How I test: I read every book on this list myself, cover to cover, over a decade of actually doing this work. Rankings reflect real difficulty progression and practical value, not AI summaries or publisher pay-for-placement. Some links are affiliate links, and if you buy through them I earn a small commission at no extra cost to you.
Written by Stefan Rows · Last reviewed July 2026 · All links checked July 2026
This is my 2026 list of the best hacking books, ranked the way I’d actually hand them to someone learning ethical hacking today. The short version: start with The Hacker Playbook 2 for methodology, read Linux Basics for Hackers (2nd Edition) if the command line still scares you, and pick up Hacking APIs or Bug Bounty Bootcamp once you know where you’re headed. Everything else on this page earned its spot.
I’ve kept the older classics too. A 2008 book on exploitation still teaches you more about how memory really works than most 2026 blog posts. Nothing here is filler, and I tell you plainly who each book is not for.
Quick picks (if you only read this far)
| If you want… | Read this | Why |
|---|---|---|
| The best all-round starting point | The Hacker Playbook 2 | Builds a lab and walks a full pentest at a beginner pace. |
| To stop fearing the Linux terminal | Linux Basics for Hackers, 2nd Ed. | Kali, bash, and Python from zero. Updated 2025 with an AI chapter. |
| To get into bug bounties | Bug Bounty Bootcamp | Choosing a program, finding bugs, writing the report, getting paid. |
| To hack APIs (where the bounties are) | Hacking APIs | REST, GraphQL, auth attacks, with guided labs on vulnerable APIs. |
| To understand exploitation deeply | Hacking: The Art of Exploitation | C, assembly, buffer overflows. The “how it actually works” book. |
| To prep for OSCP | Penetration Testing (Weidman) + Playbook 3 | Lab-heavy, methodology-first. Pair with hands-on platforms. |
| To learn offensive Python | Black Hat Python, 2nd Ed. | Sniffers, trojans, and tooling you write yourself. |
Every book at a glance, with buy links
Prefer to just grab one and go? Here’s every book on the list with a direct buy link, plus an alternative retailer where I could find one. Amazon links are affiliate links.
| Book | Buy on Amazon | Alternative |
|---|---|---|
| The Hacker Playbook 2 | Amazon | Kobo |
| The Hacker Playbook 3 | Amazon | Biblio |
| Real-World Bug Hunting | Amazon | No Starch |
| Hacking APIs | Amazon | No Starch |
| RTFM v1 | Amazon | Biblio |
| RTFM v2 | Amazon | thertfm.com |
| Hacking: The Art of Exploitation | Amazon | No Starch |
| The Web Application Hacker’s Handbook | Amazon | O’Reilly |
| Penetration Testing (Weidman) | Amazon | No Starch |
| Kali Linux Revealed | Amazon | Kali Training |
| Ghost in the Wires | Amazon | Barnes & Noble |
| Advanced Penetration Testing | Amazon | Wiley |
| Black Hat Python, 2nd Edition | Amazon | No Starch |
| Bug Bounty Bootcamp | Amazon | No Starch |
| Ethical Hacking (Graham) | Amazon | No Starch |
| Hands-on Hacking | Amazon | — |
| Linux Basics for Hackers, 2nd Ed. | Amazon | No Starch |
| Metasploit, 2nd Edition | Amazon | No Starch |
| Black Hat Bash | Amazon | No Starch |
| From Day Zero to Zero Day | Amazon | No Starch |
Table of Contents
- Quick picks (if you only read this far)
- Every book at a glance, with buy links
- How I picked these books
- Reading paths by goal
- The full list
- 1. The Hacker Playbook 2
- 2. The Hacker Playbook 3
- 3. Real-World Bug Hunting
- 4. Hacking APIs
- 5. RTFM: Red Team Field Manual v1
- 6. RTFM: Red Team Field Manual v2
- 7. Hacking: The Art of Exploitation, 2nd Edition
- 8. The Web Application Hacker's Handbook
- 9. Penetration Testing: A Hands-On Introduction to Hacking
- 10. Kali Linux Revealed
- 11. Ghost in the Wires
- 12. Advanced Penetration Testing
- 13. Black Hat Python, 2nd Edition
- 14. Bug Bounty Bootcamp
- 15. Ethical Hacking: A Hands-on Introduction to Breaking In
- 16. Hands-on Hacking
- Newer releases worth knowing (2024–2026)
- Full comparison table
- Prefer video? My favourite ethical hacking courses
- Where to buy
- Conclusion
- FAQ
How I picked these books
Four things decide whether a book makes this list. First, did it teach me something I actually used later? Second, does it get you hands-on instead of just reading, most of the good ones ship a lab or a vulnerable target. Third, is the difficulty honest, a “beginner” book that quietly assumes you know C isn’t a beginner book. Fourth, does it hold up in 2026. Some don’t, and I say so.
