// Prerequisites
What to read before Gray Hat Hacking
If Gray Hat Hacking feels too steep at advanced level, here is what to read first. Lighter books in the same topics that build the prerequisites this one assumes.
01 · 2011
The IDA Pro Book
Chris Eagle's deep manual on IDA Pro, the disassembler that defined a generation of reverse engineering. Useful even with Ghidra in the picture, since most malware-analysis literature still assumes IDA.
Intermediate4/5Chris Eagle02 · 2009
The Mac Hacker's Handbook
Charlie Miller and Dino Dai Zovi's 2009 deep dive into the Mac OS X exploit landscape — Mach-O, IPC, sandboxing as it then existed, and the early-Intel-Mac exploitation chains.
Advanced3/5Charlie Miller, Dino Dai Zovi03 · 2012
Practical Malware Analysis
Still the gold standard textbook for static and dynamic malware analysis on Windows.
Intermediate5/5Michael Sikorski, Andrew Honig04 · 2003
Hacking the Xbox
Andrew "bunnie" Huang on the original Xbox: hardware modding as the entry path into reverse engineering, plus a frank account of the legal fight that followed.
Intermediate4/5Andrew "bunnie" Huang05 · 2025
Metasploit
The second edition of the definitive No Starch guide to the Metasploit Framework, updated by the project's original maintainers and newer contributors for the modern Framework.
Intermediate4/5David Kennedy, Mati Aharoni, Devon Kearns, Jim O'Gorman, Daniel G. Graham06 · 2022
Practical Social Engineering
Joe Gray's working manual for the social-engineering side of red team and threat intel: OSINT-driven recon, pretexting, phishing infrastructure, and the legal and ethical boundaries that separate professional work from criminal activity.
Intermediate4/5Joe Gray07 · 2016
The Car Hacker's Handbook
Craig Smith's guide to automotive bus systems (CAN, LIN, FlexRay), ECUs, infotainment surfaces, and how to fuzz, trace and exploit modern vehicles.
Intermediate4/5Craig Smith08 · 2018
The Hacker Playbook 3
Peter Kim's hands-on red-team field manual: assumed-breach scenarios, lateral movement, AV/EDR evasion, and the operational rhythm of a real engagement rather than a checklist of CVEs.
Intermediate4/5Peter Kim