Best Pentesting books

Linux Basics for Hackers

Getting Started with Networking, Scripting, and Security in Kali

OccupyTheWeb's introduction to Linux from the angle that hackers and pentesters actually need it: shells, networking, scripting, and Kali tooling.

Metasploit

The Penetration Tester's Guide

The second edition of the definitive No Starch guide to the Metasploit Framework, updated by the project's original maintainers and newer contributors for the modern Framework.

Gray Hat Hacking

The Ethical Hacker's Handbook

A multi-author breadth-first reference covering the modern offensive landscape: web, binary, hardware, IoT, mobile, cloud, and adversarial ML — the closest thing in print to a single-volume snapshot of where offensive security is.

Practical Social Engineering

A Primer for the Ethical Hacker

Joe Gray's working manual for the social-engineering side of red team and threat intel: OSINT-driven recon, pretexting, phishing infrastructure, and the legal and ethical boundaries that separate professional work from criminal activity.

The Hacker Playbook 3

Practical Guide to Penetration Testing — Red Team Edition

Peter Kim's hands-on red-team field manual: assumed-breach scenarios, lateral movement, AV/EDR evasion, and the operational rhythm of a real engagement rather than a checklist of CVEs.

Penetration Testing

A Hands-On Introduction to Hacking

Georgia Weidman's lab-driven introduction to pentesting, walking the reader from setting up a target environment through scanning, exploitation, post-exploitation, and reporting.

The Art of Intrusion

The Real Stories Behind the Exploits of Hackers, Intruders and Deceivers

Mitnick and Simon's follow-up to The Art of Deception: third-party stories from working hackers — casino slot exploits, prison-network breaches, post-9/11 intelligence ops — reconstructed and annotated by Mitnick.

Pentesting Azure Applications

The Definitive Guide to Testing and Securing Deployments

Matt Burrough on attacker behaviour against Azure tenants: identity, storage, VMs, key material handling, and the recon paths that work against real subscriptions.

The Mobile Application Hacker's Handbook

Chell, Erasmus, Colley, and Whitehouse's reference on iOS and Android application security from the early-mid 2010s — runtime hooking, transport security, IPC abuse, and the platform-specific surface of mobile pentesting.