Penetration testing books split into two kinds now, and you should know which one you’re buying before you pay. Most of the famous titles teach a full engagement from recon to report, while the newest ones assume you already run engagements and teach you to build the tooling and infrastructure a red team operates on. A book from the wrong kind wastes a month of evenings, either because it explains what you already know or because chapter three assumes a C2 server you’ve never set up.
We sorted eleven pentest and red team books by the engagement you’re doing next: Active Directory, web apps and APIs, cloud and Kubernetes, tool building, and EDR evasion, plus one book for people who aren’t testers yet. Each pick names the edition, the year, and what has aged since it was printed, because a 2021 web book and a 2026 evasion book decay at very different rates. Editions, prices and stock below were checked in October 2026.
Quick Picks by Engagement Type
If you only buy one book this year, buy the one that matches the work on your calendar, not the one with the best reputation. These are the picks we’d hand to each kind of tester:
- Internal network and Active Directory: Pentesting Active Directory and Windows-based Infrastructure, because AD is where most internal tests are won or lost.
- Web apps and bug bounty: Bug Bounty Bootcamp, the widest vulnerability coverage per dollar on this list.
- APIs and mobile backends: Hacking APIs, which ends with a checklist you can run on the next job.
- Building red team infrastructure: Red Team Engineering, the only book we found that builds red team infrastructure end to end.
- Getting past endpoint detection: Evading EDR, read for how sensors work rather than for bypasses.
- Not a tester yet: Hacking For Dummies, 8th Edition, the cheapest pick and the only one written for readers who aren’t technical yet.
Studying for a certification is a different problem, since the exam objectives decide what to read. Our lists for OSCP preparation and CompTIA PenTest+ map books to each exam, and if you want defense on the same shelf, the broader cybersecurity books list covers fundamentals, SOC work and purple teaming.
How We Picked These Pentest Books
Every book here was checked against its publisher page or catalog record and against Amazon’s own catalog on the day we wrote it. That means the edition, page count and print date you see in the table are the ones the links sell. Where a publisher page was blocked to us (Packt and O’Reilly both refused automated reads), we used the Barnes & Noble record or O’Reilly’s public catalog API instead. Three rules decided what made the cut:
- A real publisher: No Starch, O’Reilly, Packt or Wiley. Dozens of self-published 2025 and 2026 Active Directory and red team titles fill Amazon’s results, and we couldn’t vet their authors, so none made it.
- The current edition, in print: every link points to a new paperback listing, not a preorder or a used-only listing, and the one pick Amazon would not confirm in stock says so.
- Hands-on content: labs, code or a repeatable method, not a tour of tool names.
A few well-known titles didn’t make it for honest reasons. The Hacker Playbook 3 dates from 2018 and we found no fourth edition. Gray Hat Hacking’s sixth edition is from 2022 and we found no seventh, and it is already in our broader list. No Starch’s The Effective Red Team covers building and running an internal red team program and is the most promising title on the horizon. It is a preorder until January 2027, though, so we would wait for it rather than pay now.
Compare the 11 Penetration Testing Books
The date is when the print edition reached Amazon, which can trail the publisher’s own release by a few weeks. Read the “Ages fastest” column before the price, because it tells you which books you’ll need to supplement with current blog posts and tool docs:
| Book | Publisher, print date | Pages | Engagement | Ages fastest |
|---|---|---|---|---|
| Red Team Engineering | No Starch, 2026-03-24 | 352 | Red team infrastructure | Cloud provider steps |
| Evasion Engineering | No Starch, 2026-07-07 | 256 | Custom tools, evasion | Detection techniques |
| Evading EDR | No Starch, 2023-10-31 | 312 | Windows endpoint evasion | Vendor sensor behavior |
| Pentesting Active Directory | Packt, 2023-11-17 | 360 | Internal network, AD | Tool versions |
| Hacking APIs | No Starch, 2022-07-12 | 368 | REST and GraphQL APIs | Lab targets, tooling |
| Bug Bounty Bootcamp | No Starch, 2021-12-07 | 416 | Web apps, bug bounty | Program landscape |
| Black Hat Python, 2nd Ed | No Starch, 2021-04-14 | 216 | Writing your own tools | Trojan and C2 techniques |
| Cloud Penetration Testing | Packt, 2023-11-24 | 298 | AWS, Azure, GCP | Console and CLI steps |
| Hacking Kubernetes | O’Reilly, 2021-11-16 | 311 | Kubernetes clusters | CVEs, admission controls |
| Malware Development for Ethical Hackers, 2nd Ed | Packt, 2026-08-31 | 258 | Payloads for testing | Lab tooling |
| Hacking For Dummies, 8th Ed | Wiley, 2025-10-14 | 416 | Overview for beginners | Slowly |
Three of the eleven are 2026 printings, and all three sit at the red team end of the shelf. That is the pattern you should notice: the web and API books have not had a new edition since 2021 or 2022, while publishers have put their new money into tool building and evasion, where techniques go stale fastest.
