Books for the library of a penetration tester ought to include:
Penetration testing: A hands-on introduction to hacking, 1st edition (June 8, 2014)
Ethical hacking and penetration testing guide, 1st edition (July 28, 2014)
This is another good book for beginners and aspiring ethical hackers who are walked through the steps involved in pentesting; the text, however, can also be a source of new ideas for intermediate users. It covers, in fact, a wide range of modern-day hacking tools, including Backtrack Linux, Google reconnaissance, MetaGooFil, dig, Nmap, Nessus, Metasploit, Fast Track Autopwn, Netcat, and Hacker Defender rootkit, which are commonly used to complete a penetration test. A four-step testing methodology is introduced and explained; this step-by-step approach is easy to follow, as it shows in a structured, orderly manner to conduct testing and gives an understanding of possible variants to the process. The book’s author, Rafay Baloch is the founder and owner of RHA InfoSec that specializes in pen-testing services.
The basics of hacking and penetration testing, second edition: Ethical hacking and penetration testing made easy (August 15, 2013)
The Hacker playbook 2: Practical guide to penetration testing (June 20, 2015)
This is the second version of The Hacker Playbook series and is a straightforward guide on pen testing that incorporates the latest attacks, tools and lessons learned from the previous book. The book chapters are broken down as if in preparation for a football play and walk readers through test cases for attacks. Several hands-on examples (with added lab sections) are featured together with helpful advice from the author Peter Kim who is a longtime security professional very involved in the IT security community today. He has spent the last ten years working as a penetration tester, and is now CEO of Secure Planet, LLC that offers professional vulnerability assessments and penetration testing services involving networks and applications. Readers have found that the amount of PowerShell techniques and scripts to uncover vulnerabilities provide much value, but it is important to note that it is not a book for absolute beginners and, although clearly written, requires sound technical knowledge.
Hacking exposed 7: Network security secrets & solutions, 7th edition (August 1, 2012)
Written by three security experts, including Stuart McClure, CNE, CCSE, Global CTO for McAfee/Intel, the book covers every core area of interest to penetration testers. The expert advice and defense strategies from the Hacking Exposed team and “case studies that expose the hacker’s latest devious methods and illustrate field-tested remedies” make this a must-read. Although now a bit dated, the book is still a great overview of hacking techniques and a solid foundation reference book for professionals entering the field.
Hacking for dummies, 5th edition (December 21, 2015)
Part of the popular series of books for absolute beginners, this volume is a resource that guides you into ethical hacking and its role in keeping systems and data secure. The book by Kevin Beaver, an independent information security consultant, is sure to become a go-to reference when performing penetration testing and/or vulnerability assessments. It is suitable mostly for absolute beginners looking for information on what ethical testing entails as well as how to use it to secure systems and keeping an IT infrastructure safe.
Professional penetration testing, second edition: Creating and learning in a hacking lab, 2nd edition (July 31, 2013)
Readers are bound to be inspired to enter a hacking and pen testing professional career with this book by Thomas Wilhelm, a professional penetration tester, and educator who covers the entire process of setting up a professional ethical hacking business and of practicing skills in a controlled pen test lab environment. Those that want to know how to build their own labs can find out in this edition.
Metasploit: The penetration tester’s guide 1st edition (July 25, 2011)
Although outdated in some parts, this book about penetration testing using the open source Metasploit Framework is still a staple in understanding how to work this popular tool. Metasploit is used to discover and execute exploits against a target; used on Windows, Linux, and Mac systems, it is the choice of many security professionals as it allows a tester quickly to write exploits and automate their execution. The book also shows how to integrate Metasploit with other tools and walks users through advanced techniques. As mentioned by aurelius, InfoSec Institute contributing writer, The Metasploit: The Penetration Tester’s Guide is one of the books that InfoSec Enthusiasts and IT Security Professionals should have on their bookshelf.
Coding for penetration testers, second edition: Building better tools, 2nd edition (October 5, 2016)
For users with a need to learn scripting and coding skills, applying penetration testing tools using Perl, Ruby, Python, and other languages, the latest book by Jason Andress and Ryan Linn is a must-read. Readers will be developing a better understanding of each language and be guided through real-world scenarios to develop and execute exploit codes against a target machine.
