Editor's top Ethical Hacking books
1Black Hat Python, 2nd Edition
Justin Seitz, Tim Arnold · No Starch Press · 216 pages · ~5 hrs to read
Building your own network sniffers, GitHub-based C2 trojans, and privilege-escalation tooling from scratch — turns "I can run tools" into "I can write tools when the built-in ones don't fit the engagement." The natural next step once Phase 1 Python fluency is solid.
Ethical Hacking Books for Beginners
1Penetration Testing: A Hands-On Introduction to Hacking
Georgia Weidman · No Starch Press · 531 pages · ~13 hrs to read
The friendliest complete introduction in book form — walks through building a lab and executing the full engagement lifecycle from recon to post-exploitation. A well-loved on-ramp before committing to OSCP-level study.
Intermediate & Advanced Ethical Hacking Books
9The Web Application Hacker's Handbook (2nd Edition)
Dafydd Stuttard, Marcus Pinto · Wiley · 912 pages · ~23 hrs to read
The classic web attack reference from Burp Suite's creator — methodology and vulnerability classes explained with a depth no course matches. Ageing in tooling specifics but the systematic approach remains the gold standard (PortSwigger Academy is its living successor).
Black Hat Python, 2nd Edition
Justin Seitz, Tim Arnold · No Starch Press · 216 pages · ~5 hrs to read
Building your own network sniffers, GitHub-based C2 trojans, and privilege-escalation tooling from scratch — turns "I can run tools" into "I can write tools when the built-in ones don't fit the engagement." The natural next step once Phase 1 Python fluency is solid.
RTFM: Red Team Field Manual v2
Ben Clark, Nick Downer
No narrative, no theory — just exact syntax for hundreds of Linux, Windows, PowerShell, and Active Directory commands operators need mid-engagement without breaking flow to search docs. Every working pentester keeps a copy within reach.
Gray Hat Hacking: The Ethical Hacker's Handbook, 6th Edition
Allen Harper, Ryan Linn, Stephen Sims, et al. · McGraw-Hill · 752 pages · ~19 hrs to read
A genuinely comprehensive survey spanning IoT, cloud, mobile, and network attacks with hands-on labs per chapter — broader than most single-author books because a dozen practising researchers each wrote their specialty section.
Social Engineering: The Science of Human Hacking
Christopher Hadnagy · Wiley · 327 pages · ~8 hrs to read
Pretexting, elicitation, and manipulation frameworks grounded in real behavioural psychology, not hacker folklore — from the person who built the first social engineering certification. The human-attack-surface half of red teaming that pure technical study skips.
Practical Malware Analysis
Michael Sikorski, Andrew Honig · No Starch Press · 802 pages · ~20 hrs to read
Static and dynamic analysis of real malware in IDA Pro and OllyDbg, including anti-debugging and unpacking tricks. Red teamers who build their own implants need to know what defenders' tooling will see — the standard text for that side of the fence.
The Hacker Playbook 3
Peter Kim · Secure Planet0
A red-team-focused walkthrough of a full engagement — initial access through lateral movement and exfiltration against a simulated enterprise — with the tooling and mindset of adversary simulation rather than a single-box CTF.
Real-World Bug Hunting
Peter Yaworski · No Starch Press · 265 pages · ~7 hrs to read
Built entirely from disclosed bug bounty reports against Twitter, Uber, and Shopify — the fastest way to calibrate what a real, payable vulnerability looks like versus a theoretical OWASP category, directly useful for anyone building a HackerOne track record.
Hacking APIs
Corey J. Ball · No Starch Press · 362 pages · ~9 hrs to read
REST and GraphQL-specific offense — BOLA, mass assignment, and JWT forgery walked through in nine guided labs. APIs are now the majority of most companies' attack surface, and this is the only book here that treats them as a first-class target.
Ethical Hacking resources
Learn next