Roadmap
A step-by-step learning path from zero to advanced cybersecurity.
Follow the phases in order. Each phase builds on the last.
New notes are added regularly — check back often.
Phase 1 — Foundations
Start here. No experience needed.
Build your base before touching any tools. If you skip this, everything else will be harder.
- Networking Basics — IP, TCP/UDP, DNS, ports, OSI model, how the internet works
- Linux for Security — terminal commands, file system, permissions, bash basics
- Security Analyst Basics — CIA triad, threats, vulnerabilities, core security terminology
When you finish Phase 1 you should be comfortable in a Linux terminal and understand how networks communicate.
Phase 2 — Recon and Enumeration
Learn how to find things before you attack anything.
- Enumeration Basics — scanning methodology, banner grabbing, attack surface mapping
- Nmap Basics — port scanning, service and OS detection, NSE scripts, output formats
- OSINT Basics — finding information from public sources, Google dorking, tools
When you finish Phase 2 you should be able to scan a target network and gather open-source intelligence on a target.
Phase 3 — Web Application Security
Understand how the web works and how it breaks.
- Web Application Testing Basics — HTTP, requests, responses, cookies, how web apps work
- Burp Suite Basics — intercepting traffic, repeater, intruder, decoder
- Authentication and Sessions — cookies, tokens, session hijacking, broken authentication
- SQL Injection Basics — in-band, blind, union-based SQLi, sqlmap, mitigations
- XSS Basics — reflected, stored, DOM-based XSS, payloads, CSP, mitigations
When you finish Phase 3 you should be able to identify and manually test the most common web vulnerabilities using Burp Suite.
Phase 3b — Web Vulnerabilities Advanced
These notes extend Phase 3 with deeper attack techniques.
File Inclusion — LFI and RFI
Command Injection
SSRF — Server-Side Request Forgery
CSRF — Cross-Site Request Forgery
XXE — XML External Entity
IDOR — Insecure Direct Object Reference
When you finish Phase 3b you can identify and test all major OWASP Top 10 web vulnerabilities manually.
Phase 4 — Attack Tools and Techniques
Learn the tools used in real engagements.
- Password Attacks Basics — wordlists, Hydra, John the Ripper, Hashcat, hash cracking, spraying
- Metasploit Basics — framework overview, modules, exploits, payloads, Meterpreter, msfvenom
When you finish Phase 4 you should be able to run common attack tools in a controlled lab environment.
Phase 4b — Tools and Workflow
Essential tools used in almost every CTF and pentest.
Gobuster Basics
ffuf — Fast Web Fuzzer
Wireshark Basics
Netcat and Socat
CyberChef Guide
When you finish Phase 4b you can perform directory brute forcing, capture and analyse network traffic, transfer files, create shells, and decode any encoding you encounter.
Phase 5 — Blue Team and Detection
Learn how defenders think, monitor, and respond.
- Log Analysis Basics — reading system, auth, and application logs, finding suspicious activity
- SIEM Basics — what a SIEM does, log ingestion, correlation rules, alert triage
- Incident Response Basics — IR lifecycle, preparation, detection, containment, eradication, reporting
When you finish Phase 5 you will understand how defenders detect and respond to the attacks covered in Phases 3 and 4.
Phase 6 — Advanced Offensive Topics
Harder concepts. Requires everything before this.
- Privilege Escalation Intro — Linux and Windows privesc concepts, common misconfigurations
- Active Directory Basics — AD structure, users, groups, GPO, common attacks
- Red Teaming vs Pentesting — methodology, differences, engagements, reporting
- CTF Tips for Beginners — categories, tools, mindset, platforms, common mistakes
When you finish Phase 6 you have a strong all-round foundation in both offensive and defensive security and are ready for certifications or deeper specialization.
Suggested Order for Complete Beginners
Follow this exact sequence if you have never studied cybersecurity before:
- Networking Basics
- Linux for Security
- Security Analyst Basics
- Enumeration Basics
- Nmap Basics
- OSINT Basics
- Web Application Testing Basics
- Burp Suite Basics
- Authentication and Sessions
- SQL Injection Basics
- XSS Basics
- Password Attacks Basics
- Metasploit Basics
- Log Analysis Basics
- SIEM Basics
- Incident Response Basics
- Privilege Escalation Intro
- Active Directory Basics
- Red Teaming vs Pentesting
- CTF Tips for Beginners
Coming Soon — What We Are Adding Next
These notes are being written and will be published to this hub.
Tools and Workflow
- Nikto — web server scanning basics
Active Directory (Advanced)
- Kerberoasting — how it works and how to crack tickets
- Pass-the-Hash — lateral movement with stolen NTLM hashes
- BloodHound — AD enumeration and attack path visualization
- AS-REP Roasting — targeting accounts without pre-auth
- Domain Privilege Escalation paths
Windows Security
- Windows Privilege Escalation — common techniques and tools
- Windows Persistence Basics — registry, services, scheduled tasks
- PowerShell for Security — recon and attack scripts
Forensics and Blue Team (Advanced)
- Memory Forensics Intro — Volatility basics, process analysis
- Disk Forensics Basics — artifacts, timeline analysis
- Malware Analysis Intro — static and dynamic analysis
- Threat Hunting Basics — hypothesis-driven hunting
- Detection Engineering Basics — writing detection rules
Career and Certifications
- CompTIA Security+ Study Notes
- eJPT Exam Prep Guide
- TryHackMe Learning Path Guide
- Building a Home Lab — VMs, networking, vulnerable machines
- Writing a Pentest Report — structure, findings, severity ratings
- Bug Bounty Basics — how to start, platforms, methodology
How This Hub Grows
Notes are added based on:
- what the community asks for in Discussions
- what topics come up on TryHackMe and real learning paths
- what is most useful for students going into security analyst or pentesting roles
If you want a topic added, open a discussion or suggest it in the repo.