The IDA Pro book

What Hacker News says

1. fapjacksSep 2017
   The physical books from this list I own are actually great (Metaploit guide, Pentesting, Book of PF, Art of Exploitation, The IDA Pro Book, and Practical Packet Analysis). I am buying this bundle because I'd love to have PDFs of these, and I'm thinking the other books must be good if they're bundled with these others which I find useful.
   thread
2. freedombenSep 2017
   I have many of these books, and I can vouch for their quality. They are excellent.

   Get the $15 bundle. Those are the best ones. They are a little bit out of date, but still very relevant. This is a steal!

   Especially great books:

   * Hacking the Art of Exploitation

   * The Ida Pro Book (mostly if you use Windows)

   * The Practice of Network Security Monitoring

   * Practical Packet Analysis

   The Metasploit book was pretty good too, and taught me a lot about Metasploit. It didn't really scratch the "deep dive" itch that I usually have though.

   Show morethread
3. dsaccoJul 2017
   So, I've read most of these. Here's a tour of what is definitely useful and what you should probably avoid.

   _________________

   Do Read:

   1. The Web Application Hacker's Handbook - It's beginning to show its age, but this is still absolutely the first book I'd point anyone to for learning practical application security.

   2. Practical Reverse Engineering - Yep, this is great. As the title implies, it's a good practical guide and will teach many of the "heavy" skills instead of just a platform-specific book targeted to something like iOS. Maybe supplement with a tool-specific book like The IDA Pro Book.

   3. Security Engineering - You can probably read either this or The Art of Software Security Assessment. Both of these are old books, but the core principles are timeless. You absolutely should read one of these, because they are like The Art of Computer Programming for security. Everyone says they have read them, they definitely should read them, and it's evident that almost no one has actually read them.

   4. Shellcoder's Handbook - If exploit development if your thing, this will be useful. Use it as a follow-on from a good reverse engineering book.

   5. Cryptography Engineering - The first and only book you'll really need to understand how cryptography works if you're a developer. If you want to make cryptography a career, you'll need more; this is still the first book basically anyone should pick up to understand a wide breadth of modern crypto.

   _________________

   You Can Skip:

   1. Social Engineering: The Art of Human Hacking - It was okay. I am biased against books that don't have a great deal of technical depth. You can learn a lot of this book by reading online resources and by honestly having common sense. A lot of this book is infosec porn, i.e. "Wow I can't believe that happened." It's not a bad book, per se, it's just not particularly helpful for a lot of technical security. If it interests you, read it; if it doesn't, skip it.

   2. The Art of Memory Forensics - Instead of reading this, consider reading The Art of Software Security Assessment (a more rigorous coverage) or Practical Malware Analysis.

   3. The Art of Deception - See above for Social Engineering.

   4. Applied Cryptography - Cryptography Engineering supersedes this and makes it obsolete, full stop.

   _________________

   What's Not Listed That You Should Consider:

   1. Gray Hat Python - In which you are taught to write debuggers, a skill which is a rite of passage for reverse engineering and much of blackbox security analysis.

   2. The Art of Software Security Assessment - In which you are taught to find CVEs in rigorous depth. Supplement with resources from the 2010s era.

   3. The IDA Pro Book - If you do any significant amount of reverse engineering, you will most likely use IDA Pro (although tools like Hopper are maturing fast). This is the book you'll want to pick up after getting your IDA Pro license.

   4. Practical Malware Analysis - Probably the best single book on malware analysis outside of dedicated reverse engineering manuals. This one will take you about as far as any book reasonably can; beyond that you'll need to practice and read walkthroughs from e.g. The Project Zero team and HackerOne Internet Bug Bounty reports.

   5. The Tangled Web - Written by Michal Zalewski, Director of Security at Google and author of afl-fuzz. This is the book to read alongside The Web Application Hacker's Handbook. Unlike many of the other books listed here it is a practical defensive book, and it's very actionable. Web developers who want to protect their applications without learning enough to become security consultants should start here.

   6. The Mobile Application Hacker's Handbook - The book you'll read after The Web Application Hacker's Handbook to learn about the application security nuances of iOS and Android as opposed to web applications.