1. Red Team Engineering
Red Team Engineering wins for anyone who has to stand up the infrastructure a red team runs on, which almost no other book covers end to end. Casey Erdmann builds it in three parts: offensive development, then infrastructure engineering, then real-world operations.
The three parts build on each other, so you finish with tools, the infrastructure to run them, and practice using both:
- Offensive development: credential-harvesting web apps, Python SMB brute-force and spraying tools, and the encryption logic of a Go ransomware sample.
- Engineering: automated C2 deployment on AWS, reverse VPN tunnels with OpenVPN and PiVPN, and fleet configuration with Salt.
- Real world: Metasploit, a physical dropbox, phishing behind C2 redirectors, and a multiplayer C2 setup for a team of operators.
That last chapter covers a topic we rarely see in print, because sharing one C2 server between several operators is an operations problem, not an exploit. If you’ve ever had two testers fighting over the same session, it is the chapter you will read twice.
Where it falls short is everything around the build: scoping, rules of engagement and the report get no chapter, because all 11 chapters are build work. It is also the priciest pick at $45 to $55 when we checked. Check the current price on Amazon.
2. Evasion Engineering
Evasion Engineering is the pick when your engagements keep getting caught and you want to write tools defenders haven’t seen. Dennis Chow and Michael LaSalvia build every tool in Go and Python, and each chapter ends by switching sides to show how a defender would detect it.
The projects are specific, and each one is something you could run against a client’s detection stack next quarter:
- Command and control: a Go implant that queues its commands through GCP Firestore.
- Lateral movement: an SSH worm with honeypot detection and exponential backoff for credential spraying.
- Local enumeration: Go replacements for the living-off-the-land binaries that EDR watches.
- Packing and exfiltration: shellcode disguised as a list of IPv4 addresses, and data hidden in Cloud Logging entries.
No Starch lists Go 1.21 or newer and Python 3 as requirements. The companion repository holds the code for all ten chapters, so you will not be retyping implants from the page.
Beginners should pass on this one. The repo’s README says plainly that it is not a beginner book, and the labs need AWS and GCP accounts, so you will want Go, Linux and a cloud console under your belt first. At 256 pages it’s also the thinnest of the red team books. It ran $40 to $45 with limited stock from a marketplace seller. Check the current price on Amazon.
3. Evading EDR
Evading EDR is the book we’d hand anyone whose payloads die on Windows endpoints, because it explains what the agent actually sees before it tells you how to hide. Matt Hand takes the EDR agent apart one sensor at a time.
The chapters run through function-hooking DLLs, process and thread notifications, object, image-load and registry callbacks, filesystem minifilters, network filter drivers, Event Tracing for Windows, AMSI, early launch antimalware drivers and the Microsoft-Windows-Threat-Intelligence provider. A closing case study plans a full attack around those sensors, which is the chapter that turns the theory into engagement planning.
Skip it if you want copy-paste bypasses. It went to print in 2023, EDR products change with every release, and it covers Windows only. The architecture you learn from it still holds, and that is why it stays on the list. It sold for $40 to $50 from a marketplace seller. Check the current price on Amazon.
