🚀 Penetration Testing Roadmap

 

Phase 1:  The Foundation (Months 1-2) – “Learn to Walk”

This phase is about understanding the landscape and the core concepts. You cannot attack what you don’t understand.

Content Section	Key Concepts & How to Learn	Icon
1. Core Networking Knowledge	Concepts: TCP/IP model , OSI Model, IP addresses, subnets, DNS, HTTP/HTTPS, routers, switches, firewalls.
How to Learn: Course: Watch Professor Messer’s CompTIA Network+ video series (YouTube). Book: “Network+ All-in-One Guide” by Mike Meyers.
2. Basic Computer & OS Knowledge	Linux (Primary OS): Install a Virtual Machine (e.g., VirtualBox ) with Kali Linux . Learn commands: ls, cd, grep, find, chmod, ps, and service management.
Windows: Understand basic command line (cmd and PowerShell), file system, and user management.
3. Introduction to Cybersecurity Concepts	Concepts: Confidentiality, Integrity, and Availability (CIA Triad ). Vulnerabilities, threats, and risks. Authentication vs. Authorization.
How to Learn: Free introductory courses on Coursera (e.g., Google’s Cybersecurity Certificate) or Cybrary.it.

Export to Sheets

---

Phase 2:  Core Penetration Testing Skills (Months 3-6) – “Learn to Run”

This is the hands-on phase where you start using the tools and methodologies.

Content Section	Key Concepts & Tools	Icon
1. The Hacking Methodology	Follow a structured approach like the PTES : Pre-engagement, Intelligence Gathering, Threat Modeling, Vulnerability Analysis, Exploitation, Post-Exploitation, and Reporting.
2. Essential Tools & Techniques	Reconnaissance: whois, nslookup, dig, theHarvester, Maltego .
Scanning & Enumeration: Master Nmap  (all scan types). Get familiar with Vulnerability Scanners like Nessus or OpenVAS.
Exploitation: Learn the Metasploit Framework  (searching, using, configuring exploits/payloads).
Post-Exploitation: Privilege escalation, pivoting, and maintaining access.
Web Application Hacking: Focus on the OWASP Top 10 (SQLi, XSS, CSRF, etc.) . Tools: Burp Suite  (industry standard) and OWASP ZAP.
How to Learn This Phase	Platforms: TryHackMe  (start with “Jr. Penetration Tester” path). Hack The Box (start with “Starting Point”). Course: TCM Security’s “Practical Ethical Hacking” .

Export to Sheets

---

Phase 3:  Practice & Specialization (Months 6-9) – “Become an Athlete”

Now you need to solidify your skills and start looking like a professional.

Content Section	Key Focus Areas	Icon
1. Intense Practice	Continue challenging yourself on TryHackMe and Hack The Box. Explore PortSwigger’s Web Security Academy  for web app practice.
2. The Art of Reporting	Structure: Executive Summary, Technical Details, Risk Rating (CVSS), Proof of Concept, Remediation Steps. Your marketing background is an asset!
Practice: Write a simple report for every machine you compromise.
3. Choose an Initial Specialization	Deepen your knowledge in one area: Web Application Pentesting (OWASP Top 10 mastery) or Network Pentesting (Active Directory  exploitation).

Export to Sheets

---

Phase 4:  Preparation for the Interview & Job (Month 9+)

Content Section	Key Preparation Steps	Icon
1. Get a Certification	Highly Recommended Starter Certs: CompTIA PenTest+ or the practical eLearnSecurity Junior Penetration Tester (eJPT). This provides concrete evidence of your skills.
2. Build a “Home Lab”	Set up a virtual network with vulnerable machines (e.g., from VulnHub) and document your process in a GitHub repository or blog . This is your portfolio!
3. Prepare for the Interview	Technical: Be ready to explain the OWASP Top 10 and walk through a full methodology. Scenario-Based: Practice your professional response to finding a critical bug. Your Story: Be ready to confidently explain your transition, initiative, and passion for the field.