diff --git a/Cybersecurity-Materials-Map.svg b/Cybersecurity-Materials-Map.svg new file mode 100644 index 0000000..54cf0ba --- /dev/null +++ b/Cybersecurity-Materials-Map.svg @@ -0,0 +1,106 @@ +
Cybersecurity Materials
Before Even Starting
The Purpose
Many People Want To Enter The Field Of Cybersecurity And Need A Roadmap Or Guide To Show Them The Proper Path. While Cybersecurity Consists Of Various Subfields, The Main Necessities For Beginners Are Still The Same. This Roadmap Can Help Newcomers Find Their Way Through The Vast And Sometimes Confusing World Of Cybersecurity. It Is Designed So That Even Someone With No Prior Knowledge Of Cybersecurity Can Use It Effectively.
English
If You Have A Hard Time Reading This Roadmap, You Probably Need To Take A Step Back And Improve Your English Skills. This Is Important Because The Books And Resources Mentioned In This Roadmap Are In English, And High-quality Materials Are Generally Found In This Language. This Doesn't Mean You Have To Speak English Fluently; Even If You Can Read And Understand Texts Using Dictionaries, You Can Follow Along. Remember, Your Language Skills Can Also Improve By Reading These Books Along The Way.
Discipline
Since Cybersecurity Is An Ever-evolving Field, Only Those Who Are Lifelong Learners Can Advance In It. This Requires A Good Level Of Discipline And Motivation To Learn Over A Long Period. You Should Spend At Least 2-3 Hours Daily For 2-3 Months Reading The Materials At The Beginning. By Reading, I Mean Developing A Deep Understanding Of What You Are Reading, Not Just Skimming. Cybersecurity Is An Endless Road, And You Won't See Any Payoffs At First Or Even Months Later. If You're Not Willing To Put In A Lot Of Time And Effort, You Might Not Be The Right Person For This Field.
Books?
You Might Ask, +"But Why Books? Won't Other Media Work?" The Answer Is
1. You Absorb Knowledge Faster By Reading Books, While Watching Videos Takes More Time.
2. Videos Provide The Digested Knowledge Of The Tutor, Which Might Be Wrong Or Shallow.
3. Books Follow A Curriculum That The Author Knows You Need To Learn Before Other Topics.
4. You'll Learn How To Read Technical Materials, Take Notes, Write Technical Materials, Etc. In Short, "You Learn How To Learn."
What Else?
Other Things You Should Consider During This Time Are Note-taking, Logging Study Times, And Practicing Writing Skills. These Will Come In Handy As Soft Skills That Help You In Your Career As A Security Engineer.
Free Online + Courses & Classes
Open Security Training
Edx +Index Of Free Online Computer Science Courses And Programs
Computer Science Fundamentals Free Courses +Free Online Equivalent Of CS Bachelor Degree!
Must To Read
Recommended
Basic OS & Networking
Network+
Linux Bible +10th Edition
Security+
Microsoft Security-101 Free Courses +Great source for learning basic but good-to-know theoretical topics
LPIC-1 +Jadi's training materials
The Linux Command Line +2nd Edition
MCSA Windows 10 Study Guide
MCSA Networking With Win Server 2016
Recommended
Basic Programming
Black Hat Python 1st Edition +Must-read For Beginners, Python 2
Black Hat Python 2nd Edition +Updated For Python 3
Gray Hat Python
Shell Programming & Bash Scripting
Black Hat Go
Effective C +Great & Light Book To Start With C
The C Programming Language
Gray Hat C#
Violent Python +Not Covering Python3
Windows Internals Series +Advanced, Needs Development Skills. Reference Book
*OS Internals +Advanced, Needs Development Skills. Reference book
Computer Science Fundamentals Free Courses +Free Online Equivalent Of CS Bachelor Degree!
CS Video Courses +Similar To Above
Black Hat Rust
Basic Hacking/ Pentest/exploitation
Penetration Testing: A Hands-On Introduction to Hacking
Breaking into Information Security
Gray Hat Hacking +5th Edition
Attacking Network Protocols
The Shellcoder's Handbook +Old but gold +Exploitation techniques are obsolete. Gives insight
Hacking: The Art of Exploitation 2nd Edition +Lighter book compared to shellcoders Handbook
Red Team Field Manual +2014
Advanced Penetration Testing +2015, Case & story driven guide into pen-tests
The Hackers Playbook 2 +2015
The Hackers Playbook 3 +2018
Hands on Hacking +2020
Windows Security Internals
pwn.college +A series of good tutorials, videos and labs on basic reversing & exploitation
Network & VoIP
Hacking Exposed Cisco +2005. Old But Still Relevant & Gold
Hacking Exposed Voip +2006, Old But Still Relevant
Hacking Exposed Uc & Voip +2013, More Up2date Of Previous Book
Hacking Exposed Wireless 3rd Edition +2015, Slightly Outdated But Still Good Overview
Security Testing With Raspberry Pi +2020
Recommended
Web
The Web Application Hacker's Handbook +2nd Edition
PortSwigger +Practice Labs
Browser Hacker's Handbook
Tangled Web
Silence on the Wire: A Field Guide to Passive Reconnaissance and Indirect Attacks
Real World Bug Hunting
Web Application Security: Exploitation and Countermeasures for Modern Web Applications
JavaScript For Hackers
Must Read
Mobile (Application)
Android Hacker's Handbook
iOS Hackers Handbook
Mobile Application Hackers Handbook
Frida Handbook
Android Security Internals
iOS Application Security
Android Security Free Course Sponsored By Google
Recommended
Code Audit
The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities
Art of Software Security Testing, The: Identifying Software Security Flaws
OWASP Core Review Guide v2
Modern Memory Safety: C/C++ Vulnerability Discovery, Exploitation, Hardening +Training Material
SonarSource static code analysis +reference of common dangerous APIs in different languages
Fortify Taxonomy +Software Security Errors
LiveOverflow +CTF YouTube channel +live code audit videos, great resource!
SCI CERT Coding Standards
C Traps & Pitfalls
C Programming FAQs
Vulnerabilities 1001 +C-Family Software Implementation Vulnerabilities
OWASP Source Code Analysis Tools +list of ALL tools, most suck!
FindSecurityBugs Java Bugs Patterns
Recurity Labs Code Audit Training
Learn about SemGrep and how to write queries for it!
Learn about CodeQL and how to write queries for it!