One note on the classics. A few titles here are old. That’s fine for fundamentals like networking, exploitation, and the hacker mindset, which barely change. It’s a problem for tool-specific books, where commands and interfaces drift. I flag which is which so you don’t waste money.
Reading paths by goal
Books work best in an order. Here’s how I’d sequence them depending on where you’re trying to end up. Read the first book fully before moving on, and do the labs. Reading alone won’t get you there.
Path 1 — Total beginner to your first pentest
- Linux Basics for Hackers, 2nd Edition, get comfortable in Kali and the terminal.
- The Hacker Playbook 2, your first full walk-through of a penetration test.
- Penetration Testing (Georgia Weidman), build a real lab and go deeper on methodology.
Path 2 — Bug bounty and web hacking
- Bug Bounty Bootcamp, the on-ramp: programs, recon, reporting.
- Real-World Bug Hunting, real HackerOne reports, vuln class by vuln class.
- Hacking APIs, where a lot of the modern payouts actually are.
Path 3 — OSCP and offensive depth
- Penetration Testing (Weidman), lab-first, the classic OSCP warm-up.
- The Hacker Playbook 3, red-team methodology and reporting.
- Hacking: The Art of Exploitation, the low-level foundation that separates operators from tool-runners.
Books give you the theory and a plan. For the reps, pair them with hands-on platforms like TryHackMe and Hack The Box, and read my getting started in cyber security guide for the full roadmap.
The full list
1. The Hacker Playbook 2
Level: Beginner – Intermediate | Author: Peter Kim | Pages: 358 | Published: 2015 | Hands-on lab: Yes
This was my gateway into hacking, and it’s still the book I hand beginners first. The Hacker Playbook 2 paces itself well: you set up a lab, then work through the tools and techniques a real penetration tester uses, without getting buried in theory on page one.
It’s framed as a “Penetration Tester Guide,” while the third book leans red team. Start here, then move up. The one honest caveat: it’s a 2015 book, so some specific tooling has moved on. The method and the mindset have not, and that’s what you’re buying it for.
2. The Hacker Playbook 3
Level: Intermediate – Advanced | Author: Peter Kim | Pages: 289 | Published: 2018 | Hands-on lab: Yes
The Hacker Playbook 3 is the step up. Kim takes you through a full engagement: recon, web app exploitation, network compromise, social engineering, physical attacks, and getting past antivirus and IDS. It ships a vulnerable web app so you can actually try the techniques instead of just reading them.
What I appreciated most is the chapter on communicating findings to a client. Almost no other book covers it, and it’s the part that pays your invoice. Read this after book 2, not before.
3. Real-World Bug Hunting
Level: Beginner – Intermediate | Author: Peter Yaworski | Pages: 264 | Published: 2019 | Hands-on lab: Case studies
Real-World Bug Hunting teaches web vulnerabilities through actual disclosed HackerOne reports. Open redirect, XSS, SQL injection, and more, each explained and then shown in a real report someone got paid for. That “here’s how it played out in the wild” angle is what makes it stick.
It also covers recon, testing your own targets, and writing up findings. Some readers find it lighter on step-by-step than they expected, so treat it as the “how bugs really look” companion to a more procedural book.
4. Hacking APIs
Level: Beginner – Advanced | Author: Corey J. Ball | Pages: 368 | Published: 2022 | Hands-on lab: Yes
APIs are where a lot of the modern bugs and bounties live, and most books skip them. Hacking APIs by Corey Ball fills that gap. It covers REST, SOAP, and GraphQL, walks you through building a testing lab, and runs guided attacks against deliberately vulnerable APIs: JWT attacks, NoSQL injection, broken authorization, the works.
