15 Must Have Books for InfoSec Enthusiasts and IT Security Professionals

Aside from security articles, podcasts and videos, books are great resources for developing new skills, improving one's career growth, and gaining extensive knowledge in the area of information security. If you are into network security, penetration testing, security research, exploit development, and teaching, then you should update yourself with good books that satisfy your hunger for knowledge.

Bear in mind that there is no single courseware or book that covers all the skills and knowledge you need to be an all-in-one good hacker with expertise on exploit development, penetration testing, vulnerability assessment, risk management, and network security. Each book has its own focus and topic, although some would cover the main issues in information security but not that extensive or should I say to its core.

Mastering network security, for example, is not just focusing on Network+, CCNA or CCNA Security courseware. You might need handful of books and resources that talk about TCP/IP, IPv6, Cryptography, etc. plus practical experience about the subject. Wait! Why Cryptography is added for network security? Well, we are talking about security right?

I have compiled a list of books that I believe could help newbies and experts progress and have fun.

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

• The Web Application Hacker's Handbook: Finding and Exploiting Security Flaws –This book is one of the most practical guides to finding web application vulnerabilities and a must have for web application security analysts, bug bounty hunters and testers. The book is written by Dafydd Stuttard and Marcus Pinto – co-founders of MDSec. Dafydd Stuttard is also the creator of Burp Suite, which is why Burp has been emphasized in this book.
• Metasploit: The Penetration Tester's Guide – The best guide for learning Metasploit, writing your own fuzzers, leveraging Metasploit based on the Penetration Testing Execution Standard (PTES), and much more. The books is written by David Keneedy (creator of Social Engineering Toolkit), Jim O'Gorman (co-founder of Social-Engineer.org), Devon Kearns (Metasploit contributor and member of the Offensive Security Team), and Mati Aharoni (founder of Offensive-Security).
• Wireless Penetration Testing using Backtrack – This book is intended for security consultants and analysts who are interested in wireless cracking, auditing and wireless security. Although it uses BackTrack as its distribution for wireless penetration testing, the tools used in the book are open source and can easily be downloaded or ported like Aircrack-ng Suite and Wireshark. If you have Kali Linux or BackBox Linux then you should be good to go, since both of these distros have wireless auditing tools pre-installed and Kali Linux is now the new BackTrack Linux. This book should give you the reason to wardrive. The book is written by Vivek Ramachandran who is the founder of SecurityTube.net and the person behind The Caffe Latte attack.
• The Tangled Web: A Guide to Securing Modern Web Applications – This book is written by Michał Zalewski a.k.a Icamtuf who is a one of the 15 most influential people in security, among the 100 most influential people in IT, and a security engineer from Google. This is a must read for web developers and web security enthusiasts because it covers brief history of the web, browser security model, web application security, and has a section called Security Engineering Cheat Sheet.
• The Browser Hacker's Handbook – Do you want to control someone's browser? If yes, then this book for you! The Browser Hacker's Handbook covers the following topics; bypassing the Same Origin Policy, control browsers (using ARP spoofing, Social Engineering, and phishing), exploiting the browser and its ecosystem (plugins and extensions), Cross-origin attacks, attacking web applications, and attacking networks. The book is written by Wade Alcorn, Christian Frichot, and Michele Orru' and they are the developers of BeEF (Browser Exploitation Framework) Project.
• RTFM: Red Team Field Manual – Nope, not the Read the F***in Manual but a cheat sheet and reference for Linux commands, Windows commands, Nmap commands, sqlmap commands, or commands you may want to use during a penetration test. A handy reference and arsenal for penetration testers on the battlefield! Thanks Ben Clark for creating this book or manual.
• Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software – This book is one of the most trusted and awesome books in malware analysis and reverse engineering. The book covers static analysis, how to setup a safe environment for malware analysis, using debuggers and disassemblers (IDA Pro, OllyDbg, and WinDbg), unpacking a malware, analyzing a shellcode and more. I am into exploit development and web and network penetration testing. I have learned new methodologies and malware analysis that has become my point of interest because of this book. This book gives you an edge for CTF games in hacker conferences like DEFCON or ROOTCON.
