// What to read next
What to read after iOS Application Security
Where to go after iOS Application Security, picked from our catalog. The next step up from intermediate level, weighted toward the topics this book covers.
01 · 2015
The Mobile Application Hacker's Handbook
Chell, Erasmus, Colley, and Whitehouse's reference on iOS and Android application security from the early-mid 2010s — runtime hooking, transport security, IPC abuse, and the platform-specific surface of mobile pentesting.
Intermediate3/5Dominic Chell, Tyrone Erasmus, Shaun Colley, Ollie Whitehouse02 · 2006
The Art of Software Security Assessment
The 1200-page reference on auditing C/C++ codebases for security: parsing complex memory and integer interactions, language pitfalls, and how vulnerabilities arise from interactions between layers.
Advanced5/5Mark Dowd, John McDonald, Justin Schuh03 · 2011
The Tangled Web
The deepest book ever written on the strange, accreted security model of the web browser.
Advanced5/5Michal Zalewski04 · 2014
Android Security Internals
Nikolay Elenkov on the actual implementation of Android's security model: package manager internals, permissions, keystore, SELinux integration, verified boot.
Advanced4/5Nikolay Elenkov05 · 2005
The Database Hacker's Handbook
Litchfield, Anley, Heasman, and Grindlay's exhaustive 2005 reference on attacking and defending Oracle, SQL Server, DB2, MySQL, PostgreSQL, Sybase, and Informix — the era when the database engine itself was the soft target.
Advanced3/5David Litchfield, Chris Anley, John Heasman, Bill Grindlay06 · 2021
Real-World Cryptography
David Wong's hands-on tour of the cryptographic primitives, protocols and pitfalls that show up in actual production systems, with deliberate attention to TLS, Noise, modern AEAD, and post-quantum.
Intermediate5/5David Wong07 · 2021
Designing Secure Software
Loren Kohnfelder, the original PKI author, on how to weave security thinking through requirements, design, implementation and operations rather than bolt it on at the end.
Intermediate5/5Loren Kohnfelder08 · 2014
Threat Modeling
Adam Shostack's practitioner-oriented introduction to threat modeling: STRIDE, attack trees, and how to fit the practice into a real software-development lifecycle.
Intermediate5/5Adam Shostack