For most people the best web application security book to start with is Web Application Security, 2nd Edition by Andrew Hoffman, because it teaches recon, attack and defense in one book. If you’re after bug bounty payouts, pair it with Real-World Bug Hunting. If your work is mostly APIs, read an API title next.
This guide ranks ten books for bug hunters, pentesters and developers who own a web app, including Burp Suite, GraphQL and OWASP API Security titles. We checked every pick in October 2026 against the Amazon US catalog and the publisher details, so each cover matches the edition the link sells.
Which web application security book should you buy first?
Buy for the job in front of you, not for the most famous title. A developer hardening a login flow, a hunter reading scope pages on HackerOne and an API team facing an audit need different first books. Each of them will drop a book that spends 200 pages on the wrong problem. These are the picks per goal; the reasoning for each one follows further down:
- Best overall: Web Application Security, 2nd Edition (about $36 to $66). Recon, offense and defense in one O’Reilly book from 2024.
- Best for bug bounty hunters: Real-World Bug Hunting (about $42 to $50). Every chapter is built on disclosed bounty reports.
- Best for learning Burp Suite: Burp Suite Cookbook, 2nd Edition (about $52 on our check date). Task recipes for Repeater, Intruder, Scanner and DOM Invader.
- Best for GraphQL targets: Black Hat GraphQL (about $47 to $60). The only full book on attacking GraphQL APIs that we found.
- Best for building secure APIs: Secure APIs (about $52 to $60). The newest pick, from late 2025, with Python examples.
- Best for developers new to security: Grokking Web Application Security (about $41 to $60). Illustrated and stack-agnostic.
If you can only buy one this month, take the Hoffman book. It is the one general web book here that covers the same bug from the attacking side and the defending side. That habit is what bug bounty triagers and AppSec reviewers both reward.
How did we pick these books?
We started from the searches readers make (web application security books, bug bounty books, API security books) and from the full catalogs of No Starch, O’Reilly, Manning, Packt and Wiley. Only titles in print as a new paperback today stayed on the list. Edition, page count and publication date for every book come from Amazon catalog data pulled in October 2026, and where the No Starch or Manning page gives a different publication month, we use the publisher month. For the No Starch and Manning picks we also read the publisher page; the O’Reilly, Packt and Wiley sites would not load from our network, so those picks rest on the publisher description carried by the Amazon listing plus their GitHub repositories. We read the companion repositories and errata where a book has them. We did not run the labs end to end for this guide, and the sections below only claim what those sources show.
Each book had to pass three checks before it made the list:
- The linked ASIN is the print edition, and the cover in this guide shows that same edition.
- The book was written by a named author with a real publisher behind it, not self-published.
- Its content still maps to the web and API bugs that pay out today, or we say plainly where it doesn’t.
Some well-known titles are missing on purpose. The Web Application Hacker’s Handbook and Bug Bounty Bootcamp already sit in our OSCP book list, and Hacking APIs by Corey Ball is a pick in the penetration testing and red team books guide, so we did not repeat them here. We also skipped the wave of self-published bug bounty and XSS titles from 2025 and 2026, because nobody edited them and we could not vouch for their accuracy.
How do the ten books compare?
The table puts the publish year next to the focus of each book, which is the quickest way to rule titles in or out. Year matters more in this field than in most, because the vulnerable patterns move from server-rendered pages to SPAs, APIs and GraphQL faster than books get revised.
| Book | Publisher, year | Pages | Side | Best for |
|---|---|---|---|---|
| Web Application Security, 2nd Ed. | O’Reilly, 2024 | 441 | Attack and defense | First book |
| Real-World Bug Hunting | No Starch, 2019 | 264 | Attack | Bug bounty |
| Burp Suite Cookbook, 2nd Ed. | Packt, 2023 | 450 | Attack | Tool skills |
| Black Hat GraphQL | No Starch, 2023 | 320 | Attack and hardening | GraphQL APIs |
| Secure APIs | Manning, 2025 | 376 | Defense | API builders |
| Defending APIs | Packt, 2024 | 384 | Defense | API teams on a budget |
| Grokking Web Application Security | Manning, 2024 | 336 | Defense | Developers |
| A Beginner’s Guide to Web Application Penetration Testing | Wiley, 2025 | 352 | Attack | Complete beginners |
| Bug Bounty from Scratch | Packt, 2024 | 238 | Process | Running a bounty career |
| Attacking and Exploiting Modern Web Applications | Packt, 2023 | 338 | Attack | Advanced case studies |
Two things stand out. Only Real-World Bug Hunting predates 2023, so it is the one title where you should expect old targets and missing API chapters. The defense books cluster around APIs, which matches where breaches have moved. The general attack books still lean on the classic browser bugs (XSS, CSRF, SQL injection) that you can practice on a free lab such as DVWA on Kali Linux.