Secure Coding in C and C++
Recommended
Reversing Engineering
Reverse Engineering For Beginners +Great Free Reference
Reversing: Secrets Of Reverse Engineering
Practical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, and Obfuscation
Practical Binary Analysis: Build Your Own Linux Tools For Binary Instrumentation, Analysis, And Disassembly
The IDA Pro Book +2nd Edition
The Ghidra Book +Upcoming
Getting Started With Ghidra
Best Assembly Reference Free Book
Ghidra Software Reverse Engineering For Beginners
Essential Skills For Aspiring Reverse Engineers
ARM Assembly Internals and Reverse Engineering
Malware
Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software
Malware Data Science
Rootkits & Bootkits
The Art of Memory Forensics
The Art of Mac Malware: Analysis
Evading EDR: The Definitive Guide to Defeating Endpoint Detection Systems
Mastering Malware Analysis 2nd Edition
Evasive Malware
Practical Threat Detection Engineering
Recommended
Fuzzing
Fuzzing: Brute Force Vulnerability Discovery +Old But Still Relevant
The Art Of Fuzzing +Ramin Farajpour's Fuzzing Intro Course Notes
Fuzzing Against The Machine
The Fuzzing Book
Fuzzing For Software Security Testing And Quality Assurance +2nd Edition
Secfigo's Awesome Fuzzing +List Of Fuzzing Books, Papers, Resources
Cpuu's Awesome Fuzzing +Good Academic Papers List
Brandon Falk +Lots Of Podcasts And Live Sessions About Advanced Fuzzing
Cryptography
Serious Cryptography
Practical Cryptography
Recommended
Hardware
The Hardware Hacking Handbook
Practical IoT Hacking
Hardware Security: A Hands-on Learning Approach
Hardware Hacking Methodology
Recommended
Cloud
Practical Cloud Security
Building and Automating Penetration Testing Labs in the Cloud: Set up cost-effective hacking environments for learning cloud security on AWS, Azure, and GCP
How to Hack Like a Ghost
Pentesting Azure Applications
Advanced Penetration Testing: Hacking Google Cloud Platform +(GCP)
Mastering Cloud Penetration Testing
AWS Penetration Testing
Hands-On AWS Penetration Testing with Kali
Penetration Testing Azure for Ethical Hackers
Hacking Kubernetes: Threat Driven Analysis and Defense
Cloud Penetration Testing for Red Teamers: Learn how to effectively pentest AWS, Azure, and GCP applications
Radio / SDR
Inside Radio: An Attack And Defense Guide
Both are mandatory. No matter what sub-field you pick in the future, you always need the basics. It might seem like "wasting time" at first, but you are actually building deep foundations rather than shallow knowledge. Skipping these basics might allow you to solve some problems initially, but you won't be able to go further into more complex security issues. You'll wish you had spent more time on your foundations when you have to step back and learn the basics later. Remember, shallow knowledge leads to being average, but a deep understanding makes you a specialist.
The most important book you must read here is "Web Application Hacker's Handbook," and solving PortSwigger labs alongside will improve your skills in web security. Implementing the techniques you've learned from these materials in real-world scenarios can give you a better understanding.
Due to the rising demand for cloud technology, in the near future, you'll find knowledge of cloud security not only helpful but essential. Cloud security is becoming hard to overlook since many businesses need it for their operations.
Programming is one of the most important fundamentals. You can't do much without knowing programming. It empowers you to leverage your knowledge when encountering programs. +Knowing programming concepts and understanding them deeply makes you a better security engineer who can understand what is happening in a system, what the flaws are, and how they can be exploited. +These books are a portal for newcomers to start their journey into programming. Learning Python is recommended. +Python is one of the most popular languages in the cybersecurity world. Whether you want to write scripts, develop tools, or understand POCs or exploits, you'll find Python beneficial.
Working in mobile application security requires knowledge of web security due to their similarities. Knowing programming is also essential for entering this subfield.
Diving through these materials requires a deep understanding of networking. +If you were a network engineer or SOC analyst and want to be a network security engineer, you might find these books helpful. +The suggested materials are old, but most of the network protocols we use today are the same as those from two decades ago, so the books and their concepts are still relevant.
Working in reverse engineering requires extensive knowledge of all the topics mentioned so far. In addition, knowing at least some Assembly language is essential. You must combine reverse engineering with other subfields to make it effective. Learning this makes you a better security engineer. Reverse engineering is also essential for malware analysis and sometimes mobile security and fuzzing.
Most of the mentioned resources are old, and some of the tools they discuss are not relevant at this time. +You'll learn basic concepts of hacking and its jargon, which are essential for entering cybersecurity. +By reading these books, you'll discover more about cybersecurity subfields you might never have heard of. These materials help you find your desired path by giving you enough information about various subfields of the security world.
The most essential aspect of learning code audit is having experience and proficiency in one or more programming languages. Learning code auditing enables you to find bugs and flaws in a program by examining its source code. The mentioned materials are also beneficial for developers to understand how to write more secure programs.
Knowing the basics of cryptography concepts is a must for all security fields. To work effectively in cryptography, you need advanced-level mathematics.