   Show morethread
4. strictneinApr 2017
   Others will likely have more informed opinions, but here's some stuff:

   Book: Web Application Hacker Handbook http://www.wiley.com/WileyCDA/WileyTitle/productCd-111802647...

   I've seen it highly recommended and if you're not familiar with the field it's a good overview of exploit types for web apps.

   Online training for free or cheap: Cybrary - mostly okay, but free.

   PluralSight - https://www.pluralsight.com/browse/it-ops/security

   Coursera has a Cybersecurity Fundamentals specializationd that's pretty good - https://www.coursera.org/specializations/cyber-security

   Other books, if you wanted to go down the reverse engineering route:

   Assembly Language Step-by-Step: Programming with Linux

   The IDA Pro Book (for the strangely hard to buy IDA Pro, but the free version is pretty good)

   Practical Malware Analysis

   Show morethread
5. dsaccoMay 2016
   Glad you asked. This is a list I like to call, "how to become an extremely effective and formidable security engineer."

   1. The Web Application Hacker's Handbook

   Probably the first book you want to read; this will teach you the core mindset you need for finding security flaws in web applications as well as give a very strong foundation for the different classes of vulnerabilities.

   2. The Mobile Application Hacker's Handbook

   Good supplement to #1 for application security, obviously focused on mobile apps.

   3. The Art of Software Security Assessment

   The bible of the security industry. Especially instructive for source code review.

   4. Security Engineering (Ron Anderson)

   Supplements #3. Very instructive for injecting security into the overall SDLC and designing secure software.

   5. The Tangled Web

   Excellent historical background and good high level overview of many information security topics. Every engineer should read this, even if they don't work in security.

   6. Gray Hat Python

   Very hands on, good introduction to aspects of reverse engineering and the typical work an e.g. security consultant will do at a top firm.

   7. Practical Malware Analysis

   Very good introduction to malware analysis.

   8. Practical Reverse Engineering

   This book, along with #9 will teach you everything you need to know to effectively reverse engineer software for security-focused analysis.

   9. Reversing: Secrets of Reverse Engineering

   10. The IDA Pro Book

   You'll want this if you have any plan to work with IDA Pro at all, which is the gold standard for decompiling and reversing software.

   11. The Shellcoder's Handbook

   If you'd like to write exploits after you're done reversing software to find an exploitable bug, this is a good book to pick up.

   12. Cryptography Engineering

   Very solid and broad introduction to cryptography. Every engineer should read this, even if they don't work in security.

   13. Introduction to Modern Cryptography

   This book, along with #14 is what you want to read if you're going to work as a cryptographer or cryptanalyst professionally.

   14. Handbook of Applied Cryptography

   --------------------------------------

   Theoretically, these books should resolve your known-unknowns and your unknown-unknowns. Anyone who reads and works through the list should be capable of designing secure software, finding errors in white and black box source code reviews and finding errors in white and black box penetration tests.

   If you're looking to get into this professionally, feel free to contact me if you have any questions and I'll do my best to help.

   Show morethread
6. GaveUpFeb 2013
   I'm by no means an expert but these are some of the links/books I've found informative.

   Smashing The Stack For Fun And Profit [1] Reversing: Secrets of Reverse Engineering [2] The IDA Pro Book [3]

   The iOS Hacker's Handbook [4] was interesting as a sort of case study on exploiting and hacking embedded hardware.

   Mostly what I've found, though, is just starting with a question and googling the answer yield the most results. For example, see mention of a stack overflow attack google how and why stack overflow attacks work (or don't) and once that side of things is understood the thought process behind finding them becomes easier to understand, although not really easier to do (for me, at least).

   [1] http://insecure.org/stf/smashstack.html

   [2] http://www.amazon.com/Reversing-Secrets-Engineering-Eldad-Ei...

   [3] http://www.amazon.com/IDA-Pro-Book-Unofficial-Disassembler/d...

   [4] http://www.amazon.com/iOS-Hackers-Handbook-Charlie-Miller/dp...

   Show morethread