Ethical Hacking Roadmap 2024: From Zero to Professional

[Blacksec]

Ethical Hacking Roadmap 2024: From Zero to Professional ​

---

> Posted by: zero_to_hero | Rank: Elite Member | Joined: 2022 [/I]

---

Spoiler: Prerequisites

• No prior experience needed
• Willing to learn and practice
• Legal mindset (always test on authorized targets)

Alright, you wanna get into hacking? Good choice. But first - let me save you 2 years of messing around.

I started exactly where you are right now. Confused, overwhelmed, watching random YouTube tutorials. Here's the roadmap I wish I had.

---

━━━ PHASE 1: FOUNDATIONS (Months 1-3) ━━━[/B]

Don't skip this. I repeat - DON'T SKIP THIS.

MONTH 1: Computer Basics
├── How computers work (CPU, RAM, Storage)
├── Binary & hexadecimal basics
├── File systems (NTFS, ext4, APFS)
└── Basic networking (IP addresses, ports, protocols)

MONTH 2: Linux Fundamentals
├── Install Kali Linux (dual boot or VM)
├── Command line mastery
├── File permissions & ownership
├── Bash scripting basics
└── Package management (apt, pacman)

MONTH 3: Networking Deep Dive
├── OSI Model (all 7 layers)
├── TCP/IP protocol suite
├── Subnetting & CIDR notation
├── DNS, HTTP/HTTPS, FTP, SSH
└── Wireshark basics - read packet captures

Free Resources:

• NetworkChuck YouTube - Networking playlists
• Professor Messer - CompTIA Network+
• TryHackMe - Pre-Security path
• OverTheWire - Bandit wargame (Linux basics)

---

━━━ PHASE 2: PROGRAMMING (Months 4-6) ━━━

You don't need to be a developer. But you MUST know how to read and write code.

MONTH 4: Python - Your Primary Weapon
├── Variables, data types, loops
├── Functions & modules
├── File handling & error handling
├── Requests library (HTTP requests)
├── Scapy (packet manipulation)
└── Build: Simple port scanner

MONTH 5: Bash Scripting
├── Automating repetitive tasks
├── Parsing text with grep, awk, sed
├── Looping through files
└── Build: Automated recon script

MONTH 6: Web Technologies
├── HTML/CSS basics
├── JavaScript fundamentals
├── How web apps work (client/server)
├── REST APIs & JSON
└── SQL basics for web apps

Python Hacking Scripts to Build:

#!/usr/bin/env python3
"""
Beginner Project: Port Scanner
"""
import socket
import concurrent.futures

def scan_port(host, port):
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(0.1)
        result = sock.connect_ex((host, port))
        if result == 0:
            return f"Port {port}: OPEN"
        sock.close()
    except:
        pass
    return None

def scan_host(host, ports=1024):
    print(f"[*] Scanning {host}...")
    with concurrent.futures.ThreadPoolExecutor(max_workers=50) as executor:
        results = executor.map(lambda p: scan_port(host, p), range(1, ports+1))
    for r in results:
        if r:
            print(f"  [+] {r}")

if __name__ == "__main__":
    import sys
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    scan_host(sys.argv[1])

---

━━━ PHASE 3: WEB APP HACKING (Months 7-9) ━━━

This is where it gets fun. Web apps are the most common attack surface.

MONTH 7: HTTP & Web Basics
├── Request/Response cycle
├── Headers, cookies, sessions
├── HTTP methods (GET, POST, PUT, DELETE)
├── Status codes (200, 301, 403, 404, 500)
└── Burp Suite basics - intercept & modify

MONTH 8: OWASP Top 10 (The Bible)
├── Injection (SQLi, Command Injection)
├── Broken Authentication
├── Sensitive Data Exposure
├── XSS (Reflected, Stored, DOM)
├── Broken Access Control
├── Security Misconfiguration
├── CSRF
├── Vulnerable Components
└── SSRF

MONTH 9: Practice Labs
├── OWASP WebGoat (Java-based)
├── OWASP Juice Shop (Node.js)
├── DVWA (Damn Vulnerable Web App)
├── PortSwigger Web Security Academy (FREE!)
└── TryHackMe - Web Fundamentals path

PortSwigger Academy - Best Free Resource:

https://portswigger.net/web-security

• SQL Injection
• XSS
• Authentication bypass
• Access control
• Server-side request forgery
• File inclusion
• And 50+ more topics

Each topic has:
- Theory explanation
- Hands-on lab
- Solution walkthrough

---

━━━ PHASE 4: NETWORK ATTACKS (Months 10-12) ━━━

MONTH 10: Network Recon & Scanning
├── Nmap deep dive
├── Network mapping
├── Service enumeration
├── OS fingerprinting
└── Firewall evasion basics

MONTH 11: Exploitation Frameworks
├── Metasploit Framework
├── Searchsploit (local exploit database)
├── Exploit-DB
├── Manual exploitation basics
└── Post-exploitation fundamentals

MONTH 12: Wireless & Physical Security
├── WiFi hacking (Aircrack-ng)
├── Bluetooth security
├── RFID cloning basics
└── USB attacks (BadUSB, Rubber Ducky)

---

━━━ PHASE 5: SPECIALIZATION (Year 2) ━━━

Now you choose your path. Don't try to learn everything.