This requires knowledge of embedded systems, reverse engineering, programming, etc., to assess the security of hardware.
You might be thinking, "But I don't have any prior knowledge of computer science. Plus, I haven't taken a computer science degree at university. How can I become a security engineer when I don't have its basic requirements?" The good news is, if you are dedicated enough, you can take online courses and learn what a university would teach you. Of course, a university program takes 3-4 years, but you can acquire essential knowledge in 6 months by learning these things on your own!
 \ No newline at end of file diff --git a/Learn-Security-Materials.md b/Learn-Security-Materials.md index f5b130e..dba0452 100644 --- a/Learn-Security-Materials.md +++ b/Learn-Security-Materials.md @@ -1,172 +1,273 @@ - [ویدیو آشنایی با مسیر ورود به دنیای امنیت سایبری](https://www.youtube.com/live/M6-ELr9FRNY) - -**Free Online Courses & Classes** -- [Open Security Training](https://p.ost2.fyi/) -- [EDX Index of free online Computer Science courses and programms](https://www.edx.org/learn/computer-science) -- - - -**Basic OS & Networking:** -- LPIC-1 [Jadi training materials](https://linux1st.com/) -- [The Linux Command Line 2nd ed.](https://nostarch.com/tlcl2) -- [**Linux Bible 10th Ed.**](https://www.amazon.com/Linux-Bible-Christopher-Negus-dp-1119578884/dp/1119578884/) **(Must-read for beginners as a reference book)** -- [**Network+**](https://www.amazon.com/CompTIA-Network-Guide-Sixth-N10-006-dp-0071848223/dp/0071848223/) **Study guide. (Must-read for beginners.)** -- [Security+](https://www.amazon.com/CompTIA-Security-Certification-Guide-SY0-601-dp-1260464008/dp/1260464008/) Study guide. Basic intro to security. -- [MCSA Windows 10 Study Guide](https://www.amazon.com/dp/1119384966/) -- [MCSA Networking With Win Server 2016](https://www.amazon.com/Exam-70-741-Networking-Windows-Server/dp/0735697426) -- [Microsoft Security-101 Free Courses](https://github.com/microsoft/Security-101) **Great source for learning basic but good-to-know theoretical topics** - -**Basic Programming (for security): [Python recommended]** - -- [**BlackHat Python 2nd Edition**](https://nostarch.com/black-hat-python2E) **(Updated for Python 3)** -- [BlackHat Python](https://www.amazon.com/Black-Hat-Python-Programming-Pentesters/dp/1593275900) (Must-read for beginners, Python 2) -- [GrayHat Python](https://www.amazon.com/Gray-Hat-Python-Programming-Engineers-ebook/dp/B007V2DNEK/ref=sr_1_1?dchild=1&keywords=grayhat+python&qid=1585827699&s=books&sr=1-1) -- [Shell Programming & Bash Scripting](https://www.amazon.co.jp/-/en/Robert-Collins/dp/1540637700) -- [Black Hat Go](https://www.amazon.com/Black-Hat-Go-Programming-Pentesters/dp/1593278659) -- [**Effective C**](https://www.amazon.com/Effective-Introduction-Professional-Robert-Seacord-ebook/dp/B0852NTB2H/) **(Great & light book to start with C)** -- [The C Programming Language](https://www.amazon.se/-/en/Brian-Kernighan/dp/0131103628) -- [Gray Hat C#](https://www.amazon.com/Gray-Hat-Creating-Automating-Security/dp/1593277598/) -- [**Violent Python**](https://www.amazon.com/Violent-Python-Cookbook-Penetration-Engineers/dp/1597499579) **(Not covering Python3)** -- [Windows Internals Series](https://docs.microsoft.com/en-us/sysinternals/learn/windows-internals) (Advanced, needs development skills. Reference book) -- [\*OS Internals](http://newosxbook.com/index.php) [Mac/iOS] (Advanced, needs development skills, Reference book) -- [**Computer Science fundamentals free courses**](https://github.com/ossu/computer-science) (Free online equivalent of CS bachelor degree!) -- [https://github.com/Developer-Y/cs-video-courses](https://github.com/Developer-Y/cs-video-courses#embedded-systems) (similar to above) -- [BlackHat Rust](https://kerkour.com/black-hat-rust) - -**Basic Hacking/Pentest/Exploitation:** - -- [Penetration Testing: A Hands-On Introduction to Hacking](https://www.amazon.com/Penetration-Testing-Hands-Introduction-Hacking-ebook/dp/B00KME7GN8/ref=sr_1_1?dchild=1&keywords=penetration+testing&qid=1585823901&s=books&sr=1-1) -- [Breaking into infosec](https://leanpub.com/ltr101-breaking-into-infosec/) -- [GrayHat Hacking 5th edition](https://www.amazon.com/Gray-Hat-Hacking-Ethical-Handbook-ebook/dp/B07D3J9J4H/ref=sr_1_1?dchild=1&keywords=grayhat+hacking&qid=1585823933&s=books&sr=1-1) -- [Attacking Network Protocols](https://www.amazon.com/Attacking-Network-Protocols-Analysis-Exploitation/dp/1593277504/) -- [Hacking: The Art of Exploitation, 2nd Edition](https://www.amazon.com/Hacking-Art-Exploitation-Jon-Erickson/dp/1593271441) Lighter book compared to shellcoders Handbook -- [Red Team Field Manual](https://www.amazon.co.uk/dp/1494295504/) (2014) -- [Advanced Penetration Testing](https://www.amazon.co.uk/Advanced-Penetration-Testing-Hacking-Networks/dp/1119367689/)(2015, Case & story driven guide into pen-tests) -- [The Hackers Playbook 2](https://www.amazon.co.uk/dp/1512214566/) (2015) -- [The Hackers Playbook 3](https://www.amazon.co.uk/Hacker-Playbook-Practical-Penetration-Testing/dp/1980901759/) (2018) -- [Hands on Hacking](https://www.wiley.com/en-se/Hands+on+Hacking-p-9781119561453) (2020) -- [The Shellcoder's Handbook](https://www.amazon.com/Shellcoders-Handbook-Discovering-Exploiting-Security/dp/047008023X) (Old but gold. Exploitation techniques are obsolete. Gives insight) -- [Windows Security Internals](https://www.amazon.com/dp/1718501986/) -- [PwnCollege](https://pwn.college/) A series of good tutorials, videos and labs on basic reversing & exploitation - -**Network & VoIP: [Most of these are old books, but protocols age well!]