Linux

Start with The Linux Command Line by William Shotts. It will take you from nothing to competent. Using this book alone you should be able to figure out the OverTheWire Bandit challenges.
If you are inclined, you can follow this up with How Linux Works by Brian Ward for some recap as well as a deeper dive into some more system administration focused topics that are just touched on in TLCL. Web security is basically just an application of development operations so these are important things to understand before proceeding. Understand how systems are built before attempting to break them. This book also gives you an extremely beginners introduction into how the kernel itself works which should be all you ever need if you are just going into webapp security.

I would also bookmark The Linux Documentation Project and go through it at your own pace if you want.
https://tldp.org/

If you really want to apply your Linux knowledge to some final lab then consider following the Linux From Scratch project:
https://www.linuxfromscratch.org/lfs/
It will have you build a Linux system from source so you'll encounter really everything there is to know on the user's end and how the filesystem is laid out.

Scripting/Python

My personal recommendation is to start with Python because it's such an incredible swiss army knife for hacking oriented tasks. I really like Python Crash Course by Eric Matthes because it's really two books in one: the first half is a typical beginners textbook, and the second half is divided 3 "real-world" projects. Data visualization, game development, and web development. You don't have to be interested in these things for following them to be useful. What this should accomplish is demystifying software development so you have an idea on how the systems you will be attacking are created.

I would then recommend that you follow that up with another book to really drill in the concepts and to provide another teaching style and set of exercises. For this task I'd personally recommend Learn Python 3 the Hard Way by Zed Shaw.

At this point my favorite resource is Python 3 Module of the Week:
https://pymotw.com/3/
Also available as reference textbook called Python 3 Standard Library by Example.
This project divides many interesting libraries from the Python STL into categories. If you are already decent at scripting logic, knowing how to use these libraries will be extremely helpful in aiding you to create your own tools and short scripts to accomplish tasks instead of relies on niche and archaic hacking tools you find on github. Just look how massive pentesting distro package repos are for yourself: https://blackarch.org/tools.html

Here are some websites that you can use for more coding exercises. You don't need to be a perfect programmer, but you should be able to brute force your way through easy to medium challenges pretty easily I think.
https://edabit.com/
https://www.codewars.com/
https://leetcode.com/
https://projecteuler.net/

Networking

My only recommendation here has always just been Computer Networking: A Top-Down Approach by James F. Kurose and Keith Ross. It has a "focus on security" throughout the book and an entire chapter on network security. I would urge you to not read this cover to cover but instead to be diligent in determining what parts of the book will help you in webapp security. Really take notes and study the ins and outs of the application layer especially.

That book contains exercise questions and both WireShark labs and Python Network Programming (with sockets) labs. These are extremely valuable labs to do and I highly recommend taking those seriously. If either of those things interests you enough to read additional material on them, consider reading Practical Packet Analysis by Chris Sanders.

Foundations of Python Network Programming by Brandon Rhodes and John Goerzen.

At this point you have an extremely solid foundation for beginning security oriented research. If you want more fundamentals then there are some sub-topics that could be useful to you in doing CTFs, for example web scraping (Web Scraping with Python by Ryan Mitchell) and web development (consider William Vincent's book series on Django development, maybe a book on JS/React/NodeJS, and maybe even something on HTML/CSS like CSS In Depth could be helpful).

At this point I would recommend starting The Web Application Hacker's Handbook by Dafydd Stuttard and Marcus Pinto because it's the only resource I've seen to date to really teach methodology and drill in HOW to find web exploits not just "how to hax0rz" like some bad tutorial or guide written by someone who forgot what it's like to be a beginner. Then just move onto doing as many CTF challenges as you can. You should know enough at this point how to intelligently research a specific topic if there is a challenge you are having trouble understanding. The knowledge and experience you gain from doing CTFs will continue to lead to the next CTF.

If you want more books I would recommend flipping through the Sec+ and PenTest+ certification study guides because they should act as an appropriate check list for what things you "should know" as a beginner in security from the industry's perspective. PenTest+ in particular will give you insight into non-technical aspects of pentesting that isn't talked about as much I think.

Remember to take it slow and easy and enjoy the ride.

Artificial Intelligence: A Modern Approach

Pattern Recognition by Christopher Bishop
-Introduction to Statistical Learning with Applications in R
-Learning from Data Yaser-Abu-Mostafa

Now you can go and practice with books like
-Hands-On Machine Learning with Scikit-Learn, Keras, and TensorFlow, 2nd Edition
-Data mining algorithms in C++

To gain some sort of graduate understanding :

-Statistical Inference Casella and Berger or All of Statistics Larry Wasserman
-Convex Optimization by Stephen Boyd
-Elements of Statistical Learning
-Deep Learning by Ian Goodfellow.

More interesting books
-Learning from Data - Yaser Abu-Mostafa - rapid intro highly recommended
-Information Theory, Inference, and Learning Algorithms - unironically god tier book

Edit
Pub: 22 Feb 2022 20:36 UTC
Views: 65