Two things make this field awkward to self-teach. First, tool-centric books age badly — a walkthrough written against a specific framework version stops matching your terminal within a couple of years, while the underlying methodology stays valid for a decade. Second, almost none of the skills are legal to practice on infrastructure you do not own or have written authorization to test. Everything below assumes a home lab, a deliberately vulnerable target, or a platform that grants permission in its terms.
So read for methodology and mechanism first, and treat command syntax as disposable. The arc here is: how an engagement is structured, then how web applications break, then how memory and binaries break, then the tooling and credential layer that employers screen on.
Get the shape of an engagement
Start with The Hacker Playbook 3: Practical Guide To Penetration Testing by Peter Kim, which frames a test as a set of plays — reconnaissance, initial foothold, escalation, lateral movement, exfiltration — and covers the modern additions like assumed-breach and red team simulation. The football metaphor is a gimmick, but the structure it imposes is the real value.
Note the path also lists The hacker playbook 2. It is the earlier edition of the same series, and while it has lab material the third book drops, most readers should skip it unless you want the extra practice targets. Read one, not both.
Then Penetration Testing by Georgia Weidman, which is the best true beginner's book here. It walks you through building the lab, then moves through networking, exploitation, post-exploitation, and even a short mobile section, explaining the concept behind each step rather than just the command. If your background is thin, start with Weidman and come back to Kim.
Learn how things actually break
Web applications are where most real testing time goes, so The web application hacker's handbook by Dafydd Stuttard is the load-bearing book on this list. It is thorough on authentication, session handling, access control, injection, and logic flaws, and it teaches you to reason about an application's trust boundaries. The specific technologies have moved on since publication; the taxonomy of failure has not.
For the layer beneath, read Hacking by Jon Erickson. It is the one book here that makes you write C, read assembly, and watch a stack smash under a debugger. Modern mitigations mean the exact exploits no longer work as printed, which does not matter — the point is understanding why memory corruption is possible at all. Everything about exploit development downstream assumes this mental model.
Tooling, credentials, and the working reality
RTFM by Ben Clark is a field reference rather than a book to read through: dense command syntax for Windows, Linux, networking, and tooling, meant to sit open beside you during an engagement. Buy it late, use it constantly.
CEH Certified Ethical Hacker All-in-One Exam Guide, Fourth Edition by Matt Walker is here for a specific reason: certifications are a hiring filter in this industry, particularly for government and contractor roles. Studying it teaches you the vocabulary recruiters and HR use. It is not a substitute for hands-on capability, and many practitioners rate hands-on certifications higher — treat this as the credential layer, not the skill layer.
Close with Tribe of Hackers Red Team by Marcus J. Carey, a collection of interviews with working red teamers on how they got in, what they look for in hires, and what the job is like week to week. It answers the questions books about technique never address.
Two honest notes. Books do not confer authorization: testing systems without explicit written permission is a crime in most jurisdictions regardless of intent. And no reading list guarantees a role — this field hires on demonstrated hands-on work, lab writeups, and certifications, in roughly that order.
See the penetration tester career hub for adjacent security paths. Follow the full reading path to take these in order.
Follow the full ordered path here: Best Books to Become a Penetration Tester, in Order.