It reads easily for how technical it is, and it works for both beginners and people already doing web testing. If bug bounty is your goal, this pairs perfectly with Bug Bounty Bootcamp.
5. RTFM: Red Team Field Manual v1
Level: Intermediate (reference) | Author: Ben Clark | Pages: 96 | Published: 2014 | Hands-on lab: No (reference)
The Red Team Field Manual isn’t a book you read, it’s a book you keep open next to you. It’s a dense command reference for those moments in the field when you don’t have Google: Linux and Windows syntax, Python, PowerShell, plus the Windows odds and ends like wmic and dsquery that you always forget.
It’s lived in my kit for years. If you’re past the beginner stage and doing actual engagements, it saves real time. If you’re brand new, skip it for now, you’ll get more out of it once you know what you’re looking up. If you’re buying today, go straight to v2 below.
6. RTFM: Red Team Field Manual v2
Level: Intermediate (reference) | Authors: Ben Clark, Nick Downer | Pages: 130 | Published: 2022 | Hands-on lab: No (reference)
RTFM v2 adds over 290 new commands and, finally, a macOS section that v1 was missing. The layout is easier to scan, which matters a lot in a book you’re using under pressure.
There’s also an optional paid video library with worked scenarios if you want more than the raw reference. If you’re buying an RTFM today, get v2 over v1.
7. Hacking: The Art of Exploitation, 2nd Edition
Level: Intermediate – Advanced | Author: Jon Erickson | Pages: 484 | Published: 2008 | Hands-on lab: Yes (LiveCD)
Hacking: The Art of Exploitation is old and I don’t care. It’s still the book that explains why exploits work instead of just how to run them. Erickson starts at C programming and takes you into buffer overflows, debugging, shellcode, and cryptography.
Be honest with yourself before buying: this is not a first book. You want some programming under your belt and at least a basic idea of assembly, or you’ll bounce off it. Get there and it’s one of the most rewarding reads in security. Some of what you’ll pick up:
- C, assembly, and shell scripting from an attacker’s angle.
- Using format strings and buffer overflows to corrupt memory.
- Inspecting processors and memory with debuggers.
- Gaining access with port-binding and shellcode.
- Hijacking TCP connections and intercepting wireless traffic.
8. The Web Application Hacker’s Handbook
Level: Intermediate – Advanced | Authors: Dafydd Stuttard, Marcus Pinto | Pages: 912 | Published: 2011 (Wiley) | Hands-on lab: Companion labs
The Web Application Hacker’s Handbook (WAHH) is written by the people who built Burp Suite, and it shows. At 912 pages it’s the deep reference for web app security, walking through each flaw class and how to both exploit and defend it.
Fair warning on age: it’s a 2011 book and the web has moved. The vulnerability fundamentals still hold, but for current, continuously-updated material use it alongside the free Web Security Academy that the same team runs. Book for depth, Academy for what’s current.
9. Penetration Testing: A Hands-On Introduction to Hacking
Level: Beginner – Intermediate | Author: Georgia Weidman | Pages: 524 | Published: 2014 | Hands-on lab: Yes
Georgia Weidman’s Penetration Testing is a lab-first classic and a common OSCP warm-up. You build a Kali lab with vulnerable VMs and work real scenarios using Wireshark, Nmap, Burp, and Metasploit. Password cracking, wireless attacks, basic web app testing, antivirus bypass, it’s a lot of ground at a beginner-friendly pace.
Caveat, read this before you buy: the book is from 2014 and some of the lab downloads and linked materials have gone stale. A second edition has been in the works for years but, as of 2026, still hasn’t shipped. Buy it for the methodology and Weidman’s excellent step-by-step teaching, and expect to source some updated lab VMs yourself.
10. Kali Linux Revealed
Level: Beginner – Advanced | Authors: Hertzog, Aharoni, O’Gorman | Pages: 314 | Published: 2017 | Also free online
Set expectations first: Kali Linux Revealed teaches you Kali, not pentesting. It’s the Kali developers themselves walking you through the OS, from Linux basics to installing Kali in every scenario, managing packages, and advanced topics like kernel compilation and custom ISOs.