** - -- [Hacking Exposed Cisco](https://www.amazon.co.uk/Hacking-Exposed-Cisco-Networks-Solutions/dp/0072259175/) (2005. Old but still relevant & gold) -- [Hacking Exposed VoIP](https://www.amazon.com/Hacking-Exposed-VoIP-Security-Solutions/dp/0072263644) (2006, Old but still relevant) -- [Hacking Exposed UC & VoIP](https://www.amazon.com/Hacking-Exposed-Communications-Security-Solutions/dp/0071798765) (2013, more up2date of previous book) -- [Hacking Exposed Wireless 3rd Ed](https://www.amazon.com/Hacking-Exposed-Wireless-Third-Solutions/dp/0071827633/). (2015, slightly outdated but still good overview) -- [Security Testing with Raspberry Pi](https://www.amazon.com/dp/1072017679/ref=cm_sw_r_cp_apa_i_Kw3pFbQTX5HK7)(2020) -- - -**Web:** - -- [Web Application Hackers Handbook 2nd Edition](https://www.amazon.com/Web-Application-Hackers-Handbook-Exploiting-ebook/dp/B005LVQA9S/ref=sr_1_1?dchild=1&keywords=web+application+hackers+handbook&qid=1585824138&s=books&sr=1-1) -- [Browser Hackers Handbook](https://www.amazon.com/Browser-Hackers-Handbook-Wade-Alcorn/dp/1118662091/ref=dp_rm_title_3) -- [Tangled Web](https://www.amazon.com/Tangled-Web-Securing-Modern-Applications-ebook/dp/B006FZ3UNI/ref=sr_1_1?dchild=1&keywords=tangled+web&qid=1585825076&s=books&sr=1-1) -- [Silence on the Wire: A Field Guide to Passive Reconnaissance and Indirect Attacks](https://www.amazon.com/Silence-Wire-Passive-Reconnaissance-Indirect-ebook/dp/B008FRNHVY/ref=pd_sim_351_2/132-4739914-1656761?_encoding=UTF8&pd_rd_i=B008FRNHVY&pd_rd_r=7af4ed8e-205e-4c4a-9c88-f6d6ed0eae98&pd_rd_w=5vNYV&pd_rd_wg=ovx5d&pf_rd_p=bab57536-7c8f-4781-a8ed-3e270b9cd303&pf_rd_r=K3DE7F4PF83RP6FJWBPH&psc=1&refRID=K3DE7F4PF83RP6FJWBPH) -- [Real World Bug Hunting](https://www.amazon.com/Real-World-Bug-Hunting-Field-Hacking/dp/1593278616/) --[Web Application Security: Exploitation and Countermeasures for Modern Web Applications](https://www.amazon.com/dp/1098143930) -- [JavaScript For Hackers](https://leanpub.com/javascriptforhackers) - -**Mobile (applications):** - -- [Android Hackers Handbook](https://www.amazon.com/Android-Hackers-Handbook-Joshua-Drake/dp/111860864X/ref=sr_1_5?dchild=1&keywords=application+hackers+handbook&qid=1585827784&s=books&sr=1-5) -- [Android Security Internals](https://www.amazon.com/Android-Security-Internals-Depth-Architecture-ebook/dp/B00P8DRZWA/ref=pd_sim_ebk_14_1/132-4739914-1656761?_encoding=UTF8&pd_rd_i=B00P8DRZWA&pd_rd_r=016875f9-bf64-4aae-8a21-2a34f792823b&pd_rd_w=ousqy&pd_rd_wg=BXMWR&pf_rd_p=dc5f8131-4953-4e94-b701-14887e2f8999&pf_rd_r=RE1XAMK6DS06W1BCY0PG&psc=1&refRID=RE1XAMK6DS06W1BCY0PG) -- [iOS Application Security](https://www.amazon.com/iOS-Application-Security-Definitive-Developers-ebook/dp/B01BLVZ3IK/ref=pd_sim_351_2/132-4739914-1656761?_encoding=UTF8&pd_rd_i=B01BLVZ3IK&pd_rd_r=afcdd8be-7855-420f-9674-81d3b711c430&pd_rd_w=mO8bw&pd_rd_wg=unNtf&pf_rd_p=bab57536-7c8f-4781-a8ed-3e270b9cd303&pf_rd_r=ATDGZE2ZYC3W7A5AFM3D&psc=1&refRID=ATDGZE2ZYC3W7A5AFM3D) -- [iOS Hackers Handbook](https://www.amazon.com/iOS-Hackers-Handbook-Charlie-Miller-ebook/dp/B00888KNL2/ref=pd_sim_ebk_14_2/132-4739914-1656761?_encoding=UTF8&pd_rd_i=B00888KNL2&pd_rd_r=016875f9-bf64-4aae-8a21-2a34f792823b&pd_rd_w=ousqy&pd_rd_wg=BXMWR&pf_rd_p=dc5f8131-4953-4e94-b701-14887e2f8999&pf_rd_r=RE1XAMK6DS06W1BCY0PG&psc=1&refRID=RE1XAMK6DS06W1BCY0PG) -- [Mobile Application Hackers Handbook](https://www.amazon.com/Mobile-Application-Hackers-Handbook/dp/1118958500/ref=dp_rm_img_1) -- [FRIDA Handbook](https://learnfrida.info/) *must-read* -- [Android Security free course sponsored by Google](https://app.hextree.io/map/android) - -**Code Audit:** - -- [The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities](https://www.amazon.com/Art-Software-Security-Assessment-Vulnerabilities-ebook/dp/B004XVIWU2/ref=sr_1_1?crid=1ILVYQ2YOZME8&dchild=1&keywords=art+of+software+security+assessment&qid=1585821139&s=digital-text&sprefix=art+of+softwa%2Cdigital-text%2C225&sr=1-1) -- [Art of Software Security Testing, The: Identifying Software Security Flaws](https://www.amazon.com/Art-Software-Security-Testing-Identifying/dp/0321304861) -- [OWASP Core Review Guide v2](https://www.owasp.org/images/5/53/OWASP_Code_Review_Guide_v2.pdf) -- [Modern Memory Safety: C/C++ Vulnerability Discovery, Exploitation, Hardening (Training Material)](https://github.com/struct/mms) -- [https://rules.sonarsource.com/](https://rules.sonarsource.com/) (reference of common dangerous APIs in different languages) -- [https://vulncat.fortify.com/en](https://vulncat.fortify.com/en) -- [LiveOverflow](https://www.youtube.com/c/LiveOverflowCTF) YouTube channel (live code audit videos), great resource! -- [SCI CERT Coding Standards](https://wiki.sei.cmu.edu/confluence/display/c/SEI+CERT+C+Coding+Standard) -- [C Traps & Pitfalls](http://literateprogramming.com/ctraps.pdf) -- [http://c-faq.com/](http://c-faq.com/) -- Vulnerabilities 1001: [C-Family Software Implementation Vulnerabilities](https://p.ost2.fyi/courses/course-v1:OpenSecurityTraining2+Vulns1001_C-derived+2022_v1/about) -- [https://owasp.org/www-community/Source\_Code\_Analysis\_Tools](https://owasp.org/www-community/Source_Code_Analysis_Tools) list of ALL tools (most suck!) -- FindSecurityBugs [Java Bugs Patterns](https://find-sec-bugs.github.io/bugs.htm) -- [ Recurity Labs Code Audit Training](https://code-audit-training.gitlab.io/) -- Learn about [SemGrep](https://semgrep.dev/docs/getting-started/) and how to write queries for it! -- Learn about [CodeQL](https://codeql.github.com/docs/codeql-cli/getting-started-with-the-codeql-cli/) and how to write queries for it! -- [Secure Coding in C and C++](https://www.amazon.se/-/en/Robert-Seacord/dp/0321822137) -- - -**Reversing:** - -- [Practical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, ...](https://www.amazon.com/Practical-Reverse-Engineering-Reversing-Obfuscation-ebook/dp/B00IA22R2Y/ref=sr_1_3?dchild=1&keywords=reverse+engineering&qid=1585820697&s=digital-text&sr=1-3) -- [Practical Binary Analysis: Build Your Own Linux Tools for Binary Instrumentation, ...](https://www.amazon.com/Practical-Binary-Analysis-Instrumentation-Disassembly-ebook/dp/B07BPKWJVT/ref=pd_sim_351_4/132-4739914-1656761?