CYBERSECURITY LEARNING PATH

Cybersecurity Roadmap

A structured path from computer fundamentals to professional penetration testing, defensive security and advanced cybersecurity specializations.

31Stages
3Learning Layers
∞Practice
MASTER ROADMAP

From Zero to Cybersecurity

Follow the stages in sequence. Build fundamentals first, then move into offensive security, defensive security and finally choose a specialization.

01
💻
STAGE 01

Computer & IT Fundamentals

Understand how computers, operating systems and virtual environments work.

01Computer Fundamentals+
Computer Architecture
CPU → ALU → Control Unit → Registers
RAM → ROM → Cache
Storage → HDD → SSD → NVMe
Motherboard
BIOS / UEFI
Hardware vs Software
02Operating Systems+
Kernel
User Space
System Calls
Windows Processes & Services
Windows Registry
Linux Kernel & Shell
Linux Filesystem
03Filesystems+
Files & Directories
File Permissions
Paths
File Metadata
NTFS
Linux Filesystems
04Virtualization+
Virtual Machines
Hypervisors
Snapshots
VM Networking
Isolated Security Lab
05Command Line+
Windows CMD
PowerShell Basics
Linux Terminal
Basic Troubleshooting
02
🌐
STAGE 02

Networking Fundamentals

Understand networks, protocols, addressing and packet-level communication.

01Networking Basics+
LAN
WAN
MAN
Client-Server
Peer-to-Peer
Router
Switch
Access Point
Firewall
02Network Models+
OSI Model
Physical
Data Link
Network
Transport
Session
Presentation
Application
TCP/IP Model
03IP Addressing+
IPv4
Private IP
Public IP
Loopback
APIPA
IPv6
Subnet Mask
CIDR
Subnetting
04Transport Layer+
TCP
Three-Way Handshake
SYN
SYN-ACK
ACK
UDP
TCP vs UDP
Ports
05Important Protocols+
DNS
DHCP
HTTP
HTTPS
SSH
FTP
SFTP
SMTP
SMB
LDAP
06Packet Analysis+
Wireshark
Packet Capture
Filters
TCP Analysis
DNS Analysis
HTTP Analysis
Suspicious Traffic
03
🐧
STAGE 03

Linux Fundamentals

Build strong Linux administration and security fundamentals.

01Linux Architecture+
Kernel
Shell
User Space
System Calls
02Filesystem+
/
/home
/etc
/var
/tmp
/usr
/opt
03Users & Groups+
Users
Groups
Root
User IDs
Group IDs
04Permissions+
Read
Write
Execute
Owner
Group
Others
chmod
chown
chgrp
05Processes & Services+
ps
top
kill
jobs
systemd
systemctl
Service Management
06Bash & Text Processing+
Variables
Conditions
Loops
Functions
Arguments
grep
find
awk
sed
cut
sort
uniq
07Linux Security+
Permission Hardening
Service Hardening
SSH Security
Updates
Logs
cron
Environment Variables
04
🪟
STAGE 04

Windows Fundamentals

Learn Windows internals, administration, security and Active Directory basics.

01Windows Architecture+
Kernel
User Mode
Kernel Mode
Processes
Services
02Users & Groups+
Local Users
Local Groups
Administrators
Standard Users
03NTFS+
File Permissions
Folder Permissions
ACLs
Inheritance
04PowerShell+
Commands
Objects
Pipelines
Scripts
Automation
05Windows Security+
Windows Defender
Firewall
Authentication
Security Policies
06Active Directory Introduction+
Domain
Domain Controller
Users
Groups
Group Policy
05
💻
STAGE 05

Programming & Scripting

Learn programming skills required for automation and security testing.

