Overview#

This roadmap supports the eCPPT v3 course with hands-on labs on TryHackMe and PortSwigger, organized into 12 sections that follow the course’s own structure, from PowerShell and reconnaissance through web hacking, Active Directory, and red team engagement fundamentals.

The roadmap was put together by Netriders Academy, with the labs curated by Amr Abdel Hamide. Every link opens the lab directly.

Note: the original list included a number of duplicate entries across sections (the same room referenced more than once); duplicates have been removed here. TryHackMe also occasionally moves rooms between free and paid, so if you find a lab that is locked, let me know and I will update the list.

Section Map#

Suggested Learning Path#

1. Foundations: Reconnaissance & OSINT -> How the Web Works
2. Web application track: Web Hacking Fundamentals -> Introduction to Web Hacking -> Burp Suite -> XSS -> SQL Injection
3. Systems and Active Directory track: System & Network: Host-Based Attacks
4. Red team engagement track: Red Team Fundamentals -> Planning and Scoping -> Initial Access -> Post-Compromise

The web application track and the systems/AD track can be studied in parallel; the red team engagement track ties both together and is best done last, once you understand both the technical attacks and the AD environment they are used against.

PortSwigger difficulty levels: Apprentice -> Practitioner -> Expert. If you are new to XSS or SQL injection, complete the Apprentice labs in each subsection before attempting the harder ones.

01. Reconnaissance & OSINT#

Focus: PowerShell, passive/active recon, and Nmap
Labs: 16

Building the toolkit you will lean on throughout the course: PowerShell for pentesters, passive and active reconnaissance, and a full Nmap track, plus OSINT tools like Shodan and Google Dorking.

02. How the Web Works#

Focus: DNS, HTTP, and the request/response cycle
Labs: 4

Before attacking a web application, understand how it actually works: DNS resolution, HTTP in detail, and how a browser and server exchange data end to end.

03. Web Hacking Fundamentals#

Focus: Burp Suite, OWASP Top 10, and first exploitation
Labs: 5

Your first hands-on exposure to web attacks: getting comfortable with Burp Suite, working through the OWASP Top 10 and Juice Shop, exploiting file upload vulnerabilities, and a first CTF-style box to tie it together.

04. Introduction to Web Hacking#

Focus: Content discovery, authentication bypass, and command injection
Labs: 6

Core web attack techniques: walking an application methodically, discovering hidden content, bypassing authentication, enumerating subdomains, and exploiting OS command injection and SQL injection.

05. Burp Suite#

Focus: Repeater, Intruder, and extensions
Labs: 5

A deeper pass on Burp Suite: Repeater for manual testing, Intruder for automated attacks, and the other modules and extensions that make it the core tool of every web pentester.

06. XSS (Cross-Site Scripting)#

Focus: Reflected, stored, DOM-based, and advanced context-based XSS
Labs: 33

The largest section in the roadmap. Start with the TryHackMe rooms for the fundamentals of XSS and CORS, then work through the full PortSwigger XSS track: contexts, DOM-based sinks, filter and CSP bypasses, client-side template injection, and exploitation techniques like cookie theft and CSRF via XSS.

07. SQL Injection#

Focus: From fundamentals to UNION and Blind SQLi
Labs: 16

SQL injection from the ground up on TryHackMe, then applied on PortSwigger through UNION attacks and the early stages of Blind SQL injection.

08. System & Network: Host-Based Attacks#

Focus: Networking, Windows/Linux privesc, and Active Directory
Labs: 34

The largest technical section: networking fundamentals, traffic analysis, exploitation with Metasploit, privilege escalation on both Windows and Linux, system hardening, and a full Active Directory attack chain from enumeration to persistence and recovery.

09. Red Team Fundamentals#

Focus: Engagement structure, threat intel, OPSEC, and C2
Labs: 5

How a red team engagement is actually run: fundamentals and engagement planning, working with threat intelligence, operational security (OPSEC), and an introduction to command and control (C2) infrastructure.

10. Initial Access#

Focus: Recon, weaponization, password attacks, and phishing
Labs: 4

Getting the first foothold: reconnaissance geared toward an engagement, weaponizing payloads, password attacks, and phishing as an initial access vector.

11. Planning and Scoping#

Focus: Pentesting fundamentals, engagement scoping, and governance
Labs: 3

The groundwork before any technical work begins: pentesting fundamentals, planning and scoping an engagement, and understanding cyber governance and regulation.

12. Post-Compromise#

Focus: Situational awareness, enumeration, privesc, lateral movement, and exfiltration
Labs: 6

What happens after the initial foothold: building situational awareness, enumerating for privilege escalation, persisting, pivoting laterally, and exfiltrating data.

Red Team Tooling Reference#

Beyond the labs above, the original course material includes a curated set of red team tools organized by phase of an engagement. These are reference links, not labs, kept here for convenience.

These links point to shortened LinkedIn redirect URLs from the original course material. Shortened links can rot or be tracked, so replace them with the tools’ direct GitHub or official pages before publishing.

Tips for Getting the Most Out of These Labs#

• Take notes on every lab: the tool, the command, and the idea behind it, so you can come back to them later.
• Avoid walkthroughs until you have genuinely tried on your own.
• Repeat labs a few days later without looking at the solution. This is what makes the knowledge stick.
• Treat the Active Directory subsection as a single narrative: enumeration, breaching, exploiting, lateral movement, and persistence build on each other, so work through them in order rather than jumping around.

These labs and tools are for learning and practice in authorized environments only. Never test any technique or tool on systems you do not own or have explicit permission to test.