Cyber Shelf

// Prerequisites

What to read before Hacking APIs

If Hacking APIs feels too steep at intermediate level, here is what to read first. Lighter books in the same topics that build the prerequisites this one assumes.

Web SecurityAppSecOffensive

  1. 01 · 2023

    Black Hat GraphQL

    Aleks and Farhi on attacking GraphQL specifically: introspection abuse, batching, depth and complexity attacks, auth flaws, and the differences from REST that make GraphQL pentests their own discipline.

    Intermediate
    4/5Nick Aleks, Dolev Farhi

  2. 02 · 2011

    The Web Application Hacker's Handbook

    The exhaustive reference for web app pentesting, comprehensive but increasingly a historical document.

    Intermediate
    4/5Dafydd Stuttard, Marcus Pinto

  3. 03 · 2021

    Bug Bounty Bootcamp

    Vickie Li's pragmatic walk through the bug-bounty workflow, from picking a program and recon to reporting findings that actually pay out.

    Beginner
    4/5Vickie Li

  4. 04 · 2019

    Real-World Bug Hunting

    Peter Yaworski breaks down real disclosed reports across major bug bounty programs, organized by vulnerability class, so readers can pattern-match real findings rather than learn classes from textbook examples.

    Beginner
    4/5Peter Yaworski

  5. 05 · 2020

    Web Security for Developers

    Malcolm McDonald's developer-side primer on the OWASP-class issues, framed around real attacks and defended with code patterns rather than vendor products.

    Beginner
    4/5Malcolm McDonald

  6. 06 · 2020

    Alice and Bob Learn Application Security

    Tanya Janca's hands-on AppSec primer covering threat modeling, secure design, secure coding, testing, deployment, and the social side of running an AppSec program — through a friendly, narrative-driven structure.

    Beginner
    4/5Tanya Janca

  7. 07 · 2014

    Penetration Testing

    Georgia Weidman's lab-driven introduction to pentesting, walking the reader from setting up a target environment through scanning, exploitation, post-exploitation, and reporting.

    Beginner
    4/5Georgia Weidman

  8. 08 · 2021

    Real-World Cryptography

    David Wong's hands-on tour of the cryptographic primitives, protocols and pitfalls that show up in actual production systems, with deliberate attention to TLS, Noise, modern AEAD, and post-quantum.

    Intermediate
    5/5David Wong
← Back to Hacking APIsWhat to read after Hacking APIs →