Module Map#

Suggested Learning Path#

Work through the modules in numerical order; the course is built so each one relies on the skills from the ones before it.

1. Getting started: Module 1 (Introduction) -> Module 3 (Report Writing) -> Module 4 (Information Gathering) -> Module 5 (Vulnerability Scanning)
2. Web applications: Module 6 -> Module 7 -> Module 8 (SQL Injection) -> Module 9 (Client-Side Attacks)
3. Exploitation: Module 10 (Locating Public Exploits) -> Module 11 (Fixing Exploits) -> Module 12 (Antivirus Evasion)
4. Post-exploitation: Module 13 (Password Attacks) -> Module 14 (Windows PrivEsc) -> Module 15 (Linux PrivEsc)
5. Network and tooling: Module 16 (Port Redirection & Tunneling) -> Module 17 (Deep Packet Inspection) -> Module 18 (Metasploit)
6. Active Directory and beyond: Module 19 (AD Introduction) -> Module 23 (AWS Cloud) -> Module 24 (Real World Scenarios)

Module 01 - Introduction to Cybersecurity#

Focus: Security principles and the pentesting mindset
Labs: 5

The starting point of the course: core security principles, an overview of careers in the field, an introduction to offensive security, effective searching, and a first dive into what penetration testing actually involves.

Module 03 - Report Writing for Penetration Testers#

Focus: Communicating findings clearly and professionally
Labs: 3

A skill that separates a good pentester from a great one: writing clear, actionable pentest reports, reporting alerts at a SOC L1 level, and retesting to confirm that findings have actually been fixed.

Module 04 - Information Gathering#

Focus: Scoping, reconnaissance, and Nmap
Labs: 20

How every engagement begins: security principles and pentesting fundamentals, planning and scoping, red team engagements and infrastructure, passive and active reconnaissance, a full Nmap track, and a first look at reconnaissance against AI systems.

Module 05 - Vulnerability Scanning#

Focus: Identifying and prioritizing vulnerabilities
Labs: 8

Turning recon into a target list: understanding vulnerabilities and how scanners work, vulnerability management, network discovery and detection, scanning with OpenVAS and Nessus, and a first pass at exploitation with Metasploit.

Module 06 - Introduction to Web Applications#

Focus: How web applications are built and how they behave
Labs: 14

The foundation for every web attack module that follows: how websites work, HTTP and DNS in detail, protocols and servers, JavaScript essentials, session management, walking an application methodically, content discovery, subdomain enumeration, a first look at XSS, and web server attacks.

Module 07 - Common Web Application Attacks#

Focus: Path traversal, file inclusion, upload flaws, and command injection
Labs: 10

Hands-on exploitation of common web flaws, starting with the Mr Robot CTF and moving through file path traversal, file inclusion, upload vulnerabilities, OS command injection, and two CTF-style boxes to put it all together.

Module 08 - SQL Injection Attacks#

Focus: Manual and automated SQL and NoSQL injection
Labs: 12

A dedicated SQL injection track: database and SQL basics, manual injection fundamentals and practice, automating attacks with SQLMap, a look at NoSQL injection, and several CTF-style rooms to reinforce the technique.

Module 09 - Client-Side Attacks#

Focus: Social engineering, phishing, and mobile security
Labs: 11

Attacks that target the human rather than the machine: OSINT and search skills, understanding human attack vectors, a full phishing track including detection and simulated campaigns, mobile security, and building effective wordlists.

Module 10 - Locating Public Exploits#

Focus: OSINT and search-driven exploit discovery
Labs: 3

Finding out what has already been discovered about a target: Google Dorking, refining your search skills, and using Shodan to locate exposed systems and known vulnerabilities.

Module 11 - Fixing Exploits#

Focus: Adapting public exploits and understanding memory internals
Labs: 12

Public exploits rarely work out of the box. This module covers the internals you need to fix them: x86-64 architecture, Windows internals and memory, buffer overflow fundamentals, several real CVEs to practice against, and runtime detection evasion.

Module 12 - Antivirus Evasion#

Focus: AV, EDR, and XDR evasion techniques
Labs: 11

Getting payloads past modern defenses: how antivirus, EDR, and XDR work, malware classification, obfuscation principles, PowerShell for pentesters, and hands-on signature and sandbox evasion.

Module 13 - Password Attacks#

Focus: Hashing, cracking, and credential harvesting
Labs: 13

The full password attack lifecycle: hashing fundamentals and cryptography, online and offline password attacks with Hydra and John the Ripper, cracking real hashes, exploiting HackPark, recent CVEs involving credentials, and credential harvesting.