01Python+
Syntax
Variables
Data Types
Conditions
Loops
Functions
Modules
File Handling
Exceptions
Networking
Requests
Sockets
Automation
Security Scripts
02Bash+
Shell Scripting
Variables
Conditions
Loops
Functions
Automation
03PowerShell+
Cmdlets
Objects
Pipelines
Files
Processes
Services
Windows Automation
Security Automation
04JavaScript+
Variables
Functions
Objects
Arrays
DOM
Async Concepts
Browser Execution
05SQL+
Databases
Tables
Rows / Columns
SELECT
INSERT
UPDATE
DELETE
WHERE
JOIN
06APIs & Git+
REST
JSON
HTTP Requests
HTTP Responses
API Authentication
Repository
Commit
Branch
Merge
Clone
Pull
Push
06
🔐
STAGE 06

Cybersecurity Fundamentals

Learn the core principles, terminology, threats and security controls.

01CIA Triad+
Confidentiality
Integrity
Availability
02Identity & Access+
Authentication
Authorization
Accounting
Auditing
Least Privilege
03Security Principles+
Defense in Depth
Zero Trust
Attack Surface
Attack Vector
04Security Terminology+
Threat
Vulnerability
Exploit
Risk
Security Control
Incident
Breach
05Risk Management+
Identify
Analyze
Prioritize
Mitigate
Monitor
06Threats & Attacks+
Malware
Phishing
Ransomware
Social Engineering
MITM
DoS / DDoS
SQL Injection
XSS
CSRF
SSRF
Credential Theft
Privilege Escalation
Supply Chain Attack
07
🔑
STAGE 07

Cryptography

Understand encryption, hashing, certificates and secure communication.

01Cryptography Basics+
Plaintext
Ciphertext
Encoding
Encryption
Hashing
02Symmetric Cryptography+
AES
Encryption / Decryption
Keys
Key Management
03Asymmetric Cryptography+
RSA
ECC
Public Key
Private Key
04Hashing+
Hash Functions
SHA-256
Password Hashing
Salt
Password Storage
05PKI & TLS+
Digital Signatures
Digital Certificates
Certificate Authorities
PKI
TLS Handshake
HTTPS
08
🌐
STAGE 08

Web Security

Understand modern web applications and their security weaknesses.

01HTTP+
Request
Response
GET
POST
PUT
DELETE
Headers
Status Codes
02Browser Security+
Cookies
Sessions
Local Storage
Same-Origin Concepts
DevTools
03Authentication+
Login
Passwords
MFA
Password Reset
Session Security
04Authorization+
Roles
Permissions
Horizontal Access
Vertical Access
IDOR / BOLA
05OWASP Vulnerabilities+
Broken Access Control
Authentication Failures
Injection
XSS
CSRF
SSRF
File Upload
Path Traversal
Security Misconfiguration
Cryptographic Failures
06Advanced Web+
JWT
OAuth
CORS
Business Logic
Race Conditions
Rate Limiting
07Security Tools+
Burp Suite
Proxy
HTTP History
Repeater
Intruder Concepts
Decoder
OWASP ZAP
Browser DevTools
curl
Postman
09
🔌
STAGE 09

API Security

Learn how to assess REST, OAuth, JWT and GraphQL APIs.

01API Fundamentals+
REST
HTTP
JSON
Endpoints
Parameters
02API Discovery+
Endpoint Discovery
API Documentation
Hidden Endpoints
Versioning
03Authentication+
API Keys
JWT
OAuth 2.0
04Authorization+
Object-Level Authorization
BOLA
Role-Based Access
05API Abuse+
Rate Limiting
Mass Assignment
Excessive Data Exposure
Input Validation
Injection
06GraphQL+
Queries
Mutations
Introspection
Authorization
10
🔎
STAGE 10

Reconnaissance

Learn passive and authorized active reconnaissance.

01Passive Recon+
OSINT
Search Engines
Public Documents
Domain Information
Public IP Information
Technology Identification
02DNS Recon+
A
AAAA
MX
NS
TXT
CNAME
Subdomains
03Domain Intelligence+
WHOIS
Domain Ownership
DNS Infrastructure
04Attack Surface+
Domains
Subdomains
IP Addresses
Services
Applications
APIs
Cloud Assets
05Active Recon+
Host Discovery
Port Discovery
Service Discovery
Version Identification
Network Mapping
11
🔍
STAGE 11

Scanning & Enumeration

Discover exposed ports, services and system information.