1. Web Application Security, 2nd Edition
Andrew Hoffman built the first edition around three pillars, reconnaissance, offense and defense, and the second edition keeps that frame while adding newer web technology and harder material in each chapter. O’Reilly published it in February 2024 at about 440 pages.
Who it suits: anyone who needs both halves of the job. The recon part teaches you to map an app you have no source code for. The offense part covers threat vectors and crafting payloads, and the closing part turns that into defenses and security practice for an engineering team. That order mirrors a real engagement, so it works as a first book for a hunter and as a shared text for a dev team. Pass on it if you already test apps every week, because a working pentester will recognize most of the attack chapters.
- The second edition (O’Reilly, February 2024) is a 441-page paperback.
- We found no companion repository, so the payloads live only in the text.
- The new price ran from about $36 to the $65.99 list price on our check date, and stock was thin, so check the current listing.
2. Real-World Bug Hunting
Peter Yaworski wrote the bug bounty book that teaches from paid reports instead of theory. Most of its chapters take one bug class and walk through disclosed reports that earned a bounty, so you see how a real hunter spotted the flaw, proved it and wrote it up.
Read it first if you understand HTTP and want to learn where bugs hide in production apps. The chapters include open redirects, parameter pollution, HTML injection and content spoofing, memory bugs, CSRF, CRLF injection, XSS, template injection, SQL injection, SSRF, XXE, remote code execution, subdomain takeover, race conditions, IDOR, OAuth flaws and logic bugs, then close with finding programs and writing reports.
The catch is age: it came out in July 2019 and has no API, GraphQL or JWT chapter. Some of the targeted apps have changed a lot since. Read it for the hunting mindset and the report structure, then use a newer book for API targets.
- No Starch published it in July 2019 as a 264-page paperback, and there is no newer edition.
- A tools appendix lists the proxies and recon utilities the reports rely on.
- New copies ran about $42 to $50, mostly from third-party sellers on our check date.
3. Burp Suite Cookbook, 2nd Edition
Dr. Sunny Wear wrote a recipe book for the proxy most web testers live in. Instead of explaining bug classes first, every recipe starts from a task (test a session token, fuzz a parameter, replay a request) and shows which Burp tool does it and how.
Who it suits: testers who know the bug classes but click around Burp without a plan. Its 11 chapters work through live tasks, Scanner, Intruder, Repeater, Decoder, DOM Invader, macros and extensions, then apply them to authentication, authorization, session management, business logic, SSRF, XXE, GraphQL and JWT attacks. Burp changes its interface often, and the book does not pin a Burp release in what we could read, so some menus will look different from your copy. If you’ve never opened Burp, our Burp Suite on Kali Linux guide gets the proxy running before you start the recipes.
- The second edition (Packt, October 2023) runs to 450 pages.
- The Amazon listing says the print edition comes with a free PDF eBook.
- Amazon sold it directly at about $52 on our check date.
4. Black Hat GraphQL
Nick Aleks and Dolev Farhi wrote the only book we found that is entirely about breaking GraphQL APIs, and it assumes no GraphQL background. A single GraphQL endpoint often exposes a whole schema, so the attack surface looks nothing like a REST API with dozens of routes.
Buy it if /graphql keeps showing up in the scope of the programs you hunt on. The chapters run from a GraphQL primer and lab setup through recon, denial of service, information disclosure, authentication and authorization bypass, injection, and CSRF, SSRF and cross-site WebSocket hijacking, ending with disclosed vulnerabilities and a testing checklist.
