Cybersecurity Books: Offensive security

Part two of nine. Pentesting, exploitation, and red team work. The books after which you have practice, not just vocabulary.

One requirement is non-negotiable: your own lab, and written authorisation for anything you do outside it.

The only book on the list that starts with C and assembly and takes you to a working exploit. The publication year is alarming, but nobody has explained the mechanics of a buffer overflow better since.

Topics: working with the stack and the heap, buffer overflows, format strings, shellcode, network attacks, bypassing the simplest protections, the basics of crypto attacks.

The full penetration test cycle from reconnaissance to the report, with a step-by-step build of the lab. The best first practical book.

Topics: information gathering, scanning and service identification, exploiting common vulnerabilities, post-exploitation and persistence, attacks on wireless networks, mobile applications, writing your own exploit.

A collection of scenarios laid out like sports plays. Aimed at red teams rather than checklist audits.

Topics: external perimeter reconnaissance, phishing campaigns, evading antivirus and monitoring tools, lateral movement, compromising Active Directory, physical intrusion.

The canonical guide to the framework. The interfaces have changed since; the working logic has not.

Topics: Metasploit architecture, modules and payloads, Meterpreter, evading defences, automation, writing your own modules.

How to write your own tools instead of assembling other people's. The second edition has been rewritten for Python 3.

Topics: network clients and servers from scratch, sniffers, proxies, a trojan controlled over email, stealing data from the browser, automating Burp, working with the Windows API.

On finding vulnerabilities in live web applications and the rules of the game on bounty platforms.

Topics: domain reconnaissance, choosing targets, the common classes of web vulnerabilities, escalating the severity of a finding, writing the report, working with the triage team.

A breakdown of real public reports: what the researcher was looking for, what they found, and how much it paid.

Topics: XSS, CSRF, SSRF, access control bypasses, business logic flaws, vulnerabilities in OAuth flows, subdomain takeover.

Next part: reverse engineering and malware.

The whole series:

1. Foundations
2. Offensive security
3. Reverse engineering and malware
4. Cryptography
5. Application security
6. Defense and response
7. The human attack vector
8. Nonfiction investigations
9. Fiction