Learn to assess networks and infrastructure the way an attacker would, under written authorisation and agreed rules, and turn findings into clear reports that get fixed.
Estimated time: 13–25 months · At about 10 hours a week.
Offensive skills are for authorised testing only: your own lab, a practice platform, or a system whose owner has given you written permission. Testing anything else is a crime in most countries.
Learning path
Click a topic to see what to learn and where. Mark topics as you go; your progress is saved in this browser only.
Explain the legal and ethical boundaries of testing.
Build and use a safe practice lab.
Follow a recognised testing methodology.
Enumerate hosts and services thoroughly.
Hands-on projects and labs
Build an isolated lab with a vulnerable VM and document a full enumeration of it.
Complete beginner paths on a practice platform and keep notes in a methodology template.
Done when you can…
Explain when testing is lawful and when it is a crime.
Enumerate a lab target thoroughly and record it methodically.
Beginner
Law, ethics and authorisation
Before any technique: understand computer misuse law, written authorisation, scope and the line between testing and crime. This is the most important topic here.
Set up an isolated lab with intentionally vulnerable targets so you can learn safely and legally. Never practise on systems you do not own or are not authorised to test.
Recognised methodologies give structure: reconnaissance, scanning, exploitation, post-exploitation and reporting. Methodology is what separates a professional from a script runner.
Most of a test is careful information gathering: discovering hosts, services and versions within scope. Thorough enumeration finds more than any exploit.
Weak and reused passwords, default credentials and poor access control are the most common real findings. Learn to spot and demonstrate them responsibly.
Understand how misconfigurations let a low-privileged user gain more rights, so you can find and explain them. Study the defensive fixes alongside each.
Run a full mock engagement in a lab from scoping document to final report.
Complete a hands-on certification lab such as the OSCP or PNPT labs.
Done when you can…
Deliver a professional-quality report from a lab engagement.
Hold or be ready for a practical certification such as OSCP or PNPT.
Advanced
Scoping and rules of engagement
Define exactly what is in scope, what techniques are allowed, timing, contacts and emergency stop. A clear scope protects the client, the systems and you.
The report is the deliverable. Write clear findings with business impact, evidence, severity and practical remediation, for both executives and engineers.
Penetration testing is authorised, scoped assessment: with the owner's written permission and agreed rules, a tester looks for weaknesses in networks and systems, shows the realistic impact, and writes it up so the organisation can fix it. The value is the report and the fixes, not the access itself.
This roadmap is a learning path for defensive and professional testing. It focuses on methodology, legal and ethical boundaries, safe practice environments and the certifications employers expect. Practise only on your own lab or on platforms built for it, and test real systems only under a signed engagement.
Why it matters
Organisations need independent testing to find weaknesses before attackers do, and regulations and customers increasingly require it. Skilled, ethical testers who write clear, actionable reports are in constant demand.
Typical job roles
EntryJunior penetration testerTests under supervision and writes findings.
Mid-levelPenetration testerRuns engagements end to end and reports.
SeniorSenior / lead testerScopes complex engagements and leads teams.
LeadOffensive security managerOwns the testing practice and quality.
Prerequisites
Strong networking and operating system knowledge, Linux and Windows.
Scripting, usually Python and Bash.
Security fundamentals and common vulnerability classes.
A firm grasp of the law and ethics of authorised testing.