I don’t recommend Kali as a first Linux distro, but if you’re committed to it, this is the book. Ignore the Amazon reviewers complaining there are no hacking tools taught, that was never the point. Worth knowing: the content is also available free as the official Kali training, so buy the print copy only if you like paper. After install, my things to do after installing Kali Linux guide covers the essentials.
11. Ghost in the Wires
Level: Any (narrative) | Author: Kevin Mitnick | Pages: 448 | Published: 2012 | Hands-on lab: No (memoir)
You could argue whether a memoir belongs on a hacking books list. For me it does. Ghost in the Wires is Kevin Mitnick telling the story of his years on the run before the FBI caught up with him. It’s the best look at how a hacker actually thinks that you’ll find in a book you can read on a plane.
I read it in about a week, which basically never happens for me. Don’t buy it to learn commands. Buy it for the mindset and, honestly, because it’s fun. Mitnick went legit and spent his later years as a respected security consultant before he passed away in 2023, and this book is the best record of the mind that made him famous.
12. Advanced Penetration Testing
Level: Advanced | Author: Wil Allsopp | Pages: 288 | Published: 2017 | Hands-on lab: Code-along
Advanced Penetration Testing goes well past the standard Kali toolset. It teaches techniques for hardened targets and, more usefully, shows you how to write your own tools from scratch. Understanding how a tool works under the hood is what puts you ahead of people who can only run whatever’s preinstalled.
There’s some social engineering in here too. This is a book for after you’ve worked through the Playbooks and WAHH. It’s genuinely advanced, so don’t start here.
13. Black Hat Python, 2nd Edition
Level: Intermediate | Authors: Justin Seitz, Tim Arnold | Pages: 216 | Published: 2021 | Hands-on lab: Code-along (Python 3)
If you can already write a bit of Python, Black Hat Python shows you how to turn it into offensive tooling: network sniffers, trojans, credential stealers, and scripts that automate the boring parts of a test. The second edition is updated for Python 3, so the code actually runs.
It’s a build-along book, so type the code, don’t just read it. Pair it with Black Hat Bash (below) and you’ve got both scripting languages every operator ends up using.
14. Bug Bounty Bootcamp
Level: Beginner | Author: Vickie Li | Pages: 416 | Published: 2021 | Hands-on lab: Yes
Bug Bounty Bootcamp is the on-ramp I recommend for anyone eyeing bug bounties with no web security background. It goes from picking your first program, to setting up a lab and proxy, to the common web vulns (SQLi, XSS, template injection) and how to bypass basic protections.
My favourite part was chaining multiple bugs together to bump up the severity and the payout. It even touches mobile app hacking, which most bounty books ignore. Vickie assumes no prior knowledge and it shows in the best way. A great first bug bounty book.
15. Ethical Hacking: A Hands-on Introduction to Breaking In
Level: Beginner – Intermediate | Author: Daniel G. Graham | Pages: 376 | Published: 2021 | Hands-on lab: Yes
Daniel Graham’s Ethical Hacking is a strong modern intro built around doing, not reading. You go from capturing network traffic to writing trojans and running XSS and SQL injection attacks, and you build your own tools in Python along the way. What I like about it:
- Hands-on from the start: real scenarios, not just theory.
- Wide range: ransomware in Python, reverse shells, web exploitation.
- You write your own tools: the skill that actually gets you hired.
- Goes deep when it wants to: Linux rootkits, privilege escalation, real malware.
Best for beginners who already grasp the basics and want to get their hands dirty, plus intermediate folks filling gaps. It was developed with feedback from students, and it reads that way in a good sense.
16. Hands-on Hacking
Level: Beginner – Intermediate | Authors: Matthew Hickey, Jennifer Arcuri | Pages: 608 | Published: 2020 | Hands-on lab: Yes (virtual labs)
Hands-on Hacking is a big, practical crash course in offensive technique. It puts you in the attacker’s seat and walks real infrastructure: breaching the external perimeter, moving into internal systems, and exploiting web apps, using the actual tools attackers use rather than hypotheticals.
