The most effective approach is sequential and heavily hands-on. Skipping foundations is the most common reason people stall.
1. Build the four non-negotiable foundations (4–8 weeks)
You cannot reliably exploit what you do not understand.
- Networking: TCP/IP model, ports, DNS, HTTP/HTTPS, subnetting, routing basics.
- Linux: Command line fluency, file permissions, processes, services, package management, basic bash.
- Scripting: Python (primary) + basic Bash. Focus on automation, parsing output, and simple tools.
- Web fundamentals: How browsers and servers talk, cookies/sessions, APIs, HTML/JS basics.
Do these properly before jumping into tools. Most good beginner paths start here.
2. Guided hands-on practice (2–4 months)
Use structured platforms that force you to attack real vulnerable systems in a legal environment.
Primary recommendation:
TryHackMe — start with their Pre-Security path, then the rebuilt Jr Penetration Tester learning path (updated for 2026). It covers ~70–90 hours of guided rooms across networking, web, Linux/Windows privilege escalation, and Active Directory basics. Complete rooms end-to-end and write notes.
Supplement with:
- PortSwigger Web Security Academy (completely free) — best resource for web vulnerabilities (SQLi, XSS, SSRF, CSRF, auth issues, etc.).
- OverTheWire (Bandit) for pure Linux command-line practice.
Goal at this stage: Be able to complete guided rooms without constantly looking up every command.
3. Move to realistic, unguided practice
Once guided rooms feel comfortable:
- Hack The Box (retired/easy → medium machines). These are closer to real engagements and excellent OSCP preparation.
- Build a home lab (VMs of Metasploitable, Windows Server, Active Directory setups).
- Practice full methodology repeatedly:
Reconnaissance → Scanning/Enumeration → Exploitation → Privilege Escalation → Post-exploitation → Reporting.
Document everything. Write professional-style write-ups for every machine (what you found, how you exploited it, impact, remediation). This becomes your portfolio.
4. Certification ladder (when ready)
- eJPT (eLearnSecurity Junior Penetration Tester) — practical, relatively accessible entry credential. Good early milestone.
- OSCP (or alternatives like PNPT) — the most recognized hands-on pentest certification. Expect 300–500 hours of serious preparation for most people. Focus on methodology and Active Directory attack chains.
Certificates help get past HR filters. Your portfolio of write-ups and demonstrated skill get you the actual job or consulting work.
5. Mindset and habits that actually work
- Treat it like deliberate practice, not passive consumption. Attack machines daily or several times per week.
- When stuck, struggle for a solid period before checking write-ups. The struggle is the training.
- Learn to write clear reports — this is a large part of real work.
- Track tools and techniques in a personal knowledge base (Obsidian, Notion, or plain markdown).
- Expect continuous learning. The field moves (especially with AI-assisted attacks and defenses).
Realistic timeline
- Part-time (10–15 focused hours/week): 9–18 months to junior-level competence and first cert.
- With prior IT/sysadmin experience: noticeably faster.
- Without prior technical background: plan for the longer end and be patient with foundations.
High-value free/cheap resources to start today
- TryHackMe (free tier + cheap premium)
- PortSwigger Web Security Academy
- Hack The Box (retired machines free)
- HackTricks (book.hacktricks.xyz) — living reference
- GTFOBins / LOLBAS for privilege escalation
- IppSec YouTube (excellent HTB walkthroughs once you’ve tried the machines yourself)
Start with the foundations and the first modules of TryHackMe’s Pre-Security + Jr Penetration Tester path. Everything else builds from there. The people who succeed are the ones who keep showing up after the initial excitement fades and the plateau hits.