Five-stage roadmap
Offensive Security & Penetration Testing
You do not need to collect next-stage tools before you are ready. Sequence does not slow you down; it removes random detours.
- 1 · FoundationBuild the vocabulary and problem-solving habits the rest of the path assumes.
- 2 · CoreLearn the concepts that make this career distinct from simply writing code.
- 3 · PracticalMeet the inconvenient parts tutorials often skip: setup, failure, feedback and deployment.
- 4 · Professional EngineeringMake your work readable, testable, reviewable and safe for another person to depend on.
- 5 · Later / SpecializationChoose depth because a real project or question now demands it—not because a roadmap poster had empty boxes.
Roadmap stage
1 · Foundation
Build the vocabulary and problem-solving habits the rest of the path assumes.
What to learn
- Networking, HTTP, Linux, scripting and how applications store identity and data.
- Authentication, authorization, sessions, input handling and common architectures.
- Written authorization, lab isolation, evidence handling and responsible disclosure.
Enough for now
You can explain HTTP and authorization behavior, read a request, state written scope and stop when a test crosses it.
Practical task
For one deliberately vulnerable lab, write the exact target, allowed accounts and data, excluded actions, stop condition and evidence rule before sending a test request.
Roadmap stage
2 · Core
Learn the concepts that make this career distinct from simply writing code.
What to learn
- Rules of engagement, threat-informed scoping and test methodology.
- Manual validation of web/API vulnerability classes and business logic.
- Evidence, severity reasoning, remediation and retesting.
Enough for now
You can explain the main trade-offs and solve a bounded problem without a recipe.
Practical task
Rebuild a familiar exercise with one changed constraint and document your reasoning.
Roadmap stage
3 · Practical
Meet the inconvenient parts tutorials often skip: setup, failure, feedback and deployment.
What to learn
- Complete deliberately vulnerable labs and explain the mechanism before the payload.
- Plan a tiny authorized assessment and record every tested hypothesis.
- Deliver one finding, fix recommendation and retest result without exposing secrets.
Enough for now
You have one small, working artifact and can demonstrate a failure you found and fixed.
Practical task
Complete the linked career experiment, then improve it after one deliberate failure or review.
Roadmap stage
4 · Professional Engineering
Make your work readable, testable, reviewable and safe for another person to depend on.
What to learn
- Rules of engagement, risk-based methodology and minimal proof of impact.
- Reproducible evidence, severity reasoning, remediation and retesting.
- Sensitive-data handling, responsible disclosure, peer review and explicit limitations.
Enough for now
The owner can reproduce the finding safely, understand why it matters, implement a proportionate fix and verify closure without receiving unnecessary secrets.
Practical task
Assess one authorized training feature against a short WSTG-informed plan. Deliver a reviewed finding with raw evidence, observed versus possible impact, smallest useful fix and a retest result.
Roadmap stage
5 · Later / Specialization
Choose depth because a real project or question now demands it—not because a roadmap poster had empty boxes.
What to learn
- Network, cloud, mobile or identity-focused penetration testing.
- Red/purple teaming and adversary emulation under mature supervision.
- Exploit development and vulnerability research after operating-system depth.
Enough for now
Choose one depth area, state why it matters now and produce one evidence-backed result.
Practical task
Write a one-page depth plan tied to a real system, research question or role requirement.
From skills to a destination
Where could you take this?
The career roadmap explains what to learn. A goal guide helps you put those skills to work. Start with one—not every route at once.
You read the roadmap—now gather evidence