It’s structured to take you from basic methods up to harder techniques, with virtual labs to practise in. Good for people entering the field and for building purple teams where attackers and defenders learn from each other.
Newer releases worth knowing (2024–2026)
The list above is my tested core. These four are more recent, and they’re the ones I’d add next. I’m still working through them rather than giving you a decade-of-use verdict, so I’ll be straight about that.
17. Linux Basics for Hackers, 2nd Edition
Level: Beginner | Author: OccupyTheWeb | Pages: 264 | Published: May 2025 | Hands-on lab: Yes
If the terminal is what’s blocking you, this is the fix. Linux Basics for Hackers takes you from installing Kali in a VM to bash and Python scripting, covering permissions, networking, staying anonymous with Tor and VPNs, and abusing services like MySQL and SSH. The 2nd edition is updated for current Kali, adds a more secure approach to root, and includes a new chapter on AI in cybersecurity. This is the beginner book competitors like StationX consistently rank at the top, and it earns it.
18. Metasploit, 2nd Edition
Level: Beginner – Intermediate | Authors: Kennedy, Aharoni, Kearns, O’Gorman, Graham | Pages: 352 | Published: 2024 | Hands-on lab: Yes
The long-awaited update to the classic Metasploit guide. Metasploit, 2nd Edition refreshes the framework’s modules and commands and adds new material, including a chapter on pentesting the cloud. It’s written by some of the biggest names in the field, including the creator of the Social-Engineer Toolkit. This is the English Metasploit book I’ve wanted to recommend for years, and it replaces the German-only Metasploit title I used to list here.
19. Black Hat Bash
Level: Beginner – Intermediate | Authors: Dolev Farhi, Nick Aleks | Published: August 2024 | Hands-on lab: Yes (Kali + Docker) | Pages: 344
Bash is on every Linux box you’ll ever land on, and Black Hat Bash teaches you to weaponise it: automating recon, fuzzing and port scanning with tools like Nmap and Nuclei, building reverse shells, evading detection, and moving laterally through a network. The only prerequisite is basic Linux familiarity. It pairs naturally with Black Hat Python.
20. From Day Zero to Zero Day
Level: Advanced | Author: Eugene Lim (Spaceraccoon) | Pages: 344 | Published: June 2025 | Hands-on lab: Yes
For when you’re past using other people’s exploits and want to find your own. From Day Zero to Zero Day is a hands-on vulnerability research guide from an award-winning bug hunter: taint analysis, mapping attack surface, reverse engineering with Ghidra and angr, coverage-guided fuzzing, and building proof-of-concept exploits. This is a serious book for serious people, but if vuln research is the goal, it’s one of the few modern titles that teaches the actual workflow.
Full comparison table
| Book | Level | Pages | Year | Hands-on lab | Best for |
|---|---|---|---|---|---|
| The Hacker Playbook 2 | Beginner–Int. | 358 | 2015 | Yes | First pentest walkthrough |
| The Hacker Playbook 3 | Int.–Adv. | 289 | 2018 | Yes | Red team methodology |
| Real-World Bug Hunting | Beginner–Int. | 264 | 2019 | Case studies | Seeing real bug reports |
| Hacking APIs | Beginner–Adv. | 368 | 2022 | Yes | API bug bounties |
| RTFM v2 | Int. (ref) | 130 | 2022 | No | Field command reference |
| Hacking: The Art of Exploitation | Int.–Adv. | 484 | 2008 | Yes | How exploits really work |
| The Web App Hacker’s Handbook | Int.–Adv. | 912 | 2011 | Companion labs | Deep web app reference |
| Penetration Testing (Weidman) | Beginner–Int. | 524 | 2014 | Yes | OSCP prep, methodology |
| Kali Linux Revealed | Beginner–Adv. | 314 | 2017 | N/A | Learning Kali itself |
| Ghost in the Wires | Any | 448 | 2012 | No | The hacker mindset (fun) |
| Advanced Penetration Testing | Advanced | 288 | 2017 | Code-along | Writing your own tools |
| Black Hat Python, 2nd Ed. | Intermediate | 216 | 2021 | Code-along | Offensive Python |
| Bug Bounty Bootcamp | Beginner | 416 | 2021 | Yes | Starting bug bounties |
| Ethical Hacking (Graham) | Beginner–Int. | 376 | 2021 | Yes | Modern hands-on intro |
| Hands-on Hacking | Beginner–Int. | 608 | 2020 | Yes | Broad practical crash course |
| Linux Basics for Hackers, 2nd Ed. | Beginner | 264 | 2025 | Yes | Kali + terminal from zero |
| Metasploit, 2nd Edition | Beginner–Int. | 352 | 2024 | Yes | Learning Metasploit |
| Black Hat Bash | Beginner–Int. | 344 | 2024 | Yes | Offensive bash scripting |
| From Day Zero to Zero Day | Advanced | 344 | 2025 | Yes | Vulnerability research |
Prefer video? My favourite ethical hacking courses
Plenty of people learn better by watching than reading, and I get asked about courses a lot. The ones that advanced my skills most are from Heath Adams, aka The Cyber Mentor. His Practical Ethical Hacking Course did more for me than any other online course, full stop.