01Port Scanning+
Open
Closed
Filtered
TCP
UDP
02Service Enumeration+
HTTP / HTTPS
SSH
SMB
DNS
FTP
LDAP
SMTP
Databases
03Version Detection+
Service Version
Software Identification
Configuration Information
04Network Mapping+
Hosts
Services
Relationships
05Nmap+
Host Discovery
Port Scanning
Service Detection
Script Concepts
Output Interpretation
12
🛡️
STAGE 12

Vulnerability Assessment

Identify, prioritize and manually validate security vulnerabilities.

01Vulnerability Concepts+
Vulnerability
Exploit
Risk
Impact
02Vulnerability Identification+
Outdated Software
Misconfiguration
Weak Authentication
Excessive Permissions
Insecure Services
Web Vulnerabilities
API Vulnerabilities
03CVE & CVSS+
CVE Identification
Vulnerability Research
Severity
Risk Prioritization
04Scanners+
Nessus
OpenVAS / Greenbone
Nmap Scripts
Burp Suite
05Validation+
False Positives
False Negatives
Manual Verification
Evidence Collection
13
⚔️
STAGE 13

Ethical Hacking Fundamentals

Learn the complete ethical hacking methodology within authorized environments.

01Ethical Hacking Basics+
White Hat
Black Hat
Grey Hat
Vulnerability
Exploit
Payload
Attack Surface
Attack Vector
02Legal Foundation+
Scope
Authorization
Rules of Engagement
Responsible Disclosure
03Hacker Methodology+
Recon
Scanning
Enumeration
Vulnerability Discovery
Validation
Privilege Assessment
Impact Analysis
Reporting
Remediation
Retesting
04Core Skills+
Recon
Enumeration
Web Security
API Security
Network Security
Linux Security
Windows Security
Authentication Security
Exploitation Fundamentals
Post-Exploitation Concepts
14
🌐
STAGE 14

Network Pentesting

Perform structured network security testing in authorized labs.

01Discovery+
Network Discovery
Host Discovery
Port Discovery
02Enumeration+
Services
Versions
Configurations
Remote Services
03Network Security Testing+
Firewall Behavior
Network Segmentation
SMB Security
SSH Security
DNS Security
VPN Security
04Traffic Analysis+
Packet Inspection
Protocol Analysis
Suspicious Traffic
15
🐧
STAGE 15

Linux Privilege Escalation

Understand Linux privilege boundaries and common misconfiguration paths.

01Permissions+
Weak Permissions
Writable Files
Writable Directories
02SUID / SGID+
SUID
SGID
Security Implications
03Sudo+
Sudo Configuration
Misconfiguration
04Scheduled Tasks+
Cron
systemd
05Credentials+
Exposed Credentials
Configuration Files
Environment Variables
06Linux Capabilities+
Capability Concepts
Insecure Capabilities
16
🪟
STAGE 16

Windows Privilege Escalation

Understand Windows privilege boundaries, services and security controls.

01Services+
Service Permissions
Misconfigured Services
02Scheduled Tasks+
Task Permissions
Configuration Issues
03Registry+
Registry Permissions
Misconfiguration
04Tokens & Privileges+
Access Tokens
Privilege Concepts
05Credentials+
Credential Exposure
Authentication Artifacts
06DLL Concepts+
DLL Search Order
Application Misconfiguration
17
🏢
STAGE 17

Active Directory Security

Understand enterprise identity, permissions and attack-path analysis.

01AD Architecture+
Domain
Domain Controller
Forest
Trust
Organizational Units
02Identity+
Users
Groups
Computers
Service Accounts
03Group Policy+
GPO
Permissions
Security Policies
04Protocols+
Kerberos
NTLM
LDAP
SMB
05Attack-Path Analysis+
Enumeration
Permission Relationships
Misconfigured Permissions
Privilege Paths
18
💥
STAGE 18

Exploitation Fundamentals

Understand exploit concepts and memory fundamentals in isolated labs.

01Exploit Concepts+
Vulnerability
Exploit
Proof of Concept
Exploit Validation
02Memory Basics+
Memory Layout
Stack
Heap
03Buffer Overflow+
Buffer
Memory Corruption
Stack Concepts
04Mitigations+
ASLR
DEP / NX
Stack Canaries
05Shell Concepts+
Shell
Reverse Shell Concept
Bind Shell Concept
Payload Concepts
19
🧩
STAGE 19

Post-Exploitation

Assess systems, privileges, networks and detection gaps after authorized access.

