// What to read next
What to read after Alice and Bob Learn Application Security
Where to go after Alice and Bob Learn Application Security, picked from our catalog. The next step up from beginner level, weighted toward the topics this book covers.
01 · 2021
Real-World Cryptography
David Wong's hands-on tour of the cryptographic primitives, protocols and pitfalls that show up in actual production systems, with deliberate attention to TLS, Noise, modern AEAD, and post-quantum.
Intermediate5/5David Wong02 · 2005
Reversing
The book that taught a generation how software actually looks once you strip away the source. Still the clearest on-ramp to thinking in assembly, even with dated tools.
Intermediate4/5Eldad Eilam03 · 2018
Social Engineering
Christopher Hadnagy's broad procedural reference on social engineering as a discipline — recon, pretexting, elicitation, microexpressions, and the structured engagement model his consultancy operationalized.
Intermediate4/5Christopher Hadnagy04 · 2010
Understanding Cryptography
A genuinely teachable intro to modern cryptography that derives the math instead of hand-waving it, covering symmetric and public-key primitives without drowning you in proofs.
Intermediate4/5Christof Paar, Jan Pelzl05 · 2021
Designing Secure Software
Loren Kohnfelder, the original PKI author, on how to weave security thinking through requirements, design, implementation and operations rather than bolt it on at the end.
Intermediate5/5Loren Kohnfelder06 · 2014
Threat Modeling
Adam Shostack's practitioner-oriented introduction to threat modeling: STRIDE, attack trees, and how to fit the practice into a real software-development lifecycle.
Intermediate5/5Adam Shostack07 · 2023
Black Hat GraphQL
Aleks and Farhi on attacking GraphQL specifically: introspection abuse, batching, depth and complexity attacks, auth flaws, and the differences from REST that make GraphQL pentests their own discipline.
Intermediate4/5Nick Aleks, Dolev Farhi08 · 2020
Container Security
Liz Rice's first-principles introduction to how Linux containers actually work — namespaces, cgroups, capabilities, seccomp, image layering — and the security implications that fall out of those mechanics.
Intermediate4/5Liz Rice