Currently studying
The books shaping how I think about security, Python tooling, and offensive security research.
Black Hat Python
What I am learning
This book teaches offensive security with Python from the ground up. Network sniffing, building bots, SSH tunneling, writing keyloggers, trojan development, and web application exploitation — all in Python. It is not about using existing tools. It is about building your own from raw sockets and standard libraries.
How I apply it
Every chapter translates directly into a tool I can build. The network interaction patterns, the way the book handles raw sockets and packet crafting, the approach to building C2 infrastructure — these inform how I architect my own recon and scanning tools. The techniques are offensive security focused, but understanding them is essential for building defensively resilient systems.
Bug Bounty Bootcamp
What I am learning
Systematic methodology for finding real vulnerabilities in production web applications. Recon techniques, subdomain enumeration, automated testing workflows, and how to write reports that get accepted by programs. It covers XSS, SSRF, IDOR, race conditions, and other vulnerability classes with hands-on examples.
How I apply it
This is the most directly applicable book to what I build. The recon automation framework I am working on is essentially the workflow described in the early chapters, turned into code. The testing methodology informs how I structure my scanners — what to test, in what order, and how to filter results into actionable output.
The Web Application Hacker's Handbook
What I am learning
Deep dive into how web applications work internally and how every layer can be exploited. Authentication mechanisms, session management, access controls, input handling, server-side logic — the book covers the full stack of web security from the attacker's perspective.
How I apply it
This gives me the theoretical depth that pure tool-building lacks. When I write a scanner that tests for XSS, I need to understand why certain payloads work in certain contexts and fail in others. When I build an authenticated crawler, I need to understand how sessions actually work at the protocol level. This book fills those gaps.