4. Pentesting Active Directory and Windows-based Infrastructure
Denis Isakov’s book is the best-value pick for internal network tests, and it’s the only Active Directory attack book from an established publisher that we could confirm in print. It pairs each attack with how defenders would spot it, including the OpSec cost of making noise.
That attack-plus-detection pairing is what separates it from the self-published AD titles crowding Amazon. When you know which event a technique raises, you can choose a quieter path, and a defender reading the same chapter learns what to alert on. The print copy also includes a free PDF, which helps when you want the commands on a lab machine.
It targets on-premises Microsoft infrastructure (Active Directory, Exchange, SQL Server, SCCM), so a Linux-heavy network or a cloud-only tenant gets little from it. It’s a 2023 first edition, so expect some tool versions to have moved. At $25 to $30 it was the cheapest of the hands-on picks. Check the current price on Amazon.
5. Hacking APIs
Hacking APIs wins for API-heavy targets, which now covers most web apps and every mobile backend. Corey Ball spends the first two parts on how APIs work and on building a lab with deliberately vulnerable API targets, then gets to the attacks.
The attack chapters cover discovery, endpoint analysis, authentication attacks, fuzzing, authorization flaws, mass assignment, injection, rate-limit evasion and a full chapter on GraphQL. Appendix A is an API hacking checklist that’s worth the price on its own, and the hAPI-hacker repository on GitHub carries wordlists and a GraphQL introspection query.
It is API only, so classic server-rendered sites get nothing from it. It doesn’t cover LLM or AI APIs, which arrived in volume after it went to print. Amazon showed it as available but not confirmed in stock when we checked, at $45 to $50 from a third-party seller, so look at the seller before you order. Check the current price on Amazon.
6. Bug Bounty Bootcamp
Bug Bounty Bootcamp is the broadest web vulnerability book here, and the one we’d pick for a tester moving into web work. Vickie Li gives each vulnerability class its own chapter, explains how to find it, and shows how to write it up so a triage team pays out.
Sixteen of its 25 chapters are vulnerability classes: XSS, open redirects, clickjacking, CSRF, IDOR, SQL injection, race conditions, SSRF, insecure deserialization, XXE, template injection, broken access control, RCE, same-origin policy bugs, SSO issues and information disclosure. The last part covers code review, Android apps, APIs and automated discovery with fuzzers, and the opening chapters on picking a program are useful even if you never submit a bug.
Full-time hunters will find it dated, because a late-2021 book misses newer client-side bug classes and its API coverage is a single chapter (pair it with Hacking APIs). It was $30 to $35, sold by a marketplace seller rather than Amazon. Check the current price on Amazon.
7. Black Hat Python, 2nd Edition
Black Hat Python is still the shortest route from running other people’s tools to writing your own. Justin Seitz and Tim Arnold rewrote the code for Python 3 in this edition, and at 216 pages you can finish it in a couple of weekends.
You build network tools and a sniffer, own a network segment with Scapy, write web attack scripts and extend Burp with Python. Later chapters run command and control through GitHub and work through Windows trojaning tasks, exfiltration, privilege escalation and offensive forensics with Volatility. Each project is small enough to adapt for a real engagement the following week.
Do not expect evasion that holds up against a modern EDR, since GitHub C2 and simple trojans get flagged today. Read it for the scripting habits, then go to Evasion Engineering for the current techniques. No newer edition is listed on No Starch’s upcoming page. It cost $30 to $40. Check the current price on Amazon.
8. Cloud Penetration Testing
Kim Crawley’s book is the only general multi-cloud pentest book we found from an established publisher, covering AWS, Azure and GCP side by side, which makes it the pick for consultants who don’t get to choose the client’s cloud. If your scope is serverless only, O’Reilly’s Learning Serverless Security also spans all three providers.
After three chapters on how enterprises build and lose cloud networks, the book repeats the same pattern for each provider: the native security features, pentesting through serverless applications, and pentesting containerized workloads. It also covers working with cloud admins and stakeholders, which matters more in the cloud than on-premises because you often can’t test without their cooperation.
Single-cloud testers get less from it, because the three-chapter pattern gives each provider a breadth pass rather than depth. Consoles and CLIs have changed since its late-2023 print. It was $40 to $45. Check the current price on Amazon.
