An application security reading list

Thomas Ptacek recommends these 16 books:

The IDA Pro Book: The Unofficial Guide to the World's Most Popular Disassembler: Chris Eagle: 9781593271787


Gray Hat Python: Python Programming for Hackers and Reverse Engineers: 0689145719215: Computer Science Books @


Network Algorithmics, : An Interdisciplinary Approach to Designing Fast Networked Devices (The Morgan Kaufmann Series in Networking): George Varghese: 9780120884773


Internetworking with TCP/IP Vol. II: ANSI C Version: Design, Implementation, and Internals (3rd Edition): Douglas E. Comer, David L. Stevens: 9780139738432


C Interfaces and Implementations: Techniques for Creating Reusable Software (9780201498417): David R. Hanson: Books


Computation Structures (MIT Electrical Engineering and Computer Science): Stephen A. Ward, Robert H. Halstead: 9780262231398


The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities (Volume 1 of 2): Mark Dowd, John McDonald, Justin Schuh: 0785342444421


Surreptitious Software: Obfuscation, Watermarking, and Tamperproofing for Software Protection: Obfuscation, Watermarking, and Tamperproofing for Software Protection: Christian Collberg, Jasvir Nagra: 0785342549256


The Web Application Hacker's Handbook: Discovering and Exploiting Security Flaws: Dafydd Stuttard, Marcus Pinto: 9780470170779


The Mac Hacker's Handbook: 9780470395363: Computer Science Books @


Cryptography Engineering: Design Principles and Practical Applications: Niels Ferguson: 8601300284644


SQL For Dummies: Allen G. Taylor: 9780470557419


JavaScript: The Good Parts: Douglas Crockford: 0636920517740


Windows® Internals: Including Windows Server 2008 and Windows Vista, Fifth Edition (Developer Reference) (9780735625303): Mark Russinovich, David A. Solomon, Alex Ionescu: Books


Reversing: Secrets of Reverse Engineering: Eldad Eilam: 9780764574818


The Practice of Programming (Addison-Wesley Professional Computing Series): 9780201615869: Computer Science Books @


Thomas Ptacek says,

Principal - Latacora

[1] Grey Hat Python: Literally the first book I thought of when I started this list, and I don't even like writing in Python. A headfirst dive into the day-to-day coding all app pentesters end up doing.

[2] The Art of Software Security Assessment: The same way you can say "TAOCP" on a programming site and everyone knows you mean "Knuth", say "TOASSA" to a security person and they know this book. This is the McGee, the Cormen/Rivest, the "Theory Of Poker" for our industry: how to find vulnerabilities by reading software.

[3] The Web Application Hacker's Handbook: As much as 50% of your app security work is going to involve finding flaws in web applications, and that percentage is only going to go up.

[4] Cryptography Engineering: The best security books are the ones you can “read backwards” to learn how to attack systems instead of defending them.

[5] The Practice of Programming: Skip it if you've already done dev professionally (and, if you can, try to spend a couple years doing that before coming to app security). Otherwise: you want to (a) get good at busting our reliable, readable security testing tools without losing cycles figuring out how to start, and (b) to know how pro devs think before trying to tear up their software.

[6] C Interfaces and Implementations: You need C. This is the single best book on C software development that has ever been written. It takes everything you've been doing in Python, Ruby, or Perl, but have lost in C, and gives it back to you - while explaining each line of code it takes to do that, and making you a competent C API designer in the process.

[7] Reversing: The best end-to-end treatment of the theory and practice of taking compiled binary software and working it back to its design and internal function. Read this to understand why writing your own version of IDA Pro is more trouble than its worth, or to see why you'd want to do that in the first place.

[8] Javascript The Good Parts: This book is tiny. Most books about Javascript are 18,000 pages long, explain how to write 1000 lines of JS to make rounded corners in IE5, and suck. This book contains nothing but how to write serious code in Javascript, a surprisingly serious language that it turns out owns a surprisingly huge portion of the Internet security model by enforcing the "same origin policy" that secures browsers.

[9] SQL for Dummies: You have to know SOME SQL to do web security work. My theory: the less of it you end up knowing, the happier you'll end up being. Thus: this book.

[10] Windows Internals: You want to know how modern OS's work on x86. Especially memory management. You want to know why system calls work the way they do. You want to grok IPC. You can learn with Unix or with Windows, but Windows depth has more market value, and there's no comparably good (and modern) Unix internals book.

[11] The Max Hacker's Handook: Union rules require me to recommend at least one book by Charlie Miller and one book by Dino Dai Zovi, and this book, which is great, kills two birds with one stone.

[12] The IDA Pro Book: Don't buy this until you get your IDA Pro license. And if you've been using IDA for years already, borrow it instead. But this book is the manual Hexrays should ship with the IDA, and IDA is the de facto standard binary reversing tool for our industry. Know that if you grok assembly and C, then a week or two, a copy of IDA, and this book combined will get you reversing WinAPI programs reliably.

[13] Internetworking with TCP/IP: Sooner or later you're going to hit a project where the only way to listen to and talk to the target is to bust out libpcap and do IO with raw frames. In TCP/IP books, there's the Comer camp and the W. Richard Stevens camp. I'm a Comer guy. This book is more general than Stevens, and works from a far cleaner codebase (Stevens' 4.4BSD, while venerable, is ugly as sin).

[14] Network Algorithms: Do any of those tools you wrote with libpcap after reading Comer & Stevens have to work fast? Do they have to deal with more than a couple hundred hosts? This book isn't cheap, and it's somewhat specialized, but it's well written, interesting, and authoritative.

[15] Computation Structures: Eventually you'll get a project that's going to involve an exotic target, maybe synthesized onto an FPGA in some crazy RISC architecture, maybe on an embedded controller you can only talk to with JTAG. You want to know how computer systems are designed and engineered from electrical signals on up. This book starts from circuits and ends with compiler design and may be all you'll ever need.

[16] Surreptitious Software: One branch of binary runtime security work involves software protection, which means "copy protection" and "tamper proofing" and "anti-cheating" and "malware countermeasures" all at this same time. This book is somewhat stuffily written and uses formalisms more than case studies, but if runtime security is your thing, you'll forgive those quirks for the breadth and authority in this book.

Want to see someone's reading list here? Send us an email to