// Comparison

Bug Bounty Bootcamp vs The Web Application Hacker's Handbook: Which Should You Read?

Two cybersecurity books on Web Security, compared honestly: who each is for, what each does best, and which to read first.

Beginner

4/52021

Bug Bounty Bootcamp

The Guide to Finding and Reporting Web Vulnerabilities

Vickie Li

Vickie Li's pragmatic walk through the bug-bounty workflow, from picking a program and recon to reporting findings that actually pay out.

Intermediate

4/52011

The Web Application Hacker's Handbook

Finding and Exploiting Security Flaws

Dafydd Stuttard, Marcus Pinto

The exhaustive reference for web app pentesting, comprehensive but increasingly a historical document.

Read this if

Readers who want a workflow-first introduction to bug bounty. Li covers recon, methodology, the bug classes that pay, automation, and reports, all in the order you'd actually do them.

Anyone moving from CTF web challenges into real engagements who needs a systematic mental model of attack surface.

Skip this if

Practitioners who already work in offensive security or who want depth on individual bug classes. The book is a wide first pass, not a deep specialization.

Frontend-heavy apps in 2024. SPA-specific bugs, JWT pitfalls, GraphQL, and modern CSP are barely covered or absent entirely.

Key takeaways

The recon chapter (subdomains, GitHub leaks, archived endpoints) alone justifies the book; most beginners skip recon and miss most of the bounty.
The chapters on race conditions and business logic flaws cover bug classes that don't show up in older textbooks but pay regularly today.
Li's writing on reports, triage interaction, and disclosure ethics is the calmest and most professional section in the bug-bounty book market.

Authentication, session management, and access control are still where most real bugs live.
Methodology beats tooling, the structure of how you map an app matters more than which scanner you run.
Use it as a reference for the classes of bug, then cross-check with PortSwigger Academy for the modern exploitation details.

How they compare

Bug Bounty Bootcamp and The Web Application Hacker's Handbook are both rated 4/5 in our catalog. Pick by topic preference and reading style rather than by rating.

Bug Bounty Bootcamp is pitched at beginner level. The Web Application Hacker's Handbook is pitched at intermediate level. Read the easier one first if you're not yet comfortable with the topic.

Bug Bounty Bootcamp and The Web Application Hacker's Handbook both cover Web Security, Offensive, so reading them in sequence reinforces the same material from different angles.

Keep reading