Module 14 - Windows Privilege Escalation#

Focus: From standard user to SYSTEM
Labs: 9

Escalating privileges on Windows: the command line, Windows internals and memory, a full Windows PrivEsc track, the LocalPotato technique, an arena to practice against, and establishing local persistence once you have escalated.

Module 15 - Linux Privilege Escalation#

Focus: From standard user to root
Labs: 7

The Linux side of privilege escalation: shell fundamentals, process analysis, enumeration for privesc, a full Linux PrivEsc track, and two CTF-style boxes to apply the technique end to end.

Module 16 - Port Redirection and SSH Tunneling#

Focus: Pivoting traffic through compromised hosts
Labs: 4

Moving traffic where you need it: data exfiltration, DNS manipulation, an introduction to command and control infrastructure, and Windows memory and network internals that underpin tunneling techniques.

Module 17 - Tunneling Through Deep Packet Inspection#

Focus: Traffic analysis and evading inspection
Labs: 8

Understanding what deep packet inspection sees: a full Wireshark track, TShark, packet and frame fundamentals, traffic analysis, Snort, and wireless security.

Module 18 - Metasploit Framework#

Focus: Exploitation and post-exploitation with Metasploit
Labs: 8

A dedicated deep dive into Metasploit: introduction, exploitation, Meterpreter, the framework basics, post-exploitation, shell generation and delivery, payload generation, and scanning combined with exploitation.

Module 19 - Active Directory Introduction and Enumeration#

Focus: AD authentication, breaching, and enumeration
Labs: 7

The starting point for attacking Active Directory: how AD authentication works, an introduction to breaching AD, understanding a Windows computer from the inside, basic and authenticated enumeration, and a full breaching and enumeration exercise.

Module 23 - AWS: Attacking Cloud Infrastructure#

Focus: Cloud security fundamentals and common pitfalls
Labs: 3

A focused look at cloud security: an introduction to cloud security concepts, the fundamentals that apply across providers, and the common pitfalls and misconfigurations that lead to real breaches.

Module 24 - Real World Scenarios#

Focus: Capstone-style, end-to-end engagements
Labs: 3

The final module: full, realistic engagements that combine reconnaissance, exploitation, privilege escalation, and lateral movement into a single scenario, capped with the Wreath network for a multi-machine pivoting exercise.

Tips for Getting the Most Out of These Labs#

• Take detailed notes from Module 1 onward. Report writing is Module 3 for a reason: build the habit of documenting as you go, not after you finish.
• Repeat Module 4’s reconnaissance workflow on every later CTF-style box before looking anything up. Consistent methodology is what the exam actually tests.
• Don’t skip the “boring” modules. Vulnerability scanning, tunneling, and report writing rarely feel as exciting as exploitation, but they are just as heavily tested.
• Revisit privilege escalation (Modules 14 and 15) constantly. These are the modules most worth repeating from memory, without notes, until they are automatic.

These labs are for learning and practice in the provided lab environments only. Never test any technique on systems you do not own or have explicit permission to test.

A1. Hack The Box: Starting Point#

Focus: A guided, beginner-friendly introduction to the Hack The Box platform
Free content: 3 tiers, most machines free

Hack The Box is the natural next step after TryHackMe’s guided rooms: less hand-holding, more “figure it out.” Starting Point is HTB’s own on-ramp: a linear track of easy machines that teaches you to connect over VPN, enumerate a target, and get your first foothold. Most Starting Point machines are free; a few are VIP-only but never block your progress through the free ones. See the official introduction to Starting Point for how tiers work, then find each machine by name inside the Starting Point section of the HTB app.

A2. OverTheWire: Wargames#

Focus: Terminal-based, SSH-driven wargames
Free content: All wargames listed below

OverTheWire is one of the oldest free platforms in the field: no browser, no VM, just SSH into a level and find the password to the next one. It needs zero setup, which makes it a great companion to run alongside any other course. Start with Bandit if you are new to Linux; the rest can be tackled roughly in the order below as your skills grow.

A3. PentesterLab: Free Exercises#

Focus: Web application vulnerabilities, with source code review
Free content: A rotating set of exercises across every badge category

PentesterLab stands out for pairing exploitation with source code review: you don’t just send a payload, you see the vulnerable code and understand exactly why it’s exploitable. Exercises are grouped into badges (Introduction, Unix, Essential, Web, Authentication/Authorization, API, Code Review, and more), and each badge has a mix of free and PRO-only exercises, clearly marked “Free Tier” on the exercise page. Work through the free exercises in the Introduction and Unix badges first, then dip into Web and Authentication/Authorization as you finish the web-focused roadmaps elsewhere on this blog.

