmer and a clear writer which is hard to find.