// Comparison
Bug Bounty Bootcamp vs Penetration Testing: Which Should You Read?
Two cybersecurity books on Offensive, compared honestly: who each is for, what each does best, and which to read first.
Vickie Li's pragmatic walk through the bug-bounty workflow, from picking a program and recon to reporting findings that actually pay out.
Georgia Weidman's lab-driven introduction to pentesting, walking the reader from setting up a target environment through scanning, exploitation, post-exploitation, and reporting.
Read this if
Skip this if
Key takeaways
- The recon chapter (subdomains, GitHub leaks, archived endpoints) alone justifies the book; most beginners skip recon and miss most of the bounty.
- The chapters on race conditions and business logic flaws cover bug classes that don't show up in older textbooks but pay regularly today.
- Li's writing on reports, triage interaction, and disclosure ethics is the calmest and most professional section in the bug-bounty book market.
- A complete pentest is a small number of repeated motions (recon, find foothold, escalate, pivot, document); Weidman teaches the rhythm before the tooling.
- Lab setup is half the learning; running through the book's Metasploitable-and-Windows-VM lab is what builds the muscle memory the OSCP later assumes.
- Reporting matters as much as exploitation; the book is one of the few intro texts that takes the deliverable seriously.
How they compare
Bug Bounty Bootcamp and Penetration Testing are both rated 4/5 in our catalog. Pick by topic preference and reading style rather than by rating.
Both books target beginner-level readers, so the choice is about topic, not difficulty.
Bug Bounty Bootcamp and Penetration Testing both cover Offensive, so reading them in sequence reinforces the same material from different angles.