// Comparison

Hacking: The Art of Exploitation vs Pentesting Azure Applications: Which Should You Read?

Two cybersecurity books on Offensive, compared honestly: who each is for, what each does best, and which to read first.

Intermediate

5/52008

Hacking: The Art of Exploitation

Jon Erickson

A from-first-principles tour of low-level exploitation that still teaches the mindset two decades later.

Intermediate

3/52018

Pentesting Azure Applications

The Definitive Guide to Testing and Securing Deployments

Matt Burrough

Matt Burrough on attacker behaviour against Azure tenants: identity, storage, VMs, key material handling, and the recon paths that work against real subscriptions.

Read this if

Self-taught hackers who want to understand what a stack overflow actually is, not just how to invoke msfconsole.

Cloud pentesters whose scope includes Azure subscriptions. Burrough covers identity (Entra ID), storage account abuse, VM-level recon, key material handling, and the role-based access patterns that drive real Azure post-exploitation.

Skip this if

Readers looking for modern exploitation (ASLR, CFI, browser sandboxes). The defenses Erickson covers are now baseline, not frontiers.

Readers focused on AWS or GCP, or anyone wanting current Azure tradecraft. The book pre-dates the current AAD-now-Entra-ID rebrand and several major service updates; treat it as foundational, not current.

Key takeaways

Exploitation is a way of seeing programs, not a list of techniques.
Memory corruption is best learned with a debugger open beside the book.
The first half on C/assembly is worth the price even if you skip the exploits.

Azure attack patterns center on identity and roles, not network-level vulnerabilities; the book's framing reflects that.
Storage account misconfigurations remain one of the most common Azure findings; the book's coverage of access-key abuse is still relevant.
Cloud pentest reporting differs meaningfully from network pentest reporting; the book's deliverable templates are useful starting points.

How they compare

We rate Hacking: The Art of Exploitation higher (5/5 against 3/5 for Pentesting Azure Applications). For most readers, that means Hacking: The Art of Exploitation is the primary pick and Pentesting Azure Applications is a useful follow-up.

Both books target intermediate-level readers, so the choice is about topic, not difficulty.

Hacking: The Art of Exploitation and Pentesting Azure Applications both cover Offensive, so reading them in sequence reinforces the same material from different angles.

Keep reading