The mobile application hacker’s handbook, 1st edition (February 24, 2015)
As mobile applications grow in number and use, many pentesters are asked to become experts in discovering and securing flows in this highly vulnerable environment; this book provides guidance toward discovering and exploiting security flaws on the iOS, Android, Blackberry and Windows Phone platforms. This book offers a very practical approach to application security and is written by a team of highly experienced computer security experts. The handbook provides insight into best practices and ways to look out for common pitfalls while showing how to assess application security approaching the subject as through the eyes of hackers.
Black hat python: Python programming for hackers and pentesters (December 14, 2014)
This book by Justin Seitz, a Senior Security Researcher expert in coding with Python, reverse engineering and writing exploits, is a great choice for intermediate users who are interested in knowing more about Python-based offensive security tools. The author covers topics like how to manipulate packets, create Trojans and write network sniffers and, in general, how to use Python to carry a variety of attacks. Not a great book for beginners as it requires familiarity with Python modules and with its use. Intermediate users will appreciate the hands-on approach and the tips given by the author throughout the text as well as the conciseness.
RTFM: Red Team Field Manual (February 11, 2014)
A solid, concise, reference book that is popular with penetration testers and that contains common commands divided by category, as well as scripts and charts. The book is suitable for quick look-ups of information and coding lines that can benefit experienced pentesters as well as beginners.
Other books
Many more books are available as a reference for pentesters looking for theoretical help, best practices and information on how to approach this professional field. Others readings include The Browser Hacker’s Handbook 1st Edition (March 24, 2014), a very hands-on manual on browser exploitation to access systems. Also, The Web Application Hacker’s Handbook: Finding and Exploiting Security Flaws, 2nd Edition (September 27, 2011) is ideal for those who desire to pursue web app penetration testing or are involved with app development. The book was written by authors Dafydd Stuttard and Marcus Pinto who are professional penetration testers and have been involved in web application security. Another great read (just on the market) is Mastering Modern Web Penetration Testing (October 28, 2016) that “cover[s] web hacking techniques so you can explore the attack vectors during penetration tests,” tells the author Prakhar Prasad who is a web application security researcher and penetration tester from India. Some books and manuals are geared more towards the achievement of a certification and to acquiring the knowledge, skills, and competency to become a “qualified” Certified Ethical Hacker or Licensed Penetration Tester:
CEH Certified Ethical Hacker All-in-One Exam Guide, Third Edition (Sep 12, 2016) offers complete coverage of the EC Council’s Certified Ethical Hacker v9 exam. CEH v9: Certified Ethical Hacker Version 9 Study Guide, 3rd Edition (May 2, 2016) by Oriyano (Author) CEH v9: Certified Ethical Hacker Version 9 Practice Tests, 1st Edition (May 2, 2016) by Raymond Blockmon (Author)
These are some preparation books that can help be familiar with penetration testing frameworks and to help ensure full mastery of the exam material. The books can even help prepare to take up to 3 certifications:
CEH – Certified Ethical Hacker CPT – Certified Penetration Tester CEPT – Certified Expert Penetration Tester
Conclusion
The books mentioned above provide reference material on specific techniques for the experienced professional and provide guidance and information to anyone interested in entering the profession by introducing ethical hacking, understanding how security testing works and what tools and techniques are used for the purpose to meet just about every functional or infrastructure need to protect systems. Some books capture the typical career paths. Is ethical hacking in your future? Well, books are essential for continued learning, in addition to hands-on training and lab work specific for mastering the discipline, as they can provide more theoretical details in an environment to focus more on certain aspects of the line of work. Whether people want to perform network penetration tests, Web application security assessments, or wireless network security audits, they are bound to find that info in one of more of the books mentioned on this page. Books are also a great place to start to prepare to become Certified Ethical Hackers (CEH) or Certified Penetration Testers (CPT). Further learning can complement well by taking courses like those offered by Infosec, an Infosec Institute-approved training provider with course-related certs undergoing CEH and CPT courses that cover in-depth hacking techniques and practical Skill Sets in Penetration Testing. Everything told, the penetration testing and ethical hacking world is a field that takes dedication and the will to continue learning. Now as in the past, books are an effective learning source for job knowledge & professional development.
Are these books not enough for you? Check out these recommendations:
The Top 15 Must-Have Books in InfoSec 15 Must Have Books for InfoSec Enthusiasts and IT Security Professionals