01System Assessment+
System Information
Current User
Privileges
Processes
Services
02Network Assessment+
Reachable Systems
Network Discovery
Segmentation
03Credential Assessment+
Credential Exposure
Credential Security
04Lateral Movement+
Movement Concepts
Trust Relationships
Segmentation Testing
05Detection Gaps+
What Was Detected?
What Wasn't Detected?
Security-Control Effectiveness
20
📡
STAGE 20

Wireless Security

Understand Wi-Fi architecture, authentication and secure configuration.

01Wi-Fi Architecture+
Access Point
Client
SSID
Channels
02Authentication+
WPA2
WPA3
Authentication Mechanisms
03Wireless Recon+
Network Discovery
Wireless Monitoring
04Wireless Risks+
Rogue AP
Weak Configuration
Poor Segmentation
05Secure Configuration+
Strong Authentication
Encryption
Segmentation
Monitoring
21
☁️
STAGE 21

Cloud Security

Learn cloud IAM, networking, storage, containers and Kubernetes security.

01Cloud Fundamentals+
AWS
Azure
GCP
Shared Responsibility
02IAM+
Users
Roles
Policies
Permissions
Least Privilege
03Storage+
Cloud Storage
Access Control
Public Exposure
04Cloud Networking+
VPC / VNet
Security Groups
Network Access
05Containers & Kubernetes+
Docker
Container Security
Cluster Security
RBAC
Workloads
Secrets
22
📱
STAGE 22

Mobile Security

Understand Android, iOS and mobile application security.

01Android+
Android Architecture
APK
Permissions
ADB
02Mobile Application Testing+
Authentication
Authorization
Insecure Storage
API Security
03Mobile Cryptography+
Key Storage
Encryption
Secure Communication
04iOS+
iOS Architecture
Security Model
05OWASP Mobile Risks+
Common Mobile Vulnerabilities
Secure Development
23
🦠
STAGE 23

Malware Analysis & Reverse Engineering

Analyze malware behavior using static, dynamic and reverse-engineering techniques.

01Malware Fundamentals+
Malware Taxonomy
Malware Behavior
Indicators of Compromise
02File Formats+
PE
ELF
03Static Analysis+
Strings
Imports
File Structure
Metadata
04Dynamic Analysis+
Process Behavior
Network Behavior
File Changes
Registry Changes
05Reverse Engineering+
Assembly Basics
Disassembly
Debugging
Program Flow
06Tools+
Ghidra
x64dbg
IDA
Procmon
Wireshark
24
🎣
STAGE 24

Social Engineering Security

Understand human-focused security risks and defensive awareness.

01Phishing+
Email Phishing
Credential Phishing
Security Awareness
02Pretexting+
Identity Manipulation
Scenario-Based Deception
03Physical Security+
Physical Assessments
Access Controls
04Email Security+
Sender Verification
Authentication
Suspicious Links
Suspicious Attachments
05Defense+
Security Awareness
Identity Verification
Detection
Prevention
25
🔴
STAGE 25

Red Teaming

Understand adversary simulation and objective-based security testing.

01Threat Modeling+
Threat Actors
Objectives
Attack Surfaces
02Attack Chain+
Initial Access
Persistence
Privilege Escalation
Lateral Movement
Objective
03Command & Control+
C2 Concepts
Communication Concepts
04Defense Evasion+
Detection-Aware Testing
Security-Control Evaluation
05Purple Team+
Red Team
Blue Team
Collaboration
Detection Improvement
26
🔵
STAGE 26

Defensive Security / Blue Team

Learn security monitoring, detection, threat hunting and incident response.