Choose ONE primary focus:

🔹 WEB APP SECURITY
   - Advanced OWASP Top 10
   - API security testing
   - Bug bounty hunting
   - Tools: Burp Pro, OWASP ZAP, Nuclei

🔹 NETWORK SECURITY
   - Active Directory attacks
   - Network pivoting
   - Lateral movement
   - Tools: Impacket, CrackMapExec, BloodHound

🔹 INFRASTRUCTURE SECURITY
   - Cloud security (AWS, Azure, GCP)
   - Container security (Docker, Kubernetes)
   - Infrastructure hardening
   - Tools: Prowler, ScoutSuite, kube-hunter

🔹 MALWARE ANALYSIS
   - Static analysis
   - Dynamic analysis
   - Reverse engineering
   - Tools: Ghidra, IDA Pro, Cuckoo Sandbox

🔹 RED TEAM OPERATIONS
   - Full-scope penetration testing
   - Social engineering
   - Physical security
   - Tools: Cobalt Strike, Caldera, Sliver

---

━━━ CERTIFICATIONS ROADMAP ━━━

ENTRY LEVEL (Do these first):
✅ eJPT - eLearnSecurity Junior Penetration Tester
   - Hands-on, practical exam
   - ~$300, 24 hours to complete
   - Best first cert

✅ PNPT - Practical Network Penetration Tester
   - Real-world scenario
   - Includes reporting
   - ~$449

INTERMEDIATE:
✅ OSCP - Offensive Security Certified Professional
   - The gold standard
   - 24-hour exam
   - ~$1,649
   - HR filters look for this

✅ eWPT - eLearnSecurity Web Application Penetration Tester
   - Web-focused alternative to OSCP
   - ~$300

ADVANCED:
✅ OSWE - Advanced Web Attacks & Exploitation
   - Code-level web exploitation
   - ~$1,649

✅ CRTP - Certified Red Team Professional
   - Active Directory focused
   - ~$400

---

━━━ LAB SETUP (DO THIS NOW) ━━━

Option 1: Virtual Lab (Recommended for beginners)
├── VirtualBox or VMware Player (FREE)
├── Kali Linux VM (attacker)
├── Metasploitable 2 (vulnerable target)
├── OWASP WebGoat (web app vulns)
└── TryHackMe subscription ($10/month)

Option 2: Cloud Lab (Advanced)
├── AWS Free Tier account
├── Create vulnerable instances
├── Practice cloud security
└── Learn incident response

Option 3: Bug Bounty (Real World)
├── HackerOne or Bugcrowd account
├── Start with VDPs (no reward, just practice)
├── Move to paid programs
└── Build your rep

My Recommended Lab Setup:

# Create your lab with Docker
docker pull secfigures/waitforit
docker run -d -p 80:80 -p 443:443 secfigures/waitforit

# Or use HackTheBox Academy
# $10/month for unlimited labs

# Or TryHackMe
# $10/month, best for beginners

---

━━━ DAILY ROUTINE OF A PRO ━━━

07:00 - Check security news (Reuters, Threatpost)
07:30 - Read 1-2 new vulnerability reports
08:00 - Lab time (HTB/TryHackMe machines)
12:00 - Lunch + browse r/netsec, r/cybersecurity
13:00 - Deep dive into one topic
15:00 - Write notes/blog post about what you learned
17:00 - Code a small tool or script
19:00 - CTF competition or lab challenge
21:00 - Review day, plan tomorrow

WEEKEND:
• 1 full CTF competition
• 1 new tool to learn
• 1 vulnerability to research deeply
• Rest (don't burn out)

---

━━━ COMMON MISTAKES TO AVOID ━━━

❌ DON'T just follow tutorials without understanding
✅ DO try to break things yourself first

❌ DON'T collect tools without learning them
✅ DO master 3-5 tools deeply

❌ DON'T skip the basics
✅ DO build strong foundations

❌ DON'T hack without authorization
✅ DO only test on systems you own

❌ DON'T compare your progress to others
✅ DO focus on your own journey

❌ DON'T give up when things get hard
✅ DO embrace the struggle - it builds skill

❌ DON'T stop learning
✅ DO stay curious forever

---

━━━ TL;DR ━━━

✅ Months 1-3: Linux + Networking basics
✅ Months 4-6: Python + Programming
✅ Months 7-9: Web App Security + OWASP
✅ Months 10-12: Network Attacks + Exploitation
✅ Year 2: Pick your specialization
✅ Always practice in legal labs
✅ Get eJPT first, then OSCP
✅ Join communities (Discord, Reddit, Twitter)

---

What's your current level? Drop a comment and I'll help you plan.
Next: Active Directory attack lab walkthrough.

Last edited by zero_to_hero; 15 minutes ago.

---

[SIG]━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
zero_to_hero | Elite Member | Security Researcher
"The expert in anything was once a beginner"
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━[/SIG][/b][/b][/b][/b][/b][/b][/b][/b][/b]