The tooling has already drifted: the repository for the book notes that InQL changed and tells you to install it from its v4 branch (4.0.7), and it lists errata for pages 83, 112 and 177. Read those notes before you set up the lab, or a few commands will not match what you see.
- No Starch published it in April 2023 as a 320-page paperback.
- The labs run against DVGA, a deliberately vulnerable GraphQL application.
- New copies ran about $47 to $60, mostly from third-party sellers on our check date.
5. Secure APIs
José Haro Peralta leads cybersecurity strategy at APISec and wrote Microservice APIs before this one, so Secure APIs comes from someone who builds APIs as well as attacks them. Manning dates it October 2025 (Amazon lists the paperback from November), which makes it the newest book on this list.
Who it suits: developers, architects and QA engineers who own an API and need to stop the bugs the attack books teach. Manning lists the OWASP Top 10 API security risks, security by design, zero-trust, automated API testing, and monitoring for threat detection, with case studies from e-commerce and ridesharing. The examples are in Python, and it adds tips on using LLMs in your own security testing. If you want to break APIs owned by others for bounties, it is the wrong book; read Hacking APIs from the pentest list instead.
- The first edition (Manning, October 2025) is a 376-page paperback.
- All code samples are Python, so a Go or Java shop will translate them.
- Amazon sold it directly at about $52, against a $59.99 list price, on our check date.
6. Defending APIs
Colin Domoney covers API defense from the root cause of each bug class to the gateway and firewall in front of it. Chris Wysopal and Isabelle Mauny wrote the forewords, and the price on our check date was the lowest of any pick here.
It fits API teams that work in more than one language. It walks the OWASP API Security Top 10, uses breach case studies to show how each weakness got exploited, and then splits the fixes into shift-left work in code and shield-right controls such as API gateways and firewalls. Defensive code appears in .NET, Python and Java. Compared with Secure APIs, it is broader on tooling and lighter on design, so it fits a platform team better than a single service owner.
- Packt published it in February 2024 at 384 pages.
- Code lives in the PacktPublishing/Defending-APIs repository on GitHub.
- Amazon sold it directly for about $29 on our check date, against a $46.99 list price, so check the current price.
7. Grokking Web Application Security
Malcolm McDonald created the Hacksplaining training site, and this book has the same illustrated, plain-language style. It explains how browsers and servers enforce security and how each attack breaks that enforcement, without tying you to one framework.
Web developers who need the mental model before the tools get the most from it. It covers the browser sandbox, the same-origin policy and cookies, input validation and output escaping, XSS, CSRF and clickjacking, SSL stripping and DNS poisoning, authentication, sessions and access control, injection and malicious file uploads, then supply-chain and API attacks.
It does not teach Burp or any scanner, so a tester who wants hands-on labs will outgrow it quickly. A developer who reads it will write fewer of the bugs the other nine books exploit, and that’s a fair trade for the money.
- Manning published it in May 2024 as a 336-page paperback.
- You only need basic web development knowledge to follow it.
- New copies ran about $41 to $60 on our check date, with some sellers quoting a 5 to 6 day ship time.
8. A Beginner’s Guide to Web Application Penetration Testing
Ali Abdollahi wrote the gentlest attack-side book on this list, and Wiley published it in January 2025. It follows the OWASP Top Ten categories and the five stages of a pentest, from scoping and recon to the final report.
Who it suits: students and sysadmins moving into security who want a structured first pass at web testing. Recon demos use Sublist3r, Subfinder and Nmap, all three packaged for Kali Linux, and the attack chapters cover OWASP Top Ten vulnerability classes such as XSS and SQL injection. Experienced hunters will find little new, and we could not confirm the full chapter list, so treat it as an on-ramp rather than a reference you’ll keep for years.
- It is a 352-page paperback from Wiley, dated January 2025.
- The five stages are scoping and recon, scanning, gaining and keeping access, analysis, and reporting.
- New copies ran about $47 to $53, with stock thin on our check date.
9. Bug Bounty from Scratch
Francisco Javier Santiago Vazquez wrote about the business side of bug bounty more than the bugs. That gap is real, since many new hunters find valid issues and still lose the payout to a duplicate, an out-of-scope asset or a report the triager can’t reproduce.