_encoding=UTF8&pd_rd_i=B07BPKWJVT&pd_rd_r=b4ef5f2b-0d4d-444b-aa73-484e65182f24&pd_rd_w=OCyY0&pd_rd_wg=TQ21N&pf_rd_p=bab57536-7c8f-4781-a8ed-3e270b9cd303&pf_rd_r=7YY83Z4WY39XX05FDQ1W&psc=1&refRID=7YY83Z4WY39XX05FDQ1W) -- [The IDA Pro Book, 2nd Edition](https://www.amazon.com/IDA-Pro-Book-2nd-ebook/dp/B005EI84TM/ref=pd_sim_351_3/132-4739914-1656761?_encoding=UTF8&pd_rd_i=B005EI84TM&pd_rd_r=b4ef5f2b-0d4d-444b-aa73-484e65182f24&pd_rd_w=OCyY0&pd_rd_wg=TQ21N&pf_rd_p=bab57536-7c8f-4781-a8ed-3e270b9cd303&pf_rd_r=7YY83Z4WY39XX05FDQ1W&psc=1&refRID=7YY83Z4WY39XX05FDQ1W) -- [The Ghidra Book (upcoming)](https://nostarch.com/GhidraBook) -- [Getting Started with Ghidra](https://www.oreilly.com/library/view/getting-started-with/9781098115265/) -- [Reversing: Secrets of Reverse Engineering](https://www.amazon.com/Reversing-Secrets-Engineering-Eldad-Eilam-ebook/dp/B007032XZK/ref=pd_sim_351_3/132-4739914-1656761?_encoding=UTF8&pd_rd_i=B007032XZK&pd_rd_r=1a048edf-5ef5-4ccf-bd40-d04f2f57ffb3&pd_rd_w=e437a&pd_rd_wg=Myaz1&pf_rd_p=bab57536-7c8f-4781-a8ed-3e270b9cd303&pf_rd_r=ZC5VJ6NGVHJVN4BXY6JX&psc=1&refRID=ZC5VJ6NGVHJVN4BXY6JX) -- [Reverse Engineering for Beginners ( great free reference)](https://beginners.re/) -- [Best Assembly reference (free) book](http://www.plantation-productions.com/Webster/) -- [Ghidra Software Reverse Engineering for Beginners](https://www.amazon.com/dp/1800207972/) -- [Essential Skills for Aspiring Reverse Engineers](https://reverencecyber.com/decoding-the-craft-essential-skills-for-aspiring-reverse-engineers/) -- [ARM Assembnly Internals and Reverse Engineering](https://www.amazon.com/Blue-Fox-Assembly-Internals-Analysis/dp/1119745306) - -**Malware** : - -- [Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software](https://www.amazon.com/gp/product/1593272901/ref=dbs_a_def_rwt_bibl_vppi_i0) -- [Malware Data Science](https://www.amazon.com/Malware-Data-Science-Detection-Attribution-ebook/dp/B077X1V9SY/) -- [Rootkits & Bootkits](https://www.amazon.com/Rootkits-Bootkits-Reversing-Malware-Generation-ebook/dp/B07P8J5HZJ/) -- [The Art of Memory Forensics](https://www.amazon.com/Art-Memory-Forensics-Detecting-Malware-ebook/dp/B00JUUZSQC/) -- [The Art of Mac Malware: Analysis](https://taomm.org/vol1/) -- [Evading EDR: The Definitive Guide to Defeating Endpoint Detection Systems](https://www.amazon.com/dp/1718503342) -- [Mastering Malware Analysis](https://www.amazon.com/Mastering-Malware-Analysis-practical-cybercrime/dp/1803240245/) -- [Evasive Malware](https://www.amazon.com/Evasive-Malware-Understanding-Deceptive-Self-Defending/dp/1718503261) -- [Evading EDR](https://www.amazon.com/dp/1718503342) -- [Practical Threat Detection Engineering](https://www.amazon.com/dp/1801076715/) - -**Fuzzing:** - -- [Fuzzing: Brute Force Vulnerability Discovery](https://www.amazon.com/Fuzzing-Brute-Force-Vulnerability-Discovery-ebook/dp/B0031AI0V2/ref=sr_1_1?dchild=1&keywords=fuzzing&qid=1585824686&s=digital-text&sr=1-1) (old but still relevant) -- [Fuzzing for Software Security Testing and Quality Assurance, Second Edition](https://www.amazon.com/Fuzzing-Software-Security-Testing-Assurance-ebook/dp/B07BHVSXNK/ref=sr_1_2?dchild=1&keywords=fuzzing&qid=1585824686&s=digital-text&sr=1-2) -- [https://github.com/secfigo/Awesome-Fuzzing](https://github.com/secfigo/Awesome-Fuzzing) (list of fuzzing books, papers, resources) -- [https://github.com/cpuu/awesome-fuzzing](https://github.com/cpuu/awesome-fuzzing) (good academic papers list) -- [Brandon Falk](https://twitter.com/gamozolabs) (Lots of podcasts and live sessions about advanced fuzzing) -- [https://github.com/raminfp/the-art-of-fuzzing] (Ramin Farajpour's Fuzzing intro course notes) -- [Fuzzing Against the Machine](https://www.amazon.com/Fuzzing-Against-Machine-Automate-vulnerability/dp/1804614971) -- [The Fuzzing Book](https://www.fuzzingbook.org/) - - -**Cryptography:** - -- [Serious Cryptography](https://www.amazon.com/Serious-Cryptography-Practical-Introduction-Encryption-ebook/dp/B0722MTGQV/ref=sr_1_1?dchild=1&keywords=serious+cryptography&qid=1585827498&s=books&sr=1-1) -- [Practical Cryptography](https://www.amazon.com/Practical-Cryptography-Niels-Ferguson/dp/0471223573/ref=sr_1_1?dchild=1&keywords=practical+cryptography&qid=1585827558&s=books&sr=1-1) -- - -**Hardware** : - -- [Hardware Security: A Hands-on Learning Approach](https://www.amazon.com/Hardware-Security-Hands-Learning-Approach-dp-0128124776/dp/0128124776/) -- [The Hardware Hacking Handbook](https://nostarch.com/hardwarehacking) -- [Practical IoT Hacking](https://www.amazon.com/Practical-IoT-Hacking-Fotios-Chantzis-ebook/dp/B085BVVSN6) -- [Hardware Hacking Methodology](https://github.com/koutto/hardware-hacking/tree/master) -- - -**Cloud** : - -- [Practical Cloud Security](https://www.oreilly.com/library/view/practical-cloud-security/9781492037507/) -- [How to Hack Like a Ghost](https://www.amazon.com/dp/1718501269/) -- [Pentesting Azure Applications](https://www.amazon.com/Pentesting-Azure-Applications-Definitive-Deployments/dp/1593278632/) -- [Advanced Penetration Testing: Hacking Google Cloud Platform (GCP)](https://www.amazon.com/Advanced-Penetration-Testing-Hacking-Platform/dp/B08P1H4KLZ) -- [Mastering Cloud Penetration Testing](https://www.amazon.com/Mastering-Cloud-Penetration-Testing-Sehgal/dp/1786461234) -- [AWS Penetration Testing](https://www.amazon.com/AWS-Penetration-Testing-Beginners-Metasploit/dp/1839216921) -- [Hands-On AWS Penetration Testing with Kali](https://www.amazon.com/Hands-Penetration-Testing-Kali-Linux/dp/1789136725) -- [Penetration Testing Azure for Ethical Hackers](https://www.amazon.com/Penetration-Testing-Azure-Ethical-Hackers/dp/1839212934) -- [Hacking Kubernets, Threat Driven Analysis](https://www.amazon.com/Hacking-Kubernetes-Threat-Driven-Analysis-Defense/dp/1492081736) -- [Cloud Penetration Testing for Red Teamers: Learn how to effectively pentest AWS, Azure, and GCP applications](https://www.amazon.com/dp/1803248483) -- [Building and Automating Penetration Testing Labs in the Cloud: Set up cost-effective hacking