// Comparison

Black Hat Bash vs The Ghidra Book: Which Should You Read?

Two cybersecurity books on Tooling, compared honestly: who each is for, what each does best, and which to read first.

Intermediate

4/52024

Creative Scripting for Hackers and Pentesters

Nick Aleks, Dolev Farhi

Nick Aleks and Dolev Farhi on getting offensive work done with the shell: privilege escalation tooling, lateral movement, and pipelining bash with the rest of the toolkit.

Intermediate

4/52020

The Ghidra Book

The Definitive Guide

Chris Eagle, Kara Nance

The reference manual for the NSA's open-source disassembler, written by the author of The IDA Pro Book. Exhaustive on the tool, thinner on the craft of reversing itself.

Read this if

Pentesters and red teamers who land on a Linux box and need to do offensive work with whatever bash is already there. The book covers privilege escalation, lateral movement, log tampering, and the practical recipes that bash actually shines at.

Practitioners switching from IDA or starting on Ghidra who want full coverage of the GUI, the decompiler, scripting, and the extension API.

Skip this if

Beginners with no shell-scripting fluency, or readers who only work on Windows. The book assumes you can write a basic for-loop and an if-conditional; the value is in the offensive idioms.

Skip this if you want a tutorial on how to actually reverse-engineer malware. It documents the tool deeply but rarely walks you through a real target end to end.

Key takeaways

Most offensive bash is data plumbing: enumerate, parse, pivot, exfiltrate. The book's framing makes the workflow explicit instead of magic.
Living-off-the-land on Linux is a real strategy; bash + awk + sed + curl is often more reliable than dropping a custom binary on a hardened target.
The chapters on log tampering, persistence via cron / systemd, and privilege escalation chains are the practical core for any operator who finishes a foothold and needs to keep moving.

Ghidra's collaborative project model and headless analyzer are genuine advantages over single-user tools, and the book covers both properly.
The decompiler is the reason to use Ghidra, and the chapters on reading and improving its output are the most useful in the book.
Real power comes from scripting and writing extensions; budget time for the Java/Python API chapters because that is where the tool stops being just a GUI.

How they compare

Black Hat Bash and The Ghidra Book are both rated 4/5 in our catalog. Pick by topic preference and reading style rather than by rating.

Both books target intermediate-level readers, so the choice is about topic, not difficulty.

Black Hat Bash and The Ghidra Book both cover Tooling, so reading them in sequence reinforces the same material from different angles.

Keep reading

Black Hat Bash

→ Alternatives to Black Hat Bash → What to read after Black Hat Bash