- The Practical Ethical Hacking Course — Heath Adams
- Linux 101 — Brent Eskridge
- Windows Privilege Escalation — Heath Adams
- Linux Privilege Escalation — Heath Adams
There’s an all-access pass for around $30 a month if you want the lot. TCM Academy is worth it.
Where to buy
You’ll find every book here in my Amazon store. Buying through it earns me a small commission at no extra cost to you, which helps keep the site running. Thank you.
Conclusion
That’s the roadmap: what to read, in what order, for where you’re trying to go. Tools and courses come and go, but a good book still teaches structure better than anything else, which is why I keep coming back to them.
If you’re just starting, don’t buy all twenty. Grab Linux Basics for Hackers and The Hacker Playbook 2, actually do the labs, and go from there. Got a favourite I’ve missed? Drop it in the comments, I read them and update this list as I work through new titles.
FAQ
For most beginners I recommend starting with two books together: Linux Basics for Hackers, 2nd Edition (2025) to get comfortable in Kali and the terminal, and The Hacker Playbook 2 for your first full walk-through of a penetration test. Read Linux Basics first if the command line is new to you. From there, move on to Georgia Weidman’s Penetration Testing for a deeper, lab-based introduction. No single book covers everything, so plan to read a few and, more importantly, practise in a lab as you go.
Yes, but only if you pair them with practice. Books give you structure and depth on penetration testing, web and network security, cryptography and more that scattered blog posts and AI answers rarely match. What they can’t give you is reps. Set up a lab with Kali and vulnerable VMs, or use a platform like TryHackMe or Hack The Box, and apply what you read. The knowledge is only useful when you use it legally and ethically, on systems you own or have permission to test.
It depends on what the book teaches. Fundamentals like networking, exploitation, cryptography and the attacker mindset barely change, so a 2008 book like Hacking: The Art of Exploitation is still excellent. Tool-specific books age faster, because commands, interfaces and defenses move on. On this list I flag which is which: buy the older classics for concepts, and lean on newer or continuously-updated resources like the free Web Security Academy for anything tied to current tooling.
The most cited starting point is Georgia Weidman’s Penetration Testing, because it’s lab-first and matches the OSCP’s hands-on style. Add The Hacker Playbook 3 for red-team methodology and reporting, and Hacking: The Art of Exploitation if you want the low-level foundation. Books alone won’t pass OSCP, though. The exam is practical, so the real preparation is time in a lab and on platforms like Hack The Box and Proving Grounds. Use the books to build your methodology, then drill it.
Yes. Learning ethical hacking and penetration testing from books is completely legal, and these skills are in high demand for defensive and offensive security roles. What matters is where you apply them. Only test systems you own or have explicit written permission to test, and use lab environments and legal practice platforms for everything else. Attacking systems without authorization is a crime regardless of intent, so keep it in the lab.
Great list! I’m especially excited to see “The Art of Deception” included. I believe understanding social engineering is crucial in today’s digital landscape. Thanks for the recommendations!
thanks!
Thanks for great post!
You’re welcome!
Your website is one of the best i have ever seen and it is awesome , clear and easy to understand . Keep it going MAN , you’re helping a lot of people !!!