environments for learning cloud security on AWS, Azure, and GCP](https://www.amazon.com/Building-Automating-Penetration-Testing-Cloud/dp/1837632391) - -**Radio / SDR:** - -- [Inside Radio](https://www.amazon.com/Inside-Radio-Qing-Yang/dp/9811084467/) -- +# Cybersecurity Materials + +**[ویدیو آشنایی با مسیر ورود به دنیای امنیت سایبری](https://www.youtube.com/live/M6-ELr9FRNY)** + +## Free Online Courses & Classes + +- **[Open Security Training](https://p.ost2.fyi/)** + +- **[EDX](https://www.edx.org/learn/computer-science)** Index of free online Computer Science courses and programs + +- **[Computer Science Fundamentals Free Courses](https://github.com/ossu/computer-science)** Free Online Equivalent Of CS Bachelor Degree! + +## Basic OS & Networking + +- **[Network+](https://www.amazon.com/CompTIA-Network-Guide-Sixth-N10-006-dp-0071848223/dp/0071848223/ )** + +- **[Linux Bible 10th Edition](https://www.amazon.com/Linux-Bible-Christopher-Negus-dp-1119578884/dp/1119578884/ )** + +- **[Security+ ](https://www.amazon.com/CompTIA-Security-Certification-Guide-SY0-601-dp-1260464008/dp/1260464008/)** + +- **[Microsoft Security-101 Free Courses](https://github.com/microsoft/Security-101)** Great source for learning basic but good-to-know theoretical topics + +- **[LPIC-1](https://linux1st.com/)** Jadi's training materials + +- **[The Linux Command Line, 2nd Edition](https://nostarch.com/tlcl2)** + +- **[MCSA Windows 10 Study Guide](https://www.amazon.com/dp/1119384966/)** + +- **[MCSA Networking With Win Server 2016](https://www.amazon.com/Exam-70-741-Networking-Windows-Server/dp/0735697426)** + +## Basic Programming + +- **[Black Hat Python, 1st Edition](https://www.amazon.com/Black-Hat-Python-Programming-Pentesters/dp/1593275900 )** Must-read for beginners, Python 2 + +- **[Black Hat Python, 2nd Edition](https://nostarch.com/black-hat-python2E )** Updated for Python 3 + +- **[Gray Hat Python](https://www.amazon.com/Gray-Hat-Python-Programming-Engineers-ebook/dp/B007V2DNEK/ref=sr_1_1?dchild=1&keywords=grayhat+python&qid=1585827699&s=books&sr=1-1)** + +- **[Shell Programming & Bash Scripting](https://www.amazon.com/Robert-Collins/dp/1540637700)** + +- **[Black Hat Go](https://www.amazon.com/Black-Hat-Go-Programming-Pentesters/dp/1593278659)** + +- **[Effective C](https://www.amazon.com/Effective-Introduction-Professional-Robert-Seacord-ebook/dp/B0852NTB2H/ )** Great & light book to start with C + +- **[The C Programming Language](https://www.amazon.com/Brian-Kernighan/dp/0131103628)** + +- **[Gray Hat C#](https://www.amazon.com/Gray-Hat-Creating-Automating-Security/dp/1593277598/)** + +- **[Violent Python](https://www.amazon.com/Violent-Python-Cookbook-Penetration-Engineers/dp/1597499579 )** Not covering Python3 + +- **[Windows Internals Series](https://learn.microsoft.com/en-us/sysinternals/resources/windows-internals)** Advanced, needs development skills. Reference book + +- **[*OS Internals](https://newosxbook.com/home.html)** Advanced, Needs Development Skills. Reference book + +- **[Computer Science Fundamentals Free Courses](https://github.com/ossu/computer-science )** Free Online Equivalent Of CS Bachelor Degree! + +- **[CS Video Courses ](https://github.com/Developer-Y/cs-video-courses)** Similar To Above + +- **[Black Hat Rust](https://kerkour.com/black-hat-rust)** + +## Basic Hacking/ Pentest/Exploitation + +- **[Penetration Testing: A Hands-On Introduction to Hacking](https://www.amazon.com/Penetration-Testing-Hands-Introduction-Hacking-ebook/dp/B00KME7GN8/ref=sr_1_1?dchild=1&keywords=penetration+testing&qid=1585823901&s=books&sr=1-1)** + +- **[Breaking into Information Security](https://leanpub.com/ltr101-breaking-into-infosec/)** + +- **[Gray Hat Hacking, 5th Edition](https://www.amazon.com/Gray-Hat-Hacking-Ethical-Handbook-ebook/dp/B07D3J9J4H/ref=sr_1_1?dchild=1&keywords=grayhat+hacking&qid=1585823933&s=books&sr=1-1)** + +- **[Attacking Network Protocols](https://www.amazon.com/Attacking-Network-Protocols-Analysis-Exploitation/dp/1593277504/)** + +- **[The Shellcoder's Handbook](https://www.amazon.com/Shellcoders-Handbook-Discovering-Exploiting-Security/dp/047008023X )** Old but gold. Exploitation techniques are obsolete. Gives insight + +- **[Hacking: The Art of Exploitation, 2nd Edition](https://www.amazon.com/Hacking-Art-Exploitation-Jon-Erickson/dp/1593271441 )** Lighter book compared to shellcoders Handbook + +- **[Red Team Field Manual](https://www.amazon.com/dp/1494295504/ )** 2014 +- **[Advanced Penetration Testing](https://www.amazon.com/Advanced-Penetration-Testing-Hacking-Networks/dp/1119367689/)** 2015, Case & story driven guide into pen-tests + +- **[The Hackers Playbook 2](https://www.amazon.com/dp/1512214566/ )** 2015 + +- **[The Hackers Playbook 3](https://www.amazon.com/Hacker-Playbook-Practical-Penetration-Testing/dp/1980901759/ )** 2018 + +- **[Hands on Hacking](https://www.wiley.com/en-se/Hands+on+Hacking-p-9781119561453 )** 2020 + +- **[Windows Security Internals](https://www.amazon.com/dp/1718501986/)** + +- **[pwn.college](https://pwn.college/ )** A series of good tutorials, videos and labs on basic reversing & exploitation + +## Network & VoIP + +- **[Hacking Exposed Cisco](https://www.amazon.com/Hacking-Exposed-Cisco-Networks-Solutions/dp/0072259175/ )** 2005. Old but still relevant & gold + +- **[Hacking Exposed VoIP](https://www.amazon.com/Hacking-Exposed-VoIP-Security-Solutions/dp/0072263644 )** 2006, Old but still relevant + +- **[Hacking Exposed UC & VoIP](https://www.amazon.com/Hacking-Exposed-Communications-Security-Solutions/dp/0071798765 )** 2013, more up2date of previous book + +- **[Hacking Exposed Wireless, 3rd Edition](https://www.amazon.com/Hacking-Exposed-Wireless-Third-Solutions/dp/0071827633/)** 2015, slightly outdated but still good overview + +- **[Security Testing with Raspberry Pi](https://www.amazon.com/dp/1072017679/ref=cm_sw_r_cp_apa_i_Kw3pFbQTX5HK7)** 2020 + +## Web + +- **[The Web Application Hacker's Handbook, 2nd Edition](https://www.amazon.com/Web-Application-Hackers-Handbook-Exploiting-ebook/dp/B005LVQA9S/ref=sr_1_1?dchild=1&keywords=web+application+hackers+handbook&qid=1585824138&s=books&sr=1-1)** + +- **[PortSwigger](https://portswigger.net/web-security)** Practice Labs + +- **[Browser Hacker's Handbook](https://www.amazon.com/Browser-Hackers-Handbook-Wade-Alcorn/dp/1118662091/ref=dp_rm_title_3)** + +- **[Tangled Web](https://www.amazon.com/Tangled-Web-Securing-Modern-Applications-ebook/dp/B006FZ3UNI/ref=sr_1_1?dchild=1&keywords=tangled+web&qid=1585825076&s=books&sr=1-1)** + +- **[Silence on the Wire: A Field Guide to Passive Reconnaissance and Indirect Attacks](https://www.amazon.com/Silence-Wire-Passive-Reconnaissance-Indirect-ebook/dp/B008FRNHVY/ref=pd_sim_351_2/132-4739914-1656761?