A practical, no-fluff roadmap for going from zero to your first paid pentest engagement. Built for self-learners who want to know what to study, in what order, and with which tools — without drowning in information.
When you start in offensive security, the biggest problem is not lack of resources — it's too many of them, and no clear order.
This roadmap solves that by giving you:
- A linear path through the major skills (recon → scanning → exploitation → post-exploitation → reporting)
- The specific tools used at each phase, with the commands you'll actually type
- The best free resources (TryHackMe rooms, HackTheBox boxes, PortSwigger labs, books, YouTube channels) — curated, not dumped
- Cheat sheets for the things you'll forget and look up 100 times
- A reporting template so you can document findings like a professional from day one
It is opinionated. If you follow it end-to-end, you will be able to attempt the eJPT, CPTS, or OSCP with a real foundation.
- Beginners who already know basic Linux and networking, and want to learn practical offensive security
- Self-taught learners who want a structured plan instead of "watch random YouTube videos"
- People preparing for entry-level certs (eJPT, PNPT, CPTS, OSCP)
- Anyone tired of bookmarking 500 articles and never reading them
Not for: complete beginners with zero IT background. If you don't know what an IP address is or how to use a Linux terminal, start with 00-getting-started/prerequisites.md first.
┌──────────────────────────────┐
│ 00. Getting Started │
│ Lab, mindset, legal, ethics │
└──────────────┬────────────────┘
│
┌───────────────────────┼───────────────────────┐
▼ ▼ ▼
┌────────────────┐ ┌────────────────┐ ┌────────────────┐
│ 01. Recon │ ───▶ │ 02. Scanning & │ ───▶ │ 03. Web App │
│ OSINT, passive │ │ Enumeration │ │ OWASP Top 10 │
└────────────────┘ └────────────────┘ └────────┬───────┘
│
┌────────────────┐ │
│ 04. Exploitation │ ◀───────────┘
│ Network + Web │
└────────┬─────────┘
│
┌────────▼─────────┐
│ 05. Post-Exploit │
│ PrivEsc, Pivot │
└────────┬─────────┘
│
┌────────▼─────────┐
│ 06. Reporting │
│ Write the report │
└──────────────────┘
| Folder | What's inside |
|---|---|
00-getting-started/ |
Set up your lab (Kali / Parrot / VMs), required prerequisites, legal & ethical boundaries |
01-reconnaissance/ |
Passive recon, OSINT, subdomain discovery, Google dorking |
02-scanning-enumeration/ |
Nmap, service enumeration, SMB/FTP/SSH/HTTP enumeration |
03-web-application/ |
OWASP Top 10, Burp Suite, sqlmap, XSS, SSRF, IDOR, auth flaws |
04-exploitation/ |
Metasploit, public exploits, manual exploitation, payload generation |
05-post-exploitation/ |
Linux & Windows privilege escalation, persistence, lateral movement |
06-reporting/ |
Pentest report template, executive summary, finding write-ups |
resources/ |
Curated platforms, books, courses, YouTube channels, certifications |
cheatsheets/ |
Quick reference: nmap, reverse shells, payloads, Burp, privesc |
labs/ |
Recommended TryHackMe / HackTheBox / OWASP Juice Shop path |
- Week 1–2:
00-getting-started/— build your lab, learn the rules - Week 3–6:
01-reconnaissance/+02-scanning-enumeration/— recon & enumeration are 60% of every pentest - Week 7–14:
03-web-application/— finish PortSwigger Web Security Academy for free - Week 15–18:
04-exploitation/+05-post-exploitation/— start HackTheBox Starting Point and easy boxes - Week 19–22:
06-reporting/— write reports for every box you pwn - Week 23+: Take eJPT ($200) or grind toward OSCP
Jump straight into cheatsheets/ and resources/.
- Check the
cheatsheets/for the relevant technique - Use the recon / enum / exploitation order — never skip enumeration
- After you pwn the box, write it up with the
06-reporting/template
- Enumerate harder. 80% of "I'm stuck" moments are missing enumeration. Re-scan, re-read banners, re-list directories.
- Take notes from day one. Use Obsidian, Notion, or markdown files. Future-you will thank past-you.
- Never run tools you don't understand on systems you don't own. Read
00-getting-started/legal-ethics.md. This is not optional. - Build before you break. Setting up a vulnerable VM (DVWA, Metasploitable) teaches you more than 10 walkthroughs.
- Write the report. A vulnerability with no report is a wasted vulnerability. Practice reporting on every box.
- 🧪 Free practice platforms: TryHackMe · HackTheBox · PortSwigger Academy · OverTheWire
- 📚 Reference docs: HackTricks · PayloadsAllTheThings · GTFOBins · LOLBAS
- 🎓 Affordable certs (in order): eJPT → PNPT → CPTS → OSCP
Found a broken link, outdated tool, better resource? PRs welcome. Keep entries concise and actionable — no marketing fluff.
MIT — use it, fork it, share it.
Maintained by @nodirsafarov. If this saved you time, star the repo so others can find it.