The art of software security assessment
by Mark Dowd, John McDonald, Justin Schuh · first published 2006
68% recommend29% neutral3% critical
Why HN recommends it
Exhaustive, code-centric guide to finding and preventing vulnerabilities, covering C pitfalls and web apps. Recommended for aspiring security researchers and bug hunters wanting a methodology and fundamentals.
Summarised by Claude from recommending comments
Affiliate links. As an Amazon Associate I earn from qualifying purchases.
Mentions per year
What Hacker News says
Related books
2013–2017A tangled web
Lucy Maud Montgomery
Recommended by 2 · mentioned by 22 recommend · 2 mention2 recommend · 22 recommend
2009–2023The web application hacker's handbook
Dafydd Stuttard, Marcus Pinto
Recommended by 31 · mentioned by 4831 recommend · 48 mention31 recommend · 4831 recommend
2009–2017Gray hat Python
Justin Seitz
Recommended by 5 · mentioned by 85 recommend · 8 mention5 recommend · 85 recommend
2017–2024Sound Reinforcement Handbook
Gary D. Davis, Ralph Jones
Recommended by 3 · mentioned by 33 recommend · 3 mention3 recommend · 33 recommend
2016–2023The Browser Hacker's Handbook
Wade Alcorn, Christian Frichot, Michele Orru
Recommended by 2 · mentioned by 32 recommend · 3 mention2 recommend · 32 recommend
2016–2024Practical Reverse Engineering
Bruce Dang, Alexandre Gazet, Elias Bachaalany
Recommended by 6 · mentioned by 86 recommend · 8 mention6 recommend · 86 recommend
2009–2020The shellcoder's handbook
Chris Anley, John Heasman, Felix Linder, Gerardo Richarte
Recommended by 8 · mentioned by 98 recommend · 9 mention8 recommend · 98 recommend
…instead of just a platform-specific book targeted to something like iOS. Maybe supplement with a tool-specific book like The IDA Pro Book. 3. Security Engineering - You can probably read either this or The Art of Software Security Assessment. Both of these are old books, but the core principles are timeless. You absolutely should read one of these, because they are like The Art of Computer Programming for security. Everyone says they have…
on “Cybersecurity Humble Book Bundle” ↗…like this enter the mainstream more and more on HN. These bounties are well deserved. For those of you who would like to try and earn bounties like these, I recommend the same books I always do: 1. The Art of Software Security Assessment 2. Gray Hat Python 3. The Web Application Hacker's Handbook This is your ethical hacker starter kit. The first two are good for foundational knowledge and will show you how to find the bugs worth something.…
on “$9000 bounty paid for Python bugs” ↗…http://www.leshatton.org/MISRA_comp_1105.html http://www.leshatton.org/ISOC_subset1103.html http://www.embedded.com/electronics-blogs/embedded-systems-d... For the related topic of secure code, these books are good: Mark Dowd. 2006. The Art of Software Security Assessment. Robert Seacord. 2013. Secure Coding in C and C++, 2e. For details on what is really going on inside C: Paul Anderson. 1998. Advanced C: Tips and Techniques. Kenneth Louden. 1997. Compiler Construction:…
on “Ask HN: Books to learn advanced C programming” ↗…strong foundation for the different classes of vulnerabilities. 2. The Mobile Application Hacker's Handbook Good supplement to #1 for application security, obviously focused on mobile apps. 3. The Art of Software Security Assessment The bible of the security industry. Especially instructive for source code review. 4. Security Engineering (Ron Anderson) Supplements #3. Very instructive for injecting security into the overall SDLC…
on “Ask HN: What are the best books for learning information security?” ↗…want to learn reverse engineering. Start with Hacking: The Art of Exploitation and then proceed to Reversing: Secrets of Reverse Engineering or Practical Reverse Engineering. You'll also want to read The Art of Software Security Assessment and Security Engineering alongside those, to develop excellent source code auditing and binary penetration testing skills. Frankly you should read those no matter what you do in security. 5. It's very…
on “High frequency security bug hunting: 120 days, 120 bugs” ↗The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities http://www.amazon.com/The-Software-Security-Assessment-Vulne...
on “Ask HN: What's the best technical eBook you have read?” ↗…try your hand at working for first :) They might also send / you'd want to read: - Gray Hat Python (debugging and fuzzing with Python) - The Tangled Web (web browser security and insecurity) - The Art of Software Security Assessment - the bible, which you really want to read as it's a foundational text. Very dense, but you'll come out of it knowing how to attack memory very well.
on “A Career in Science Will Cost You Your Firstborn” ↗The Art of Software Security Assessment is a gold standard in infosec that goes well beyond simply web applications, but it does cover those, as well. Definitely read that to get a holistic image.
on “Ask HN: Best resources on webapp security?” ↗The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities by Mark Dow et al. https://www.amazon.com/dp/0321444426/ (https://www.amazon.com/dp/0321444426/) This book will give you the fundamentals of application…
on “Ask HN: What are the best textbooks in your field of expertise?” ↗…to bother much about attack surface/vectors etc. Just use some standard "healthy" compiler options and you are good. If you would like to know more on this subject, i recommend reading the classic The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities by Mark Dowd et al.
on “Compiler Options Hardening Guide for C and C++” ↗…with _The Tangled Web_, for candidates to Matasano. We like both books a lot (I wish WAHH had a title I wasn't embarrassed to say out loud, though). The other book candidates here tend to get is _The Art Of Software Security Assessment_.
on “Breaker 101: An intensive online web security course” ↗…bit controversial, the terms are still up in the air, and if you want to learn more about security, you'd be far better off reading Ferguson's "Practical Cryptography" and McDonald, Dowd, and Schuh's "Art of Software Security Assessment". Don't build obstacle courses. Design stuff that works.
on “Why you shoud never use your favorite password on News.YCombinator.com” ↗The industry standard answer to that question is "The Shellcoders Handbook", though I think you'd be better off with "The Art Of Software Security Assessment" and a lot of man pages.
on “New book. Gray Hat Python: Python Programming for Hackers and Reverse Engineers” ↗It's not a big secret at all ;) tptacek has a list of books on Amazon, linked to from his news.yc profile, which cover a wide range of application security topics (http://amzn.to/cthr46). I own The Art of Software Security Assessment and The Web Application Hacker's Handbook and I can vouch for them as quality resources, although I'm not sure how accessible they would be for a beginner. In terms of a more practical introduction,…
on “So how does hacking work anyway?” ↗…most of your comment, I think The Art of Memory Forensics is an absolute must read for the people that want to do digital forensics. Or attackers worrying about the footprint they leave behind... The Art of Software Security Assessment is a great book, but it's on a totally different topic and there's zero comparison between these two.
on “Cybersecurity Humble Book Bundle” ↗