_encoding=UTF8&pd_rd_i=B008FRNHVY&pd_rd_r=7af4ed8e-205e-4c4a-9c88-f6d6ed0eae98&pd_rd_w=5vNYV&pd_rd_wg=ovx5d&pf_rd_p=bab57536-7c8f-4781-a8ed-3e270b9cd303&pf_rd_r=K3DE7F4PF83RP6FJWBPH&psc=1&refRID=K3DE7F4PF83RP6FJWBPH)** + +- **[Real World Bug Hunting](https://www.amazon.com/Real-World-Bug-Hunting-Field-Hacking/dp/1593278616/)** + +- **[Web Application Security: Exploitation and Countermeasures for Modern Web Applications](https://www.amazon.com/dp/1098143930)** + +- **[JavaScript For Hackers](https://leanpub.com/javascriptforhackers)** + +## Mobile (application) + +- **[Android Hacker's Handbook](https://www.amazon.com/Android-Hackers-Handbook-Joshua-Drake/dp/111860864X/ref=sr_1_5?dchild=1&keywords=application+hackers+handbook&qid=1585827784&s=books&sr=1-5)** + +- **[iOS Hackers Handbook](https://www.amazon.com/iOS-Hackers-Handbook-Charlie-Miller-ebook/dp/B00888KNL2/ref=pd_sim_ebk_14_2/132-4739914-1656761?_encoding=UTF8&pd_rd_i=B00888KNL2&pd_rd_r=016875f9-bf64-4aae-8a21-2a34f792823b&pd_rd_w=ousqy&pd_rd_wg=BXMWR&pf_rd_p=dc5f8131-4953-4e94-b701-14887e2f8999&pf_rd_r=RE1XAMK6DS06W1BCY0PG&psc=1&refRID=RE1XAMK6DS06W1BCY0PG)** + +- **[Mobile Application Hackers Handbook](https://www.amazon.com/Mobile-Application-Hackers-Handbook/dp/1118958500/ref=dp_rm_img_1)** + +- **[FRIDA Handbook](https://learnfrida.info/)** Must read + +- **[Android Security Internals](https://www.amazon.com/Android-Security-Internals-Depth-Architecture-ebook/dp/B00P8DRZWA/ref=pd_sim_ebk_14_1/132-4739914-1656761?_encoding=UTF8&pd_rd_i=B00P8DRZWA&pd_rd_r=016875f9-bf64-4aae-8a21-2a34f792823b&pd_rd_w=ousqy&pd_rd_wg=BXMWR&pf_rd_p=dc5f8131-4953-4e94-b701-14887e2f8999&pf_rd_r=RE1XAMK6DS06W1BCY0PG&psc=1&refRID=RE1XAMK6DS06W1BCY0PG)** + +- **[iOS Application Security](https://www.amazon.com/iOS-Application-Security-Definitive-Developers-ebook/dp/B01BLVZ3IK/ref=pd_sim_351_2/132-4739914-1656761?_encoding=UTF8&pd_rd_i=B01BLVZ3IK&pd_rd_r=afcdd8be-7855-420f-9674-81d3b711c430&pd_rd_w=mO8bw&pd_rd_wg=unNtf&pf_rd_p=bab57536-7c8f-4781-a8ed-3e270b9cd303&pf_rd_r=ATDGZE2ZYC3W7A5AFM3D&psc=1&refRID=ATDGZE2ZYC3W7A5AFM3D)** + +- **[Android Security free course sponsored by Google](https://app.hextree.io/map/android)** + +## Code Audit + +- **[The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities](https://www.amazon.com/Art-Software-Security-Assessment-Vulnerabilities-ebook/dp/B004XVIWU2/ref=sr_1_1?crid=1ILVYQ2YOZME8&dchild=1&keywords=art+of+software+security+assessment&qid=1585821139&s=digital-text&sprefix=art+of+softwa%2Cdigital-text%2C225&sr=1-1)** + +- **[Art of Software Security Testing, The: Identifying Software Security Flaws](https://www.amazon.com/Art-Software-Security-Testing-Identifying/dp/0321304861)** + +- **[OWASP Core Review Guide v2](https://owasp.org/www-project-code-review-guide/assets/OWASP_Code_Review_Guide_v2.pdf)** + +- **[Modern Memory Safety: C/C++ Vulnerability Discovery, Exploitation, Hardening ](https://github.com/struct/mms)** Training Material + +- **[SonarSource static code analysis](https://rules.sonarsource.com/)** reference of common dangerous APIs in different languages + +- **[Fortify Taxonomy](https://vulncat.fortify.com/en)** Software Security Errors + +- **[LiveOverflow](https://www.youtube.com/c/LiveOverflow)** CTF YouTube channel live code audit videos, great resource! + +- **[SCI CERT Coding Standards](https://wiki.sei.cmu.edu/confluence/display/c/SEI+CERT+C+Coding+Standard)** + +- **[C Traps & Pitfalls](http://literateprogramming.com/ctraps.pdf)** + +- **[C Programming FAQs](http://c-faq.com/)** + +- **[Vulnerabilities 1001](https://p.ost2.fyi/courses/course-v1:OpenSecurityTraining2+Vulns1001_C-derived+2022_v1/about)** C-Family Software Implementation Vulnerabilities + +- **[OWASP Source Code Analysis Tools](https://owasp.org/www-community/Source_Code_Analysis_Tools)** list of ALL tools, most suck! + +- **[FindSecurityBugs Java Bugs Patterns](https://find-sec-bugs.github.io/bugs.htm)** + +- **[Recurity Labs Code Audit Training](https://code-audit-training.gitlab.io/)** + +- **[Learn about SemGrep and how to write queries for it!](https://semgrep.dev/docs/getting-started/)** + +- **[Learn about CodeQL and how to write queries for it!](https://codeql.github.com/docs/codeql-cli/getting-started-with-the-codeql-cli/)** + +- **[Secure Coding in C and C++](https://www.amazon.com/Robert-Seacord/dp/0321822137)** + +## Reversing Engineering + +- **[Reverse Engineering for Beginners](https://beginners.re/)** great free reference + +- **[Reversing: Secrets of Reverse Engineering](https://www.amazon.com/Reversing-Secrets-Engineering-Eldad-Eilam-ebook/dp/B007032XZK/ref=pd_sim_351_3/132-4739914-1656761?_encoding=UTF8&pd_rd_i=B007032XZK&pd_rd_r=1a048edf-5ef5-4ccf-bd40-d04f2f57ffb3&pd_rd_w=e437a&pd_rd_wg=Myaz1&pf_rd_p=bab57536-7c8f-4781-a8ed-3e270b9cd303&pf_rd_r=ZC5VJ6NGVHJVN4BXY6JX&psc=1&refRID=ZC5VJ6NGVHJVN4BXY6JX)** + +- **[Practical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, and Obfuscation ](https://www.amazon.com/Practical-Reverse-Engineering-Reversing-Obfuscation-ebook/dp/B00IA22R2Y/ref=sr_1_3?dchild=1&keywords=reverse+engineering&qid=1585820697&s=digital-text&sr=1-3)** + +- **[Practical Binary Analysis: Build Your Own Linux Tools for Binary Instrumentation, Analysis, and Disassembly ](https://www.amazon.com/Practical-Binary-Analysis-Instrumentation-Disassembly-ebook/dp/B07BPKWJVT/ref=pd_sim_351_4/132-4739914-1656761?