Hacking

Top 7 cybersecurity books for ethical hackers in 2020

Top ethical hacking books for 2020

Ethical hacking is a huge field with a number of different specializations within it. Since ethical hackers are expected to perform an assessment of the security of an organization’s complete network environment, a number of books exist that provide extremely in-depth descriptions of how to hack into a particular type of target or perform specialized activities (like reverse engineering or cryptanalysis).

This list is focused on some of the best books for the ethical hacking generalist. Preference was given to books that provide a solid overview of ethical hacking or that focus on common targets (like web applications).

Earn two pentesting certifications at once!

Enroll in one boot camp to earn both your Certified Ethical Hacker (CEH) and CompTIA PenTest+ certifications — backed with an Exam Pass Guarantee.

View Pricing

 

1. “Ghost in the Wires” by Kevin Mitnick and William L. Simon

“Ghost in the Wires” by Kevin Mitnick is a great book to read if you want to get into the “why” of ethical hacking. Mitnick is one of the most successful social engineers in history and his story of the cat-and-mouse game of his exploits is an extremely engaging one. Social engineering is one of the most effective techniques in an ethical hacker’s toolkit and Mitnick is a master of it.

“Ghost in the Wires” is not the book that will teach you how to hack into a computer or extract user credentials from Active Directory. What it will do is provide an entertaining entry into the world of ethical hacking and useful tricks and case studies for future social engineering engagements.

2. “The 24 Deadly Sins of Software Engineering” by David LeBlanc, Michael Howard and John Viega

“The 24 Deadly Sins of Software Engineering” by Michael Howard, David LeBlanc and John Viega is a foundational book for ethical hackers. This book takes a look at the most common mistakes that developers make that open up their applications to potential exploitation. The book includes a description of each “sin,” sample code and a description of how to identify the

sin in source code review and testing.

A comprehensive understanding of each of the 24 deadly sins is necessary for an ethical hacker. These are the vulnerabilities that you are most likely to be looking for and exploiting during an ethical hacking engagement. Learning how to identify and exploit these vulnerabilities now can save a lot of time and trouble during a live engagement.

3. “Hacking: The Art of Exploitation” by Jon Erickson

“Hacking: The Art of Exploitation” by Jon Erickson provides a comprehensive overview of what an ethical hacker needs to know. This covers the basics of programming, common exploits, networking fundamentals, shellcode, common countermeasures and cryptography. The text includes numerous examples of sample code, providing the ability to get hands on with the various techniques described.

Many ethical hacking books are designed to provide a very deep dive into a particular topic. Before reading those, work through “Hacking: The Art of Exploitation” to ensure that you have the foundational knowledge necessary to get the most out of these more advanced books.

4. “The Web Application Hacker’s Handbook” by Dafydd Stuttard and Marcus Pinto

Web applications are a prime target for ethical hackers. A web application is usually designed to be exposed to the public internet yet has direct access to sensitive internal resources like databases. Since a web application contains an average of 22 different vulnerabilities, there are plenty of potential attack vectors for an ethical hacker.

“The Web Application Hacker’s Handbook” by Dafydd Stuttard and Marcus Pinto is one of the best books available for learning about hacking web applications. In addition to reading through the book, check out Stuttard’s further work with PortSwigger: the Web Security Academy.

5. “Hacking Exposed” by Stuart McClure

“Hacking Exposed” is designed to provide the hacker’s perspective to cyber defenders. It provides a walkthrough of various attack methods and describes how to defend against SQL injection and other common attack techniques.

“Hacking Exposed” is worth a read because it provides a wider overview of hacking techniques than many of the other books on this list. In addition to discussing common targets of ethical hacks (Windows/Linux machines, web applications and so on), it also talks about hacking infrastructure and mobile devices and countermeasures to protect against these attacks. Read this book to get a grounding in these subjects, then find a specialized book for a deep dive into hacking routers or mobile devices.

6. “Black Hat Python” by Justin Seitz

Taking advantage of automation is key to becoming an effective ethical hacker. A large percentage of an ethical hacker’s job is trying the same collection of techniques on a variety of different systems and across engagements. The ability to create scripts for common activities enables an ethical hacker to do their job more quickly, effectively and consistently and may be necessary for accomplishing an objective before being detected.

Python is one of the most widely-used programming languages in the world and “Black Hat Python” by Justin Seitz teaches how to use this language to create scripts for ethical hacking. This book provides hands-on examples for scripting every stage of an ethical hacking engagement, from initial reconnaissance on a network to exfiltrating data from a compromised machine.

7. “RTFM: Red Team Field Manual” by Ben Clark

The “Red Team Field Manual” by Ben Clark is a bit different from the rest of the books on this list. While reading through it before an ethical hacking engagement is certainly useful, the book is designed to come with you and be a resource on an ethical hacking engagement.

This is a reference guide created based upon years of experience in ethical hacking engagements. It provides how-to guides for accomplishing certain tasks and helps to ensure that you can get the syntax right for terminal commands when Google or a man page aren’t an option.

Conclusion: Getting started in ethical hacking

Ethical hacking is a fast-moving field, and it is essential to always keep learning to keep up with the latest vulnerabilities and attack vectors. Reading cybersecurity news, attending talks and digging into CVEs is the best way to keep up with the state of the art in the hacking world.

However, before learning about the cutting edge in ethical hacking, it’s necessary to understand the foundations and the ecosystem in which ethical hackers operate. Reading these top seven books is a great way to get a grounding in ethical hacking.

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

Sources

• Web Applications vulnerabilities and threats: statistics for 2019, PT Security
• Web Security Academy, PortSwigger
• Programming Languages You Should Learn in 2020, Computer Society