The shellcoder's handbook
by Chris Anley, John Heasman, Felix Linder, Gerardo Richarte · first published 2007
89% recommend11% neutral
Why HN recommends it
Covers how memory-corruption bugs are found and turned into working exploits, with shellcode as the payload. It is a go-to text for learning exploit development after the basics.
Summarised by Claude from recommending comments
Affiliate links. As an Amazon Associate I earn from qualifying purchases.
Mentions per year
What Hacker News says
Related books
2016–2024Practical Reverse Engineering
Bruce Dang, Alexandre Gazet, Elias Bachaalany
Recommended by 6 · mentioned by 86 recommend · 8 mention6 recommend · 86 recommend
2013–2017A tangled web
Lucy Maud Montgomery
Recommended by 2 · mentioned by 22 recommend · 2 mention2 recommend · 22 recommend
2013–2017The IDA Pro book
Chris Eagle
Recommended by 5 · mentioned by 75 recommend · 7 mention5 recommend · 75 recommend
2009–2017Gray hat Python
Justin Seitz
Recommended by 5 · mentioned by 85 recommend · 8 mention5 recommend · 85 recommend
2009–2023The web application hacker's handbook
Dafydd Stuttard, Marcus Pinto
Recommended by 31 · mentioned by 4831 recommend · 48 mention31 recommend · 4831 recommend
2013–2024Practical Malware Analysis
Michael Sikorski, Andrew Honig
Recommended by 13 · mentioned by 1613 recommend · 16 mention13 recommend · 1613 recommend
2008–2025The art of software security assessment
Mark Dowd, John McDonald, Justin Schuh
Recommended by 21 · mentioned by 3121 recommend · 31 mention21 recommend · 3121 recommend
…because they are like The Art of Computer Programming for security. Everyone says they have read them, they definitely should read them, and it's evident that almost no one has actually read them. 4. Shellcoder's Handbook - If exploit development if your thing, this will be useful. Use it as a follow-on from a good reverse engineering book. 5. Cryptography Engineering - The first and only book you'll really need to understand…
on “Cybersecurity Humble Book Bundle” ↗…Reversing: Secrets of Reverse Engineering 10. The IDA Pro Book You'll want this if you have any plan to work with IDA Pro at all, which is the gold standard for decompiling and reversing software. 11. The Shellcoder's Handbook If you'd like to write exploits after you're done reversing software to find an exploitable bug, this is a good book to pick up. 12. Cryptography Engineering Very solid and broad introduction to cryptography.…
on “Ask HN: What are the best books for learning information security?” ↗…something a user can control. Once you have that, you're in with a good chance of getting a working exploit. For those that are interested in learning how to write exploit code, I'd highly recommend The Shellcoder's Handbook - http://www.amazon.co.uk/Shellcoders-Handbook-Discovering-Exp...
on “Gain control of a Linux System via an USB-Device due to strcpy” ↗…highly recommend for anyone looking to be a well-rounded hacker: * TCP/IP Illiustrated (Volumes 1,2 & 3) - W. Richard Stephens * The Web Application Hacker's Handbook - Stuttard, Pinto et al * The Shellcoder's Handbook - Kozoil, Aitel et al * The Cuckoo's Egg - Clifford Stoll * Neuromancer - William Gibson * ARM System-on-chip Architecture - Stephen B. Furber * Operating Systems Design & Implementation - Tanenbaum…
on “The Hacker's Path” ↗…development skills. 1. Introduction to Software Exploits - http://opensecuritytraining.info/Exploits1.html - In my opinion this is simply the best resource out there to learn the basics. It uses the book "The Shellcoder's Handbook" as its textbook and I completely recommend the book. 2. Hacking: The Art of Exploitation - This is the most often recommended book, its great and has a much better introduction than the Shellcoder's…
on “Ask HN: What's the prerequisite to become an exploit developer?” ↗…asked for books. How about: * The Web Application Hacker's Handbook (bad title, great book). * Eldad Eilam's "Reversing" * The Art Of Software Security Assessment (our industry's bible) * The Shellcoder's Handbook * The last 10 years of Black Hat Briefings talks, which are all available online.
on “Ask HN: My 13 year-old cousin hacked into his school's system. What advice would you give?” ↗…which has a stupid volume of features for a relatively small amount of money. WAHH should be standard reading for anyone that wants to learn about Web Application attacks. I'd also highly recommend the Shellcoder's Handbook (although that could do with an update too). I will definitely be buying both the 2nd edition of WAHH and the try it bits too when it comes out. [1] - http://www.portswigger.net/
on “ Web App Hacker's Handbook 2nd Edition - Preview” ↗…resources for learning about vulnerability discovery, which is mainly about fuzzers these days. A good resource for determining how to exploit that vulnerability so that it does neat things for you is The Shellcoder's Handbook (some asm required, but not too hard if you know some OS internals).
on “Ask HN: How do you learn to develop exploits?” ↗If you wan't to learn to develop exploits I would read some of these few sources to get started... 1. The Shellcoder's Handbook 2. Hacking: The Art of Exploitation 3. Gray Hat Hacking 4. w00w00 Exploiting Heaps Basically memory exploits all boil down to overwriting the EIP with an address that points to some code that does something.…
on “Ask HN: How do you learn to develop exploits?” ↗…many of the vulnerabilities covered throughout this book." It then goes on to recommend that: "Readers interested in learning more about exploiting memory corruption vulnerabilities should pick up The Shellcoder's Handbook, or Exploiting Software ...". It also suggests Phrack and Uninformed journals. I've read Shellcoder's Handbook and recommend it, however, it is out of date now. Despite this, I don't think the value…
on “Ask HN: How do you learn to develop exploits?” ↗I've been working through https://guyinatuxedo.github.io/ while reading "The Shellcoder's Handbook" and Sam Bowne's class notes (https://samsclass.info/127/127_F19.shtml). Highly recommended
on “Pwn.college” ↗…example, here's are some things I've been doing as I'm considering a move into a security-focused role: - Following the industry (podcasts ala Sans mainly) - Reading books on hacking (currently "The Shellcoder's Handbook") - Reviewing my comp sci basics (x86 assembly + reading K&R "The C Programming Language") - Dabbling in some hacking exercises (https://ropemporium.com and https://canyouhack.us/) Mainly asking because…
on “Introducing Chronicle, a new Alphabet business dedicated to cybersecurity” ↗This was an interesting book to review as I read the first edition ages ago, bought the second edition and never bothered reading it. With the Shellcoder's Handbook 2nd Edition this really is pretty much everything you needed in 2008 to get started, but it's amazing how much things have moved on. It's still worth a look as a book, but obviously there's a lot more…
on “An updated review of Jon Erickson's Hacking: The Art of Exploitation” ↗