This one is for people who want bounty hunting as a side income and need the process mapped out. Its 13 chapters cover how programs and rewards work, choosing a program, building a methodology and a toolkit, a few advanced techniques, writing reports, and dealing with security teams and payouts. It is the shortest pick at 238 pages and light on hands-on labs, so pair it with Real-World Bug Hunting or the Burp cookbook for the technical half.
- Packt published it in June 2024, and the listing includes a free PDF eBook with the print copy.
- Report writing and program selection get chapters of their own.
- Amazon sold it directly at about $42 on our check date.
10. Attacking and Exploiting Modern Web Applications
Simone and Donato Onofri wrote a case-study book for people who already have the basics. Matteo Meucci, who led the OWASP Testing Guide for years, wrote the foreword, and each case maps to MITRE ATT&CK.
Intermediate testers who want full attack chains on targets they won’t meet in a beginner lab are the audience here. Its eight chapters cover SAML and single sign-on attacks, SQL injection and XSS against WordPress, and command injection and path traversal on an IoT device. The later chapters move to XSS that becomes remote code execution in Electron apps and to auditing Ethereum smart contracts in Solidity.
Across the book it works through three CTFs and seven real CVEs, and the tools are Burp, Python and Bash. It is not a catalog of bug classes, so a beginner should read picks 1 or 8 first.
- Packt published it in August 2023 at 338 pages.
- Code lives in the PacktPublishing/Attacking-and-Exploiting-Modern-Web-Applications repository.
- Amazon sold it directly at about $42 on our check date.
Which books match the current OWASP API Security Top 10?
Check a book’s year against the OWASP API Security Top 10 2023 before you trust its API chapter. The 2023 list renamed and merged categories, so an older book can teach the right bug under a label your auditor or bug bounty platform no longer uses. Three changes trip readers most:
- Mass Assignment and Excessive Data Exposure from 2019 are now one category, API3:2023 Broken Object Property Level Authorization.
- Server Side Request Forgery is a category of its own as API7:2023.
- Unrestricted Access to Sensitive Business Flows (API6:2023) covers abuse of features like checkout or sign-up that works as designed.
Real-World Bug Hunting predates the list entirely, and Hacking APIs (2022) still has a chapter called Mass Assignment, which is fine as long as you file the finding under API3 today. Manning describes Secure APIs as working through the OWASP Top 10 API risks, and Defending APIs covers the same list. We could not confirm which edition each one quotes, so check the category numbers against the OWASP page as you read.
Where can you practice what the books teach?
Only on targets you own or that a program puts in scope, and a free lab covers almost every chapter here. Reading about SQL injection without sending a payload builds very little skill, so set up one practice target before you open the attack books:
- DVWA runs on a Kali or Ubuntu VM and covers the classic browser bugs from picks 1, 2 and 8.
- The free PortSwigger Web Security Academy labs pair directly with the Burp Suite Cookbook.
- DVGA, the vulnerable GraphQL app used in Black Hat GraphQL, gives you a GraphQL endpoint to attack.
- Our manual SQL injection and sqlmap walkthrough runs the injection chapters end to end.
Developers reading the defense books should also run a scanner against their own staging app. OWASP ZAP is free, and a dynamic scan of staging shows which of the bugs these books describe a scanner catches and which ones still need a code review.
What does a 12-week reading plan look like?
Twelve weeks with three books is a realistic pace for someone working a day job, and it gets you from first payload to a first report you’d be happy to submit. Each step below ends on something you can check yourself:
- Weeks 1 to 4: read Web Application Security and reproduce each attack chapter on DVWA until the payload fires.
- Weeks 5 and 6: work through the Burp Suite Cookbook recipes for Repeater and Intruder against the same lab.
- Weeks 7 to 9: read Real-World Bug Hunting one chapter a day and solve the matching PortSwigger lab after each.
- Week 10: pick one API book (Black Hat GraphQL for hunters, Secure APIs for builders) and map its chapters to the 2023 OWASP API categories.
- Weeks 11 and 12: choose a public program with a wide scope, read its rules, and write one full report draft even if you find nothing.
Certifications follow naturally from that plan. If you want a credential next, the Security+ books cover the broad base, and the Kali Linux books build the tooling side for a later OSCP attempt.
