Overview#

This roadmap supports the Security+ (SY0-701) course with hands-on labs from 101Labs and TryHackMe, organized into 15 sections that take you from reconnaissance and network basics through web attacks, password cracking, wireless, shells and post-exploitation, scripting, and security tools, ending with governance, risk, and architecture.

The roadmap was put together by Netriders Academy, with the labs curated by Ahmed Sultan. Every link opens the lab directly.

Note: four labs (hping, ARP reconnaissance, Nessus, and OpenVPN) appear in two sections because they support more than one topic, so the total counts each appearance (100 unique labs). The final review list in section 15 points back to earlier labs rather than repeating their links. TryHackMe also occasionally moves rooms between free and paid, so if you find a lab that is locked, let me know and I will update the list.

Exam Domains at a Glance#

Most labs in this roadmap are practical, so they concentrate on the threat and operations domains of SY0-701. The conceptual domains are covered mainly by section 14, alongside your study notes.

Section Map#

Suggested Learning Path#

1. Foundations: Linux & System Skills -> Reconnaissance & Network Basics -> Scanning & Enumeration
2. Concepts: Governance, Risk & Architecture, alongside your study notes
3. Web: Web Attacks & Vulnerabilities -> Web Tools & Exploitation
4. Attacks and credentials: Passwords, Hashing & Cracking -> Wireless Attacks -> Network Tools & Traffic Analysis
5. Exploitation: Shells, Exploitation & Post-Exploitation -> Privilege Escalation
6. Tooling and automation: Security Tools & Frameworks -> Scripting & Automation -> OSINT & Misc Tools
7. Wrap-up: Advanced Topics & Final Review

Section 10 (Linux & System Skills) is the best warm-up, since almost every other lab assumes you are comfortable in a Linux shell and connected to the lab network.

01. Reconnaissance & Network Basics#

Focus: Information gathering and core network utilities
Labs: 12

Learn the command-line tools every security professional uses to gather information and inspect a network: Nmap, Recon-ng, theHarvester, DNS tools, and the everyday utilities (ping, traceroute, netstat, ARP, ipconfig/ifconfig).

02. Scanning & Enumeration#

Focus: IP scanners, anonymous scanning, and hping
Labs: 3

Discovering hosts and services on a network with IP scanners, anonymous port scanning, and hping for auditing and testing network devices.

03. Web Attacks & Vulnerabilities#

Focus: Classic web attacks and the OWASP Top 10
Labs: 15

The most common web application attacks in practice: XSS, CSRF, directory traversal, SQL injection, and broken access control, followed by a walk through the OWASP Top 10 (A1 to A10) one lab at a time.

04. Web Tools & Exploitation#

Focus: Burp Suite, cURL, Gobuster, Nikto, ZAP, and Nessus
Labs: 7

The tooling behind web testing: intercepting and manipulating requests with Burp Suite, working with cURL, discovering directories with Gobuster, and scanning for vulnerabilities with Nikto, ZAP, and Nessus.

05. Passwords, Hashing & Cracking#

Focus: Hashcat, John the Ripper, and Responder
Labs: 4

How passwords are attacked: cracking with Hashcat and John the Ripper, and capturing password hashes on the network with Responder.

06. Wireless Attacks#

Focus: Evil twin, WPS, WPA handshakes, and Wi-Fi monitoring
Labs: 6

Wireless security in practice: evil twin attacks, WPS attacks with Reaver and Wifite, discovering networks and capturing WPA handshakes with the Aircrack-ng suite, and monitoring signals with Kismet.

07. Network Tools & Traffic Analysis#

Focus: Netcat, Tcpdump, Wireshark, hping, and ARP
Labs: 5

Working with traffic directly: Netcat for connections, Tcpdump and Wireshark for capturing and inspecting packets (including credentials sent over HTTP), and hping and ARP for probing devices.

08. Shells, Exploitation & Post-Exploitation#

Focus: Reverse and bind shells, MSFvenom, and Meterpreter
Labs: 14

From getting a shell to using it: reverse and bind shells with Netcat and Socat, stabilizing shells, building payloads with MSFvenom, and working with Meterpreter, including process migration and exploiting a vulnerable FTP service.

09. Privilege Escalation#

Focus: Enumeration for privilege escalation and process inspection
Labs: 4

Escalating privileges manually with Python and enumerating for weaknesses with WinPEAS and LinPEAS, plus using Process Explorer to find and scan suspicious processes.

10. Linux & System Skills#

Focus: Linux concepts, file operations, and VPN access
Labs: 5

The Linux skills every security lab depends on: fundamental and advanced Linux operations, file operations, and connecting to an internal network with OpenVPN.

11. Scripting & Automation#

Focus: Bash, Python, and PowerShell scripting
Labs: 8

Automating security tasks with the three most common scripting languages: Bash, Python, and PowerShell, each from introduction to more advanced use.

12. Security Tools & Frameworks#

Focus: Hydra, SQLmap, Sn1per, BeEF, Nessus, and OpenVAS
Labs: 6

Popular security tools and frameworks in action: online password attacks with Hydra, automated SQL injection with SQLmap, reconnaissance with Sn1per, browser exploitation with BeEF, and vulnerability scanning with Nessus and OpenVAS.

13. OSINT & Misc Tools#

Focus: Site cloning, checksums, SSH, and lab setup
Labs: 6

Miscellaneous but important skills: credential harvesting with site cloning, verifying integrity with MD5 checksums, connecting over SSH from Windows and Linux, and setting up your own Kali Linux virtual machine.

14. Governance, Risk & Architecture#

Focus: Security principles, cryptography, IAM, governance, and architecture
Labs: 8

The conceptual side of Security+, covered with TryHackMe rooms: security engineering, security principles, cryptography, identity and access management, governance and regulation, vulnerability management, security architecture, and virtualization.

15. Advanced Topics & Final Review#

Focus: Weaponizing vulnerabilities and a final review set
Labs: 1

One advanced lab on weaponizing vulnerabilities, followed by a final review list. Finish here by re-running the key labs from earlier sections without looking at the instructions.

Tips for Getting the Most Out of These Labs#

• Set up your environment first. Build your Kali Linux virtual machine and connect over OpenVPN before starting the practical sections.
• Take notes on every lab: the tool, the command, and what it does, so you can come back to them later.
• Tie each lab to an exam objective. Ask yourself which threat, attack, or control the lab demonstrates, since that is how the exam frames it.
• Repeat labs a few days later without looking at the solution. This is what makes the knowledge stick.

These labs are for learning and practice in the provided lab environments only. Never use any tool or technique, especially the wireless, password, and exploitation labs, on systems or networks you do not own or have explicit permission to test.