9. Hacking Kubernetes
Hacking Kubernetes is the pick when the target is a cluster rather than a cloud account. Andrew Martin and Michael Hausenblas take one component per chapter, show its architecture and default settings, walk through real attacks and historical CVEs against it, then show the hardening that stops them.
That threat-driven structure is why it suits both sides of an engagement. You get a map of where clusters break, and your client gets the fix in the same chapter, which makes your report easier to write. It runs 311 pages.
Its weak spot is age. This first edition went to print in November 2021, so Pod Security Admission and the CVEs since then are missing, and we could not confirm a second edition. Stock was limited at $35 to $40. Check the current price on Amazon.
10. Malware Development for Ethical Hackers, Second Edition
Zhassulan Zhussupov’s second edition is the newest book here and the one to buy when an engagement calls for a custom payload instead of a framework default. It covers Windows and Linux, with proof-of-concept code in C, C++ and assembly.
Topics run from persistence and injection to evasion, anti-analysis and analyzing what you built, so it reads from both the red and blue side. The companion repository has code folders for 16 chapters and lists the lab: MinGW, Kali or Parrot, VirtualBox 7.0, Sysinternals, x64dbg and PE-bear.
Skip it if you cannot read C, because nothing here holds your hand through the language. The repo still lists Windows 7 and 10 targets and Process Hacker 2, so build the lab on current Windows yourself. It was $25 to $30 when we checked. Check the current price on Amazon.
11. Hacking For Dummies, 8th Edition
Hacking For Dummies is here for the reader who isn’t a tester yet, or who manages testers and wants to understand the reports. Kevin Beaver writes from the defender’s side, about finding weaknesses in your own systems before someone else does.
The October 2025 edition adds hybrid-work environments and hacking with AI to the long-running overview, and it’s written without jargon. If your actual question is whether penetration testing is a career for you, this is a cheaper way to find out than a $50 red team book.
If you already use Burp or Nmap at work, you have outgrown it, because it is an overview and audit guide with no exploitation depth. It was the cheapest pick at $15 to $20. Check the current price on Amazon.
What to Look For in a Penetration Testing Book
The print date matters more for some topics than others, and that’s the mistake we see most often in pentest book lists: treating a 2021 Kubernetes book and a 2021 Python scripting book as equally old. Weigh these before you buy:
- How fast the topic decays: evasion and cloud steps go stale in a year or two, while methodology, vulnerability classes and Windows internals last much longer.
- What the labs need: Evasion Engineering wants AWS and GCP accounts, the malware book wants a Windows VM and a debugger, and the AD book wants a domain to attack.
- Which language it codes in: Go, Python, C or PowerShell. Pick the book in a language you’ll actually maintain tools in.
- Whether the code is online: a maintained companion repo saves hours of retyping and tells you whether anyone still fixes the examples.
- Who sells it: several picks were sold by marketplace sellers rather than Amazon when we checked, so look at the seller and the delivery date before you pay.
Most of these books assume a lab you can break without consequences. If you don’t have one, our guide to cybersecurity home lab hardware prices three builds, and the Kali Linux books cover the attack box itself.
Build a Red Team Reading Path
Reading these in the wrong order is the expensive mistake, since the red team books assume everything the web and AD books teach. For a tester heading from internal assessments toward red team work, this is the order we’d read them in:
- Pentesting Active Directory: learn the internal network, because most red team objectives sit behind AD.
- Black Hat Python: start writing small tools instead of only running them.
- Evading EDR: understand what the endpoint sees before you try to hide from it.
- Red Team Engineering: build the C2, redirectors and phishing infrastructure an operation runs on.
- Evasion Engineering: replace public tooling with your own and learn how defenders will catch it.
Web and cloud testers can swap the first two for Bug Bounty Bootcamp and Hacking APIs, or Cloud Penetration Testing and Hacking Kubernetes, and still finish on the last three. Defenders who read alongside red teamers will get more out of our threat hunting books and the Windows internals shelf, which explain the telemetry that every book on this path is trying to avoid.