_encoding=UTF8&pd_rd_i=B07BPKWJVT&pd_rd_r=b4ef5f2b-0d4d-444b-aa73-484e65182f24&pd_rd_w=OCyY0&pd_rd_wg=TQ21N&pf_rd_p=bab57536-7c8f-4781-a8ed-3e270b9cd303&pf_rd_r=7YY83Z4WY39XX05FDQ1W&psc=1&refRID=7YY83Z4WY39XX05FDQ1W)** + +- **[The IDA Pro Book, 2nd Edition](https://www.amazon.com/IDA-Pro-Book-2nd-ebook/dp/B005EI84TM/ref=pd_sim_351_3/132-4739914-1656761?_encoding=UTF8&pd_rd_i=B005EI84TM&pd_rd_r=b4ef5f2b-0d4d-444b-aa73-484e65182f24&pd_rd_w=OCyY0&pd_rd_wg=TQ21N&pf_rd_p=bab57536-7c8f-4781-a8ed-3e270b9cd303&pf_rd_r=7YY83Z4WY39XX05FDQ1W&psc=1&refRID=7YY83Z4WY39XX05FDQ1W)** + +- **[The Ghidra Book](https://nostarch.com/GhidraBook)** upcoming + +- **[Getting Started with Ghidra](https://www.oreilly.com/library/view/getting-started-with/9781098115265/)** + +- **[Best Assembly reference free book](http://www.plantation-productions.com/Webster/)** + +- **[Ghidra Software Reverse Engineering for Beginners](https://www.amazon.com/dp/1800207972/)** + +- **[Essential Skills for Aspiring Reverse Engineers](https://reverencecyber.com/decoding-the-craft-essential-skills-for-aspiring-reverse-engineers/)** + +- **[ARM Assembly Internals and Reverse Engineering](https://www.amazon.com/Blue-Fox-Assembly-Internals-Analysis/dp/1119745306)** + +## Malware + +- **[Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software](https://www.amazon.com/gp/product/1593272901/ref=dbs_a_def_rwt_bibl_vppi_i0)** + +- **[Malware Data Science](https://www.amazon.com/Malware-Data-Science-Detection-Attribution-ebook/dp/B077X1V9SY/)** + +- **[Rootkits & Bootkits](https://www.amazon.com/Rootkits-Bootkits-Reversing-Malware-Generation-ebook/dp/B07P8J5HZJ/)** + +- **[The Art of Memory Forensics](https://www.amazon.com/Art-Memory-Forensics-Detecting-Malware-ebook/dp/B00JUUZSQC/)** + +- **[The Art of Mac Malware: Analysis](https://taomm.org/vol1/read.html)** + +- **[Evading EDR: The Definitive Guide to Defeating Endpoint Detection Systems](https://www.amazon.com/dp/1718503342)** + +- **[Mastering Malware Analysis, 2nd Edition](https://www.amazon.com/Mastering-Malware-Analysis-practical-cybercrime/dp/1803240245/)** + +- **[Evasive Malware](https://www.amazon.com/Evasive-Malware-Understanding-Deceptive-Self-Defending/dp/1718503261)** + +- **[Practical Threat Detection Engineering](https://www.amazon.com/dp/1801076715/)** + +## Fuzzing + +- **[Fuzzing: Brute Force Vulnerability Discovery](https://www.amazon.com/Fuzzing-Brute-Force-Vulnerability-Discovery/dp/0321446119)** old but still relevant + +- **[The art of fuzzing](https://github.com/raminfp/the-art-of-fuzzing )** Ramin Farajpour's Fuzzing intro course notes + +- **[Fuzzing Against the Machine](https://www.amazon.com/Fuzzing-Against-Machine-Automate-vulnerability/dp/1804614971)** + +- **[The Fuzzing Book](https://www.fuzzingbook.org/)** + +- **[Fuzzing for Software Security Testing and Quality Assurance, 2nd Edition](https://www.amazon.com/Fuzzing-Software-Security-Testing-Assurance-ebook/dp/B07BHVSXNK/)** + +- **[secfigo's Awesome Fuzzing](https://github.com/secfigo/Awesome-Fuzzing)** list of fuzzing books, papers, resources + +- **[cpuu's awesome fuzzing](https://github.com/cpuu/awesome-fuzzing)** good academic papers list + +- **[Brandon Falk](https://twitter.com/gamozolabs )** Lots of podcasts and live sessions about advanced fuzzing + +## Cryptography +- **[Serious Cryptography](https://www.amazon.com/Serious-Cryptography-Practical-Introduction-Encryption-ebook/dp/B0722MTGQV)** + +- **[Practical Cryptography](https://www.amazon.com/Practical-Cryptography-Niels-Ferguson/dp/0471223573)** + +## Hardware + +- **[The Hardware Hacking Handbook](https://nostarch.com/hardwarehacking)** + +- **[Practical IoT Hacking](https://www.amazon.com/Practical-IoT-Hacking-Fotios-Chantzis-ebook/dp/B085BVVSN6)** + +- **[Hardware Security: A Hands-on Learning Approach](https://www.amazon.com/Hardware-Security-Hands-Learning-Approach-dp-0128124776/dp/0128124776/)** + +- **[Hardware Hacking Methodology](https://github.com/koutto/hardware-hacking)** + +## Cloud + +- **[Practical Cloud Security](https://www.oreilly.com/library/view/practical-cloud-security/9781492037507/)** + +- **[Building and Automating Penetration Testing Labs in the Cloud: Set up cost-effective hacking environments for learning cloud security on AWS, Azure, and GCP](https://www.amazon.com/Building-Automating-Penetration-Testing-Cloud/dp/1837632391)** + +- **[How to Hack Like a Ghost](https://www.amazon.com/dp/1718501269/)** + +- **[Pentesting Azure Applications](https://www.amazon.com/Pentesting-Azure-Applications-Definitive-Deployments/dp/1593278632/)** + +- **[Advanced Penetration Testing: Hacking Google Cloud Platform (GCP)**](https://www.amazon.com/Advanced-Penetration-Testing-Hacking-Platform/dp/B08P1H4KLZ)** + +- **[Mastering Cloud Penetration Testing](https://www.amazon.com/Mastering-Cloud-Penetration-Testing-Sehgal/dp/1786461234)** + +- **[AWS Penetration Testing](https://www.amazon.com/AWS-Penetration-Testing-Beginners-Metasploit/dp/1839216921)** + +- **[Hands-On AWS Penetration Testing with Kali](https://www.amazon.com/Hands-Penetration-Testing-Kali-Linux/dp/1789136725)** + +- **[Penetration Testing Azure for Ethical Hackers](https://www.amazon.com/Penetration-Testing-Azure-Ethical-Hackers/dp/1839212934)** + +- **[Hacking Kubernetes: Threat Driven Analysis and Defense](https://www.amazon.com/Hacking-Kubernetes-Threat-Driven-Analysis-Defense/dp/1492081736)** + +- **[Cloud Penetration Testing for Red Teamers: Learn how to effectively pentest AWS, Azure, and GCP applications](https://www.amazon.com/dp/1803248483)** + +## Radio / SDR + +- **[Inside Radio: An Attack and Defense Guide](https://www.amazon.com/Inside-Radio-Qing-Yang/dp/9811084467/)** \ No newline at end of file