Gray hat Python

What Hacker News says

1. dsaccoJul 2017
   So, I've read most of these. Here's a tour of what is definitely useful and what you should probably avoid.

   _________________

   Do Read:

   1. The Web Application Hacker's Handbook - It's beginning to show its age, but this is still absolutely the first book I'd point anyone to for learning practical application security.

   2. Practical Reverse Engineering - Yep, this is great. As the title implies, it's a good practical guide and will teach many of the "heavy" skills instead of just a platform-specific book targeted to something like iOS. Maybe supplement with a tool-specific book like The IDA Pro Book.

   3. Security Engineering - You can probably read either this or The Art of Software Security Assessment. Both of these are old books, but the core principles are timeless. You absolutely should read one of these, because they are like The Art of Computer Programming for security. Everyone says they have read them, they definitely should read them, and it's evident that almost no one has actually read them.

   4. Shellcoder's Handbook - If exploit development if your thing, this will be useful. Use it as a follow-on from a good reverse engineering book.

   5. Cryptography Engineering - The first and only book you'll really need to understand how cryptography works if you're a developer. If you want to make cryptography a career, you'll need more; this is still the first book basically anyone should pick up to understand a wide breadth of modern crypto.

   _________________

   You Can Skip:

   1. Social Engineering: The Art of Human Hacking - It was okay. I am biased against books that don't have a great deal of technical depth. You can learn a lot of this book by reading online resources and by honestly having common sense. A lot of this book is infosec porn, i.e. "Wow I can't believe that happened." It's not a bad book, per se, it's just not particularly helpful for a lot of technical security. If it interests you, read it; if it doesn't, skip it.

   2. The Art of Memory Forensics - Instead of reading this, consider reading The Art of Software Security Assessment (a more rigorous coverage) or Practical Malware Analysis.

   3. The Art of Deception - See above for Social Engineering.

   4. Applied Cryptography - Cryptography Engineering supersedes this and makes it obsolete, full stop.

   _________________

   What's Not Listed That You Should Consider:

   1. Gray Hat Python - In which you are taught to write debuggers, a skill which is a rite of passage for reverse engineering and much of blackbox security analysis.

   2. The Art of Software Security Assessment - In which you are taught to find CVEs in rigorous depth. Supplement with resources from the 2010s era.

   3. The IDA Pro Book - If you do any significant amount of reverse engineering, you will most likely use IDA Pro (although tools like Hopper are maturing fast). This is the book you'll want to pick up after getting your IDA Pro license.

   4. Practical Malware Analysis - Probably the best single book on malware analysis outside of dedicated reverse engineering manuals. This one will take you about as far as any book reasonably can; beyond that you'll need to practice and read walkthroughs from e.g. The Project Zero team and HackerOne Internet Bug Bounty reports.

   5. The Tangled Web - Written by Michal Zalewski, Director of Security at Google and author of afl-fuzz. This is the book to read alongside The Web Application Hacker's Handbook. Unlike many of the other books listed here it is a practical defensive book, and it's very actionable. Web developers who want to protect their applications without learning enough to become security consultants should start here.

   6. The Mobile Application Hacker's Handbook - The book you'll read after The Web Application Hacker's Handbook to learn about the application security nuances of iOS and Android as opposed to web applications.

   Show morethread
2. dsaccoMay 2016
   Glad you asked. This is a list I like to call, "how to become an extremely effective and formidable security engineer."

   1. The Web Application Hacker's Handbook

   Probably the first book you want to read; this will teach you the core mindset you need for finding security flaws in web applications as well as give a very strong foundation for the different classes of vulnerabilities.

   2. The Mobile Application Hacker's Handbook

   Good supplement to #1 for application security, obviously focused on mobile apps.

   3. The Art of Software Security Assessment

   The bible of the security industry. Especially instructive for source code review.

   4. Security Engineering (Ron Anderson)

   Supplements #3. Very instructive for injecting security into the overall SDLC and designing secure software.

   5. The Tangled Web

   Excellent historical background and good high level overview of many information security topics. Every engineer should read this, even if they don't work in security.

   6. Gray Hat Python

   Very hands on, good introduction to aspects of reverse engineering and the typical work an e.g. security consultant will do at a top firm.

