I have been working in web development for a fair amount of time. I am looking at developing in either Python (Django etc.) or PHP. I am new to security. Where do I begin looking? What are basic things I should have in mind? Basically, how do I get started with this? Apart from web related security, what do I go through?

  • Thanks a lot for the answer guys! It looks helpful to go through these sources.
    – ape
    May 22 '12 at 7:46

There are so many things to do and read that it's impossible to list them all all here. However, here is a collection of links to questions on this site to get you started:


Security is every where in this connected world. First of all, you should grab some security-related books to read, such as:

The Tangled Web: A Guide to Securing Modern Web Applications
The Web Application Hacker's Handbook: Finding and Exploiting Security Flaws
The Shellcoder's Handbook: Discovering and Exploiting Security Holes

You should constantly update your information against this vast field via forums, Twitter, LinkedIn groups, ...

Last but not least, I think you should keep your enthusiasm, your curiosity in every digital system: how it works, how people interacts with it, how to break security mechanism, ...

Good luck!


If you are going for PHP you might like this great book


It explains the acts that might expose your application and makes it vulnerable.

also you might like the "programing " chapter of this book


its a great start for beginners ,its divided into 4 parts: introduction,programing,networking ,cryptography


Well both of us are surely in the same boat.

I will simply list down a few things which have helped me a lot in my past few months ever since i ventured in the field of security.

http://www.securitytube.net - you will great videos which will help in understanding the theory you read elsewhere

http://www.happyhacker.org - Again a great site for good reading stuff.

Visiting security.stackexchange.com regularly and reading the previous posts has also helped me a lot. It is awesome!!

www.metasploit.com & www.backtrack-linux.org - Metasploit and BackTrack are definitely not things to play around with. But any 'beginner' must know of the best-in-business things

www.insecure.org - nmap i another great tool which you will find here and may want to look at. The site also offers other great reading stuff.

www.offensive-security.com - you can save this one when you feel you are crossing past the 'beginner' stage. They have a great post on Metaspolit, and they offer professional courses as well.


I did a blog post with a friend (@securityninja) on something similar - http://www.securityninja.co.uk/application-security/random-thoughts-on-education-learning-from-markofu/ - which you might find useful.

Additionally, Robin Wood has recently done some research on this topic. He presented it at BSides London recently and has posted his findings on his blog - http://www.digininja.org/projects/breaking_in_part_1.php.

There's a lot of information so I hope it's of help.


Where do I begin looking?

Start by looking around you. Security is about people dealing with technology. What are the challenges your friends, family, and peers are having with keeping their information secure? What are some solutions to their problems.

What are basic things I should have in mind?

Information has value that we are trying to protect, but it's value is not the same to everyone and protection takes different forms: confidentiality, integrity, availability. Learn what type of information needs what type of protection. Sometimes the protection is legally required (personal, medical, financial, etc).

Basically, how do I get started with this?

Read articles or books on security that interest you. Participate in discussions and forums. If you find an area of interest with like-minded people, you won't be able to stop.

Apart from web related security, what do I go through?

Learn about networking, system administration, risk and mitigation, and most importantly good written and spoken presentation.

Not the answer you're looking for? Browse other questions tagged or ask your own question.