// Comparison

Hacking et Cyberdéfense vs Metasploit: Which Should You Read?

Two cybersecurity books on Offensive, compared honestly: who each is for, what each does best, and which to read first.

Advanced

4/52026

Auditer son environnement Windows

Jacques Beirnaert-Huvelle, Guillaume Morelle

Two working pentesters who also teach the material walk through the full Active Directory kill chain, offense and defense both, in an expert-level French-language audit manual.

Intermediate

4/52025

Metasploit

The Penetration Tester's Guide

David Kennedy, Mati Aharoni, Devon Kearns, Jim O'Gorman, Daniel G. Graham

The second edition of the definitive No Starch guide to the Metasploit Framework, updated by the project's original maintainers and newer contributors for the modern Framework.

Read this if

French-speaking Windows administrators and security practitioners who already know the basics and want one book covering the whole Active Directory attack lifecycle, enumeration, exploitation, privilege escalation, lateral movement, persistence, and trust-relationship abuse, paired with the Tier-based defenses that actually stop it.

Pentesters and red teamers who want to know Metasploit cold, or developers who want to extend the Framework. Written by the original project leads and updated for the current ecosystem; the canonical Metasploit text.

Skip this if

Readers who don't read French, or beginners without prior Windows/AD or pentesting fundamentals; the publisher pitches this explicitly as an expert-level text, not an introduction.

Readers wanting modern post-exploitation tradecraft against well-defended targets. Metasploit shines in lab and OSCP-style scenarios; against modern EDR with kernel callbacks, the playbook is more nuanced than this book covers.

Key takeaways

Has readers build a disposable AD lab (GOAD, NetExec-Lab) so every attack chapter is run hands-on instead of read as theory.
Covers the full AD attack lifecycle end to end, from LDAP/Kerberos fundamentals through post-exploitation and trust-relationship abuse.
Pairs the offense with a dedicated defense chapter on Tier architecture, AGDLP, and risk-prevention policy, making it as much an audit manual as an attack manual.

Metasploit's value is workflow integration: payloads, post-exploitation modules, sessions, pivoting all wired together. The book teaches you to use the framework as a force multiplier, not as a list of exploits.
Custom modules (auxiliary, exploit, post) are how you turn Metasploit into your toolkit; the book's chapters on module development are the highest-leverage material.
The 2nd edition (2025) is updated for the modern Framework, mainstream Linux, and the current model of Meterpreter; the original 2011 edition is now dated.

How they compare

Hacking et Cyberdéfense and Metasploit are both rated 4/5 in our catalog. Pick by topic preference and reading style rather than by rating.

Hacking et Cyberdéfense is pitched at advanced level. Metasploit is pitched at intermediate level. Read the easier one first if you're not yet comfortable with the topic.

Hacking et Cyberdéfense and Metasploit both cover Offensive, Pentesting, so reading them in sequence reinforces the same material from different angles.

Keep reading

Hacking et Cyberdéfense

→ Alternatives to Hacking et Cyberdéfense → What to read after Hacking et Cyberdéfense