Social Engineering
Examines what social engineering is, the methods used by hackers to gather information, and ways to prevent social engineering threats.
Stats for nerds
6recommend
10mentions
8people
2014–2024years
80% recommend20% critical
Mentions per year
What Hacker News says
- Links:
https://github.com/onlurking/awesome-infosec
Books:
This Is How They Tell Me the World Ends: The Cyberweapons Arms Race https://www.amazon.com/dp/1635576059/
Social Engineering: The Science of Human Hacking https://www.amazon.com/dp/111943338X/
PTFM: Purple Team Field Manual https://www.amazon.com/dp/B08LJV1QCD/
I issue these to all new cyber hires in a senior infosec role.
For someone coming fresh into building infosec programs from scratch, I recommend Creating an Information Security Program from Scratch https://www.amazon.com/dp/0367554658/
If you want to go splunking for publicly exposed vulnerabilities, Shodan occasionally runs personal account specials: http://shodan.io/
If you put an email address in your profile, I’d be happy to gift a book bundle to you.
- "Social Engineering: The Art of Human Hacking" by Hadnagy.
- I've looked at recommendations in 25 articles and compiled a list of the most recommended books on cybersecurity sorted by how often they were mentioned.
Hacking Exposed 7 by Stuart McClure
Countdown to Zero Day by Kim Zetter
Ghost in the Wires by Kevin Mitnick
Spam Nation by Brian Krebs
Practical Malware Analysis by Michael Sikorski
Threat Modeling by Adam Shostack
Social Engineering by Christopher Hadnagy
The Hacker Playbook 3 by Peter Kim
The Practice of Network Security Monitoring by Richard Bejtlich
Dark Territory by Fred Kaplan
The Code Book by Simon Singh
Hacked Again by Scott N. Schober
The Hacker Playbook by Peter Kim
The Art of Invisibility by Kevin Mitnick
The Art of Deception by Kevin Mitnick
See the full list at https://www.readthistwice.com/lists/best-cybersecurity-books
- This is a copy/paste of one my comments from a different thread.
Disclaimer: I'm not particularly good at this, so whatever comments I make are well intentioned but may be of varying accuracy.
...
Online sources:
* https://hackthissite.org Wargaming site. Plenty of challenges to practice, but some are a bit outdated.
* OWASP.org is a good place to find info. If you look something up, there's a good chance you will find it here.
* https://owasp.org/www-project-web-security-testing-guide/ Thanks to redis_mic for this one.
* https://overthewire.org Similar to HTS, but you don't need an account. The subject matter covered is also slightly different.
* https://0x00sec.org/ A forum dedicated to security. There's a lot of script kiddies, but also some gold.
* https://www.hackerone.com/ What better way to learn then practice on live targets? That being said, I would do some of the others first.
...
I do a lot of learning through reading, so books:
* Network Security Assessment by Chris McNab. I have second edition, which is a good and instructive read, but quite outdated.
* Real-World Bug Hunting by Peter Yaworski. Web security 101. Good read, and fairly useful.
* Advanced Penetration Testing by Wil Allsop. Outdated, but interesting. You will never use flash again after reading this.
* Social Engineering, The Science of Human Hacking by Christopher Hadnagy. This is a very interesting read. Also, one of the few that can't go out of date.
...
This should be enough to get you started. There's a couple more books I can think of, but they tend to be more specialized into certain fields of security and less approachable/generally applicable. If you want these recommendations as well, feel free to email me, my email's in my bio.
- Sorry, I just saw this.
Disclaimer: I'm not particularly good at this, so whatever comments I make are well intentioned but may be of varying accuracy.
...
Online sources: * OWASP.org is a good place to find info. If you look something up, there's a good chance you will find it here.
* https://owasp.org/www-project-web-security-testing-guide/ Thanks to redis_mic for this one, I didn't know it existed until today.
* overthewire.org Similar to HTS, but you don't need an account. The subject matter covered is also slightly different.
* https://0x00sec.org/ A forum dedicated to security. There's a lot of script kiddies, but also some gold.
* https://www.hackerone.com/ What better way to learn then practice on live targets? That being said, I would do some of the others first.
...
I do a lot of learning through reading, so books:
* Network Security Assessment by Chris McNab. I have second edition, which is a good and instructive read, but quite outdated.
* Real-World Bug Hunting by Peter Yaworski. Web security 101. Good read, and fairly useful.
* Advanced Penetration Testing by Wil Allsop. Outdated, but interesting. You will never use flash again after reading this.
* Social Engineering, The Science of Human Hacking by Christopher Hadnagy. This is a very interesting read. Also, one of the few that can't go out of date.
...
This should be enough to get you started. There's a couple more books I can think of, but they tend to be more specialized into certain fields of security and less approachable/generally applicable. If you want these recommendations as well, feel free to email me, my email's in my bio.
- Seems like a good place to copy/paste one of my comments from a different thread.
Disclaimer: I'm not particularly good at this, so whatever comments I make are well intentioned but may be of varying accuracy.
...
Online sources:
* OWASP.org is a good place to find info. If you look something up, there's a good chance you will find it here.
* https://owasp.org/www-project-web-security-testing-guide/ Thanks to redis_mic for this one, I didn't know it existed until today.
* overthewire.org Similar to HTS, but you don't need an account. The subject matter covered is also slightly different.
* https://0x00sec.org/ A forum dedicated to security. There's a lot of script kiddies, but also some gold.
* https://www.hackerone.com/ What better way to learn then practice on live targets? That being said, I would do some of the others first.
...
I do a lot of learning through reading, so books:
* Network Security Assessment by Chris McNab. I have second edition, which is a good and instructive read, but quite outdated.
* Real-World Bug Hunting by Peter Yaworski. Web security 101. Good read, and fairly useful.
* Advanced Penetration Testing by Wil Allsop. Outdated, but interesting. You will never use flash again after reading this.
* Social Engineering, The Science of Human Hacking by Christopher Hadnagy. This is a very interesting read. Also, one of the few that can't go out of date.
...
This should be enough to get you started. There's a couple more books I can think of, but they tend to be more specialized into certain fields of security and less approachable/generally applicable. If you want these recommendations as well, feel free to email me, my email's in my bio.
Related
Threat modeling
1 recommend · 2
2019–2024
The Secret Life of Programs
5 recommend · 8
Security Engineering
38 recommend · 60
The Code Book
98 recommend · 148
Thinking in systems
124 recommend · 202
Cryptography engineering
50 recommend · 116
Applied Cryptography
76 recommend · 258
