// Alternatives
Alternatives to The Tangled Web
Books in our catalog with overlapping topics and a similar reading level to The Tangled Web. If The Tangled Web is the wrong fit at advanced level, start here.
01 · 2023
Black Hat GraphQL
Aleks and Farhi on attacking GraphQL specifically: introspection abuse, batching, depth and complexity attacks, auth flaws, and the differences from REST that make GraphQL pentests their own discipline.
Intermediate4/5Nick Aleks, Dolev Farhi02 · 2022
Hacking APIs
Corey Ball's structured approach to attacking REST and GraphQL APIs: enumeration, auth flaws, business logic, mass assignment, and the testing harness around them.
Intermediate4/5Corey J. Ball03 · 2011
The Web Application Hacker's Handbook
The exhaustive reference for web app pentesting, comprehensive but increasingly a historical document.
Intermediate4/5Dafydd Stuttard, Marcus Pinto04 · 2020
Web Security for Developers
Malcolm McDonald's developer-side primer on the OWASP-class issues, framed around real attacks and defended with code patterns rather than vendor products.
Beginner4/5Malcolm McDonald05 · 2021
Real-World Cryptography
David Wong's hands-on tour of the cryptographic primitives, protocols and pitfalls that show up in actual production systems, with deliberate attention to TLS, Noise, modern AEAD, and post-quantum.
Intermediate5/5David Wong06 · 2006
The Art of Software Security Assessment
The 1200-page reference on auditing C/C++ codebases for security: parsing complex memory and integer interactions, language pitfalls, and how vulnerabilities arise from interactions between layers.
Advanced5/5Mark Dowd, John McDonald, Justin Schuh07 · 2005
The Database Hacker's Handbook
Litchfield, Anley, Heasman, and Grindlay's exhaustive 2005 reference on attacking and defending Oracle, SQL Server, DB2, MySQL, PostgreSQL, Sybase, and Informix — the era when the database engine itself was the soft target.
Advanced3/5David Litchfield, Chris Anley, John Heasman, Bill Grindlay08 · 2021
Designing Secure Software
Loren Kohnfelder, the original PKI author, on how to weave security thinking through requirements, design, implementation and operations rather than bolt it on at the end.
Intermediate5/5Loren Kohnfelder09 · 2014
Threat Modeling
Adam Shostack's practitioner-oriented introduction to threat modeling: STRIDE, attack trees, and how to fit the practice into a real software-development lifecycle.
Intermediate5/5Adam Shostack10 · 2010
Cryptography Engineering
A working engineer's introduction to cryptography that takes implementation pitfalls more seriously than most.
Intermediate4/5Niels Ferguson, Bruce Schneier, Tadayoshi Kohno