Overview#

This roadmap supports the eJPT v2 course with hands-on labs on TryHackMe and PortSwigger, organized into 4 sections that follow the structure of the course: information gathering and scanning, auditing and monitoring, host and network attacks, and web application attacks.

This roadmap was prepared by Amr Abdel Hamide for Netriders Academy. Pair it with my eJPTv2 Study Notes for the theory behind each topic. Every link opens the lab directly.

Note: TryHackMe occasionally moves rooms between free and paid. If you find a lab that is locked, let me know and I will update the list.

Section Map#

Suggested Learning Path#

1. Start with the basics: Information Gathering & Vulnerability Scanning
2. Understand monitoring and auditing: Auditing and Monitoring
3. Host and network track: System & Network Host-Based Attacks. Work through Networking & Basics first, then Privilege Escalation, Metasploit, and Basic Exploitation before moving on to the wider CTF collection.
4. Web application track: Web Application Attacks. Complete Web Basics and TryHackMe SQL injection before starting PortSwigger.

The host/network track and the web track are independent, so you can study them in either order or alternate between them.

PortSwigger difficulty levels: Apprentice -> Practitioner -> Expert. If you are new to a topic, complete the Apprentice labs in each subsection before attempting the harder ones.

01. Information Gathering & Vulnerability Scanning#

Focus: Passive/active recon, OSINT, and Nmap
Labs: 13

The starting point of every assessment: gathering information about the target passively and actively, using OSINT tools like Shodan and Google Dorking, and mastering Nmap and RustScan for host and service discovery.

02. Auditing and Monitoring#

Focus: Vulnerability scanners, risk, and detection frameworks
Labs: 8

Understanding how systems are audited and monitored: security principles and risk management, vulnerability scanning with Nessus and OpenVAS, and detection frameworks like MITRE ATT&CK and Yara.

03. System & Network Host-Based Attacks#

Focus: Networking, privilege escalation, Metasploit, and boot2root machines
Labs: 55

The core hands-on section: networking fundamentals and traffic analysis, privilege escalation on Windows and Linux, exploitation with Metasploit, and a long list of boot2root machines to apply everything end to end. Start with the basic machines, then move on to the wider CTF collection.

04. Web Application Attacks#

Focus: Web fundamentals, SQL injection, and XSS
Labs: 49

From how the web works to hands-on exploitation: web fundamentals and OWASP first, then SQL injection (TryHackMe followed by PortSwigger), and finally the full PortSwigger XSS track covering reflected, stored, DOM-based, and context-specific XSS, plus exploitation and CSP bypass.

Tips for Getting the Most Out of These Labs#

• Take notes on every lab: the tool, the command, and the idea behind it, so you can come back to them later.
• Avoid walkthroughs until you have genuinely tried on your own.
• Repeat labs a few days later without looking at the solution. This is what makes the knowledge stick.
• Do the CTF machines methodically: enumerate first, note every service and version, then exploit. The same process will carry you through the exam.

These labs are for learning and practice in authorized environments only. Never test any technique on systems you do not own or have explicit permission to test.