01Security Monitoring+
Logs
Events
Alerts
Monitoring
02SIEM+
Log Collection
Correlation
Alerts
Investigation
03EDR / XDR+
Endpoint Monitoring
Detection
Response
04Threat Hunting+
Hypothesis
Indicators
Suspicious Behavior
05Incident Response+
Identification
Containment
Eradication
Recovery
Lessons Learned
06Digital Forensics+
Evidence
Timeline
System Artifacts
Incident Investigation
27
🔬
STAGE 27

Vulnerability Research

Explore source auditing, fuzzing, crash analysis and CVE research.

01Source Code Auditing+
Code Review
Security Flaws
Input Handling
Authentication
Authorization
02Fuzzing+
Input Generation
Crash Detection
Test Cases
03Crash Analysis+
Crash Reproduction
Root Cause
Memory Behavior
04Patch Diffing+
Before Patch
After Patch
Security Changes
05CVE Research+
Vulnerability Discovery
Analysis
Documentation
Responsible Disclosure
28
📝
STAGE 28

Professional Penetration Testing

Learn how to conduct professional penetration tests from scope to retesting.

01Pentest Fundamentals+
Black-Box
Grey-Box
White-Box
Internal Pentest
External Pentest
Web Pentest
Network Pentest
API Pentest
02Pre-Engagement+
Client
Scope
Objectives
Rules of Engagement
Testing Limitations
Testing Window
Authorization
Emergency Contacts
Stop Conditions
03Assessment Process+
Scope
Recon
Enumeration
Vulnerability Discovery
Validation
Risk Assessment
Evidence
Reporting
Remediation
Retesting
04Finding Documentation+
Title
Description
Affected Asset
Evidence
Risk
Impact
Severity
Validation
Remediation
Retest
05Reporting+
Executive Summary
Technical Findings
Severity
Business Impact
Evidence
Remediation
Retest Results
29
⚖️
STAGE 29

Legal, Governance & Standards

Understand the legal and professional frameworks surrounding cybersecurity.

01Legal+
Authorization
Scope
Rules of Engagement
Data Handling
Responsible Disclosure
02Security Standards+
OWASP
NIST Cybersecurity Framework
NIST Penetration Testing Guidance
MITRE ATT&CK
CIS Controls
ISO 27001 Concepts
03Vulnerability Standards+
CVE
CVSS
30
🧪
STAGE 30

Practical Security Lab

Turn theory into hands-on cybersecurity skills using isolated labs.

01Lab Infrastructure+
Main PC
Virtualization
Linux VM
Windows VM
Security Tools
Vulnerable Applications
Isolated Network
02Beginner Labs+
Linux Basics
Networking
Nmap
Wireshark
HTTP
Burp Suite
03Web Labs+
OWASP Juice Shop
DVWA
WebGoat
04Vulnerable Machines+
VulnHub
Hack The Box Academy / Labs
TryHackMe Rooms
05Advanced+
Active Directory
Multi-Machine Network
Full Pentest Simulation
Detection + Attack Simulation
31
🎯
STAGE 31

Final Specializations

Choose one specialization after building your cybersecurity foundation.

01🔴 Red Team+
Advanced Pentesting
Adversary Simulation
Attack Chains
Active Directory
Cloud
Detection Evasion
Purple Team
02🌐 Web / API Security+
Advanced Web Pentesting
API Security
Business Logic
Authentication
Authorization
Bug Bounty
Secure Code Review
03🏢 Active Directory+
AD Architecture
Kerberos
NTLM
LDAP
SMB
Trusts
Attack Paths
Enterprise Pentesting
04☁️ Cloud Security+
AWS
Azure
GCP
IAM
Cloud Networking
Containers
Kubernetes
Cloud Detection
05🦠 Malware Analysis+
Assembly
Reverse Engineering
Static Analysis
Dynamic Analysis
Debugging
Malware Behavior
06🔬 Exploit Development+
Memory
Assembly
Debugging
Fuzzing
Crash Analysis
Root Cause
Exploit Development
07🔵 Blue Team / SOC+
SIEM
EDR
Detection Engineering
Threat Hunting
Incident Response
Digital Forensics
08⚖️ GRC+
Risk
Compliance
Policies
ISO 27001
NIST
Auditing
Governance
✓

Choose Your Specialization

Fundamentals → Security → Ethical Hacking → Pentesting → Advanced Security → Specialization