I appreciate this a lot! Thank you for leaving a comment!!
What do you mean by several people reported that parts of the labs and the external materials in the book are no longer available in book number 7?
Exactly what you just said.
So im about to ramp up my Pen Testing career path. Just got down with Linux+ n starting Sec+ from there im going to work on hacking certs. Ive been loosing the excitement for hacking since i started school so im looking for books to spark my joy again to stay motivated… I have added your amazon store and site to my start.me page. I was wondering if you could possible do an article on book to read in the correct order from beginning to advanced?? Also if you could do an article on any insite you have for a best path to follow for quickest career building. Im a lil late in the game to be getting started 32. so i could really use a boost LOL
There is no particular order in which you should read anything first, or any best path. The best path is the path you are most interested in. Also, there are no shortcuts. 32 is not late.
I started programming with 34 and I see no reason why it would be too late.
The best day to start was yesterday, the next best day is today. Keep it up.
Stefan, I’m not sure if you still look here but I am wondering why you didn’t add the 1st Playbook here. I just find it interesting to add part 2 and 3 but skip the 1st.
Hey Chris, of course I do!
That’s simply due to the fact that I did not read the first one and I only wanted to include books that I have actually, at least partly, read (unlike other articles out there.)
If you have an opinion on the first book, gladly let me know!
I’m currently in the process of reading the first one. Once I am completed with it I will give you an update to what my thoughts are on it. So far it has been pretty good. It is very well laid out just like I’m sure the 2nd and 3rd book are as well.
If you are interested, here is a post from the actual author of the series that relates to your question:
Peter here (author of the THP series), I can chime in as well (thanks u/misconfig_exe for letting me know). So, I think everyone has it pretty much on the dot. My first book was really just a collection of notes from my 10 years of pentesting. I loved to teach and my friends/students were always asking for my notes. So I didn’t really expect to sell any (other than to my students and maybe my mom…) and published it myself for kicks (no copy editors or anything like that). Fortunately, it sold really well and people seemed to like the format. So I took a step back and worked on book two. I really tried to clean two up, add a lot more on real world pentesting examples, lots of PowerShell, some labs, and took a lot of the advice I received from the community on what they wanted.
So… three years later and years of running Red Teams (which I state is definitely different from Pentesting in the book), I come out with the third installment, which is almost all new content. Again, the biggest request was more hands on labs. So included in the book is a NodeJS vuln web app, lateral movement VMs (3 VMs), and a custom THP Kali image with all the custom tools. Also, I included a lot of custom code to do Red Team “stuff”. This included tools for cloud attacks, recompiling Metasploit/Meterpreter to get around AV, examples of how to use C to get around AV (keyloggers, droppers, etc), how to be stealthy on the network and most importantly, how to live off the land.
Now back to the question, if you are pretty proficient in pentesting, go straight to 3. If you are pretty new on the topic, 2 will definitely help fill in some gaps (skip book 1). Of course, you can always reach out to me on twitter @hackerplaybook if you have additional questions. Let me know if this helps!
Lastly, I love our amazing security community and I’m so glad I can be a part of it! I’d love to give away some free copies of book 3, so I’ll randomly pick out three comments from this post by the end of Sunday and give away some books. Thanks everyone and keep breaking everything!
-Peter
Hey hey,
thanks for leaving that here!
Which book I should read first I am little bit confusing?
.I am a beginner
First I’d like to thank you for that list. It was very helpful in choosing my first books – I just ordered both written by Peter Kim. I was also considering RTFM, but instead I went for Operator Handbook: Red Team + OSINT + Blue Team Reference by Joshua Picolet. Any thoughts on that one? It was published recently, so I suppose you didn’t have a chance to look at it yet, but I’d appreciate your feedback about it if you ever have a chance.
Hey Michal,
haven’t looked at it, but you can’t go wrong with a Peter Kim book. Let me know how the other books are once you have finished them 🙂
I have read Real World Bug Hunting it was amazing.
Indeed!
Hacking is my hobby
I would also like to add another great book for dummies which is titled, “ABCD of Hacking: The Beginner’s guide” by Shashank Pai K. Start with this book and I bet you would never repent as this book explains from scratch, in layman terms with intuitive examples.