A4. Root-Me: Wide-Coverage Challenges#

Focus: Broad, self-directed challenges across many categories
Free content: The large majority of the platform

Root-Me is a long-running, community-driven challenge platform covering web, cryptography, network, steganography, reverse engineering, and more, in a single points-based scoreboard. It has less structure than TryHackMe or a guided roadmap, which makes it a good place to go once you already know a topic and want a wide bank of realistic challenges to test yourself against.

A5. CyberDefenders: Blue Team Practice#

Focus: Log analysis, malware analysis, and incident response, from the defender’s side
Free content: A large set of downloadable challenges

Every roadmap on this blog so far leans offensive. CyberDefenders is the counterweight: free, downloadable “Challenges” built around real PCAP files, disk images, and logs, each with a set of investigative questions to answer. It’s excellent practice for the Digital Forensics, Threat Hunting, and CySA+-style material covered elsewhere on this blog, from the other side of the fence.

A6. VulnHub: Downloadable Vulnerable Machines#

Focus: Full boot2root VMs you run yourself
Free content: The entire library

VulnHub hosts a large, entirely free library of downloadable vulnerable virtual machines. Unlike TryHackMe or Hack The Box, there is no hosted infrastructure: you download an OVA or VMDK and run it locally in VirtualBox or VMware. That makes it slower to get started, but it’s a good way to practice working entirely offline and to build comfort with setting up your own lab environment, a skill the exam labs for certifications like OSCP assume you already have.

A7. picoCTF: Beginner-Friendly CTF Archive#

Focus: A large, permanent archive of beginner-to-intermediate CTF challenges
Free content: The entire archive, year-round

picoCTF, run by Carnegie Mellon University, was built as a yearly competition for students but keeps its full archive of past challenges open year-round for free practice. It spans binary exploitation, cryptography, web exploitation, forensics, and reverse engineering, each with a difficulty rating, and is a good source of short, self-contained challenges when you want a single problem to solve in an hour rather than a full machine.

A8. WebGoat & DVWA: Local Vulnerable Web Apps#

Focus: OWASP Top 10 practice you run entirely on your own machine
Free content: Both are fully open source

Two classic, self-hosted training applications worth having in your own lab, both free and open source:

• OWASP WebGoat: a deliberately insecure Java application maintained by OWASP, with guided lessons for each vulnerability class in the OWASP Top 10.
• DVWA (Damn Vulnerable Web Application): a PHP/MySQL application with adjustable difficulty levels (low, medium, high) for the same vulnerability, so you can see how the same attack needs to adapt as defenses get stronger.

Both run easily in Docker and are worth keeping around as a no-time-limit sandbox for testing a payload or technique you just learned somewhere else.

A9. PortSwigger Web Security Academy: Additional Topics#

Focus: Web vulnerability classes not already covered by the XSS and SQL injection tracks in the other roadmaps on this blog
Labs: 77 across 14 topics

The web-focused roadmaps elsewhere on this blog (eWAPT v2, eCPPT v3, eJPT v2, the Advanced Web Application Pentest roadmap) already cover PortSwigger labs for XSS, SQL injection, NoSQL injection, SSRF, and API testing in depth. This section fills in the rest of the Web Security Academy: access control, CSRF, file upload, business logic flaws, insecure deserialization, information disclosure, race conditions, path traversal, CORS, clickjacking, OAuth, JWT, server-side template injection, and web cache poisoning. As with the other PortSwigger sections on this blog, work through Apprentice labs in a topic before moving on to Practitioner and Expert.

How to Fit These Into Your Study Plan#

• Run OverTheWire Bandit in parallel with any course. It needs no setup, takes 30 minutes here and there, and directly reinforces the Linux fundamentals every other roadmap on this blog assumes you already have.
• Use Hack The Box Starting Point once you’ve finished a TryHackMe-based roadmap. The lack of hand-holding is the point: it tests whether the methodology actually stuck.
• Keep CyberDefenders in rotation if you’re working through the CySA+ or DFIR roadmaps. It’s the closest free equivalent to the log and PCAP analysis those exams actually test.
• Set up WebGoat or DVWA locally once, and leave them running. They’re the fastest way to test a technique the moment you read about it, without spinning up a TryHackMe room.

These platforms are for learning and practice in the environments they provide only. Never test any technique on systems you do not own or have explicit permission to test.