The Ethical
Hacking Roadmap
2026

Almost every attack and every defense sits on top of networking concepts. Get comfortable with the OSI and TCP/IP models, IP addressing and subnetting, DNS, DHCP, routing, and how HTTP/HTTPS actually move data. Without this, tool output from scanners and proxies is just noise you can't interpret.

Nearly every security tool ships Linux-first. Get fluent with the filesystem, permissions, process management, package managers, and shell scripting in Bash. Install a distro like Kali Linux or Parrot OS and live in the terminal — GUI-only comfort will slow you down at every later stage.

You don't need to be a software engineer, but you do need to read and write code. Start with Python for automation and scripting, and pick up enough Bash for one-liners. Understanding how code actually executes is what separates running a tool from understanding what it's doing.

Most corporate environments run on Windows and Active Directory, so most real-world engagements target it. Learn user/group management, Group Policy, NTFS permissions, and how domain authentication generally works — this context makes later AD attack paths make sense instead of feeling like magic.

Before touching any offensive tool, understand what makes testing legal: written authorization, defined scope, and rules of engagement. Learn the basics of laws relevant to your country (e.g. computer misuse legislation) and what a scope document and a get-out-of-jail letter actually look like. Skipping this step isn't a shortcut — it's a career-ending mistake.

Every security decision maps back to Confidentiality, Integrity, and Availability. Learn how vulnerabilities, threats, and risk relate to each other, and get familiar with common frameworks like MITRE ATT&CK for describing attacker behavior in a structured way. This vocabulary is what lets you communicate findings clearly later.

Set up a virtualized lab using VirtualBox or VMware with a Kali Linux attacker box and deliberately vulnerable target VMs. This gives you a safe, fully legal environment to practice everything that follows — never run offensive tools against systems you don't own or lack written permission to test.

Platforms like TryHackMe, HackTheBox, and VulnHub host machines specifically designed to be tested legally. Start with beginner-friendly rooms and paths that teach one concept at a time, and resist jumping to advanced boxes before the fundamentals from Phase 01 feel automatic.

Real engagements follow a repeatable structure, generally: reconnaissance → scanning → enumeration → exploitation → post-exploitation → reporting. Learn this flow before diving into individual tools — it gives every tool you learn later a clear place in the process instead of feeling random.

Use a tool like Obsidian, Notion, or CherryTree to log every machine, concept, and command you learn from day one. This habit compounds — your notes become both a personal reference and, later, the foundation of the writeups and reports that certifications and jobs actually require.

Learn the difference between passive recon (gathering public info without touching the target — WHOIS, DNS records, job postings, LinkedIn) and active recon (direct interaction like ping sweeps and port scans). Most real engagements start entirely passive to avoid tipping off defenders early.

Nmap is the industry-standard tool for discovering live hosts, open ports, and running services. Learn scan types (TCP connect, SYN, UDP), timing options, and service/version detection. Understanding what each scan actually does on the wire matters more than memorizing flags.

Once you know what ports are open, dig into what's actually running: web servers, SMB shares, FTP, SSH banners, and database services. Learn tools like enum4linux, smbclient, and gobuster/ffuf for content discovery. This step turns a scan result into an actual attack surface map.

Learn to use automated scanners like Nessus, OpenVAS, or Nikto to surface known vulnerabilities, then cross-reference findings against sources like the NVD (National Vulnerability Database) and Exploit-DB. Automated scanners are a starting point, not a final answer — always verify findings manually before trusting them.

Practice turning raw scan output into a clean, structured recon summary: open ports, running services and versions, and a prioritized list of what looks worth investigating further. This habit — documenting as you go rather than after — is exactly what real client-facing pentest reports require.

The OWASP Top 10 is the standard reference for the most common and impactful web application vulnerabilities — injection flaws, broken authentication, broken access control, security misconfiguration, and more. Study each category's root cause, not just its name, before touching a single tool.

Burp Suite is the standard tool for intercepting, inspecting, and modifying web traffic between browser and server. Learn the Proxy, Repeater, and Intruder tabs deeply — most web testing work happens inside this single tool, and fluency here is a genuine career differentiator.

Understand why injection flaws happen — unsanitized input reaching a query or shell — and practice identifying and demonstrating them on legal lab environments like PortSwigger's Web Academy or DVWA. Learn both manual testing and how tools like sqlmap automate the process, so you understand what's happening underneath the automation.

Learn the difference between reflected, stored, and DOM-based XSS, and how Cross-Site Request Forgery abuses a user's authenticated session. Practice identifying and demonstrating impact safely in lab environments, and study the defenses (CSP, output encoding, CSRF tokens) alongside the attacks — understanding the fix is half the skill.

Study weak password policies, broken session management, IDOR (Insecure Direct Object Reference), and privilege escalation within web apps. These logic-level flaws are consistently among the highest-paying and most commonly found issues in real bug bounty programs, precisely because they can't be caught by automated scanners alone.

Learn how outdated services, weak configurations, and known CVEs on hosts get exploited using frameworks like Metasploit, always inside your lab or authorized scope. Focus on understanding the exploit's mechanism, not just firing a module — that understanding is what lets you explain impact to a client afterward.

Getting initial access is rarely the finish line — real engagements need privilege escalation to demonstrate actual business impact. Practice enumeration scripts (LinPEAS, WinPEAS), misconfigured permissions, and kernel/service exploits on lab machines, always documenting the exact path from low-privilege to admin/root.

Study — at a conceptual level, inside your lab — how attackers maintain access, move laterally, and gather credentials after an initial compromise. Understanding these patterns is what makes you effective at both offense (demonstrating real risk) and defense (recognizing these exact patterns in security logs).

Learn how phishing, pretexting, and other social engineering tactics work well enough to design authorized awareness campaigns and simulated phishing tests — always with explicit organizational sign-off. This is one of the most legally sensitive areas of the field; scope and consent matter even more here than in technical testing.

Once fundamentals are solid, pick a direction to go deeper: cloud security (AWS/Azure misconfigurations), mobile app security (Android/iOS), wireless security, or malware analysis/reverse engineering studied defensively in a controlled lab. Specializing after a strong generalist base is far more effective than specializing too early.

A solid first certification to prove foundational knowledge to recruiters and HR filters that screen resumes before a human sees them. Security+ is broad and vendor-neutral; eJPT (eLearnSecurity Junior Penetration Tester) is more hands-on and practical for those aiming specifically at pentesting roles.

Widely considered the most respected hands-on penetration testing certification in the industry — a 24-hour practical exam where you actually compromise machines rather than answer multiple choice. Demanding, but the single credential that opens the most pentesting job doors. Plan for several months of dedicated lab practice beforehand.

Write up your HackTheBox/TryHackMe machine walkthroughs, CTF solutions, and lab projects on a personal blog or GitHub. A portfolio of clear, well-documented writeups demonstrates real methodology and communication skill — exactly what certifications alone can't prove to a hiring manager.

Platforms like HackerOne and Bugcrowd connect researchers with companies that have explicitly authorized testing within a defined scope. This is legal by design — every program specifies exactly what's in and out of scope. Start with programs that have generous scope and active triage teams while you're still building speed.

From here, common directions include Penetration Tester, Security Analyst/SOC Analyst, Red Teamer, Application Security Engineer, or independent Bug Bounty Hunter. Each rewards a slightly different emphasis from this roadmap — SOC and defensive roles lean more on Phase 06 monitoring/detection knowledge, offensive roles lean more on Phases 04–05.