   7. Practical Malware Analysis

   Very good introduction to malware analysis.

   8. Practical Reverse Engineering

   This book, along with #9 will teach you everything you need to know to effectively reverse engineer software for security-focused analysis.

   9. Reversing: Secrets of Reverse Engineering

   10. The IDA Pro Book

   You'll want this if you have any plan to work with IDA Pro at all, which is the gold standard for decompiling and reversing software.

   11. The Shellcoder's Handbook

   If you'd like to write exploits after you're done reversing software to find an exploitable bug, this is a good book to pick up.

   12. Cryptography Engineering

   Very solid and broad introduction to cryptography. Every engineer should read this, even if they don't work in security.

   13. Introduction to Modern Cryptography

   This book, along with #14 is what you want to read if you're going to work as a cryptographer or cryptanalyst professionally.

   14. Handbook of Applied Cryptography

   --------------------------------------

   Theoretically, these books should resolve your known-unknowns and your unknown-unknowns. Anyone who reads and works through the list should be capable of designing secure software, finding errors in white and black box source code reviews and finding errors in white and black box penetration tests.

   If you're looking to get into this professionally, feel free to contact me if you have any questions and I'll do my best to help.

   Show morethread
3. dsaccoApr 2015
   As a security engineer, I'm really happy to see news like this enter the mainstream more and more on HN. These bounties are well deserved.

   For those of you who would like to try and earn bounties like these, I recommend the same books I always do:

   1. The Art of Software Security Assessment

   2. Gray Hat Python

   3. The Web Application Hacker's Handbook

   This is your ethical hacker starter kit. The first two are good for foundational knowledge and will show you how to find the bugs worth something. The third book is specialized for web applications, which is still great but not quite as lucrative.

   You will also want to check out CTFs, Cryptography Engineering and the Matasano Crypto Challenges.

   If you're looking to join a top tier security firm, Matasano is great for those who like offices and Accuvant (my employer) is great for those who like working fully remotely.

   Show morethread
4. forloopFeb 2015
   > Problem is, my financial situation doesn't always allow for me to get access to structured learning.

   There's so much information on the web, or via books/video courses/MOOCs that there's no need to do the structured learning thing. Particularly with Python. Plus, Python is used in security to create scripts/tools.

   EDIT: Example of some books, vis-a-vis Python and security (learn the basics first).

   * Violent Python: A Cookbook for Hackers, Forensic Analysts, Penetration Testers and Security Engineers

   * Hacking Secret Ciphers with Python

   * Python Penetration Testing Essentials

   * Gray Hat Python: Python Programming for Hackers and Reverse Engineers

   Show morethread
5. dsaccoJan 2015
   ^^ Exhibit A: One of the firms you'd want to try your hand at working for first :)

   They might also send / you'd want to read:

   - Gray Hat Python (debugging and fuzzing with Python)

   - The Tangled Web (web browser security and insecurity)

   - The Art of Software Security Assessment - the bible, which you really want to read as it's a foundational text. Very dense, but you'll come out of it knowing how to attack memory very well.

   Show morethread
6. meowfaceJul 2014
   I'm not tptacek, but...

   After lightly reading through both books, I think Gray Hat Python is a great book for more advanced security concepts, especially on the reverse engineering and exploit dev side of things, but isn't a very good book for learning Python or programming.

   Violent Python on the other hand is a great book for beginners to Python and programming, and it teaches both pretty well, but it only goes into surface level security concepts for the most part.

   Gray Hat Python is closer to a Windows API/x86 assembly book than a Python one. Violent Python is a real Python book and mostly covers general information security and network security concepts.

   Gray Hat Python is also purely application security. Debugging, reversing, hooking, writing shellcode, exploiting... Violent Python is almost entirely network security, with one chapter on forensics. Exploit dev vs. exploit user.

   It depends on your experience level and what you want to actually learn. If someone was brand new to Python, application security, and even programming, I'd recommend reading Violent Python first and then Gray Hat. If someone has more advanced security knowledge and has some decent programming skills already, I'd probably tell them to skip Violent Python.

   Or if they wanted to focus on appsec vs. netsec, I'd direct them to one or the other based on that. If you want both, you should definitely read both.

   Show morethread