• The Android Hacker's Handbook – Mobile security is a trend, and emerging threats just keep on coming every day -- targeting and bashing Android and iOS phones. This book is an essential guide to securing and auditing Android apps plus Android application building blocks and application security.
• Violent Python: A Cookbook for Hackers, Forensic Analysts, Penetration Testers and Security Engineers – This book does not teach you how to code and what are the best practices in Python but leveraging Python for creating your own automation scripts for penetration testing and computer forensics. It gives you an idea on how to create a web scraper, wireless analyzer, sniffer (by using Scapy), fuzzers, bruteforce attack tools, port scanners, botnets, and how to replicate Conficker. Some would say that some Python snippets in the book are badly written but for me it is okay and it is up to you to improve some scripts in the book. A must have for Pythonistas who want to venture into penetration testing, open source intelligence gathering, wireless auditing and forensic analysis.
• Malware, Rootkits & Botnets: A Beginner's Guide – This book is written by Christopher C. Elisan who is the Principal Malware Scientist and Senior Manager of the Malware Intelligence Team at RSA, The Security Division of EMC. As the book says, it is a beginner's guide to Malware, Rootkits and Botnets which explains how these things work including the history of malware without having the need to be a software engineer, programmer, hacker or a reverse engineer. The book is well written, organized and can easily be understood by newbies.
• Black Hat Python: Python Programming for Hackers and Pentesters - This book is written by Justin Seitz, a senior security researcher at Immunity Inc. and the author of Gray Hat Python. This book is ideal for intermediate programmers who want to create a Github-Adware Trojan, extending the Burp proxy with python, network sniffers, web fuzzers or scrapers, keyloggers, and other offensive python projects. This book has a more detailed explanation of the snippets presented in the book than Violent Python however, we can't compare which two books about Python are better in this article since they have their own uniqueness and specifics.
• Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning – This book is written by Gordon Fyodor Lyon, who is the author of open source Nmap Security Scanner and maintains the SecLists.Org, Insecure.Org, SecTools.Org, SecWiki.Org, and Nmap.Org security resource sites. This book describes how to use Nmap and how Nmap works which covers subverting firewalls and intrusion detection systems, optimizing Nmap performance, and automating common networking tasks with the Nmap Scripting Engine (NSE).
• Cryptography Engineering – A book written by Niels Ferguson, Bruce Schneier, and Tadayoshi Kohno. This book is formerly known as Practical Cryptography, which is the first edition of the book, and with its second edition, it is fully updated and that Tadayoshi Kohno has been added as one of its authors. It is a sequel and now focuses on how to build a secure system rather than just design a cryptographic protocol.
• A Bug Hunter's Diary: A Guided Tour Through the Wilds of Software Security – I am a bug hunter myself and somehow this book gave me a good inspiration not just to deal with web application bugs but also software bugs. This book is a story and proof-of-concepts on how Tobias Klein found bugs for applications like VideoLAN's VLC media player, Sun Solaris kernel, FFmpeg multimedia library, WebEx ActiveX, Avast! AV, OSX TTY IOCTL, etc. by getting or gaining the control of the instruction or program counter control (EIP, RIP, R15 or PC). The book does not include a working exploit code or a shellcode since the author's home country (Germany) forbids the distribution of hacking tools, scanners, and exploits. No need to be disappointed about that since there are other books and resources that talks about exploit development like Jon Erickson's Hacking: The Art of Exploitation (2^nd Edition). Readers should have a fair understanding of Assembly, C, C++ programming languages to enjoy this book.
• Hacking: The Art of Exploitation, 2nd Edition – If you think that Tobias Klein's A Bug Hunter's Diary: A Guided Tour Through the Wilds of Software Security is not enough since you really want to exploit buffer overflow vulnerability in order to spawn a shell, then this book is for you. This book is not intended for script kiddies but people who want to graduate from being a script kiddie since this book will teach you about the true hacker culture and exploitation by creating your own proof of concepts.

Well, that's all for now! If you think that the list is lacking, feel free to comment below so that people can read about that book because sharing is caring.