No hype, no shortcuts. This is the order I'd learn in if I started today, with the exact free resources, tools, labs, books and people. Work it top to bottom. Don't skip the fundamentals: that's the step that separates people who last from people who quit.
Built by Mohamed Medjahdi, Cybersecurity Engineer · medjahdi.dev
Fundamentals: the step everyone skips
If you jump straight to "hacking" you'll spend years copy-pasting payloads you don't understand and wondering why they fail. Learn how a request actually reaches a server and the rest gets easy. Four things, roughly in this order:
Networking
TCP/IP, ports, DNS, what actually happens when you load a page.
XSS, running your JavaScript in a victim's browser.
SQLi, injecting into a database query.
IDOR, changing an ID to reach others' data.
CSRF, forcing a victim's browser to act.
SSRF, making the server send requests for you.
RCE, running your commands on the server.
LFI / RFI, including local/remote files you shouldn't.
Pick one surface: start with web
Offensive security is huge: web, networks, mobile, cloud, IoT, wireless. Don't scatter across all of them. Start with web apps, free to practise, browser-based, in constant demand, fastest feedback. The single best free resource on the planet for this is PortSwigger's Web Security Academy, work through it topic by topic.
The reference list of the ten riskiest web flaws. Learn each, then hunt it in the labs. The workshop's XSS is A03: Injection. Pair this with the OWASP Testing Guide: a free, professional checklist of how to test everything.
A01 Broken Access Control, reaching data that isn't yours
A02 Cryptographic Failures, weak or missing encryption
A03 Injection, untrusted input runs as code (XSS & SQLi)
A04 Insecure Design, the flaw is in the design itself
A05 Security Misconfiguration, unsafe settings or defaults
A06 Vulnerable & Outdated Components, old libraries, known holes
A07 Auth Failures, weak logins and sessions
A08 Software & Data Integrity, trusting unverified code/updates
A09 Logging & Monitoring Failures, attacks go unseen
A10 Server-Side Request Forgery, the server tricked into requests
4. Post-exploitation, escalate, pivot, measure real impact.
5. Reporting, write it up clearly. This is what a client pays for.
Automated tools find hidden paths. Manual testing, poking every input by hand: is what finds the good bugs: broken business logic, access-control flaws, a reflected XSS a scanner walks right past. Tools narrow the search; your brain finds the bug.
Recon, in more detail
Recon is where most bugs are won. Three layers:
Subdomains: more subdomains = more attack surface. Tools: subfinder, amass, and the free web tool crt.sh (certificate logs).
Content / endpoints: hidden paths and files with dirsearch / ffuf, plus Burp's site map as you browse.
Tech fingerprinting: what's it built with? Wappalyzer, plus nuclei for known-vuln checks.
Read the output critically. Most of a scan is noise: a wall of errors and dead ends. The skill isn't running the tool, it's spotting the two useful lines in two hundred.
Use AI the right way
In 2026 AI is part of the job. Autonomous agents now run recon and exploitation, and they drive the same classic tools you're learning, AI didn't replace Nmap and Burp, it orchestrates them. But it's a multiplier, not a replacement: it pays off for the person who can already tell when its output is wrong.
Use it to explain errors, write small scripts, and speed up the boring parts.
Use it to draft reports (template below).
Always verify. Never submit a finding or report you haven't confirmed yourself.
Fundamentals first. Then AI is a force multiplier in your hands, not a crutch hiding what you don't understand.
The AI vulnerability-report template
Finding a bug is half the job: the report is the other half, and it's the half that pays. Paste your finding plus this template into any AI, get a first draft, then verify and edit it yourself.
1, The template
vulnerability-report.md
# Vulnerability ReportTitle: [short descriptive title]
Severity: [Critical / High / Medium / Low]
Affected asset: [URL / endpoint / feature]
Date: [date] Tested by: [name]
## Summary
[1-2 sentences: what it is and why it matters.]
## Steps to Reproduce
1. [step] 2. [step] 3. [step]
## Proof of Concept
[the exact payload / request used]
## Impact
[what an attacker can actually do - be concrete.]
## Remediation
[how to fix it.]
## References
[OWASP link, CVE if any]
2, The prompt to give your AI
prompt.txt
You are a penetration tester writing a professional vulnerability report.
Using ONLY the finding below, fill in the template. Be precise and concise.
Do not invent details: mark anything uncertain as (to confirm).
FINDING:
- Vulnerability type: [e.g. DOM-based XSS]
- Location: [e.g. product search field]
- Payload used: [the script you injected]
- What happened: [script executed, session token shown]
- Target: [OWASP Juice Shop, local test instance]
TEMPLATE:
[paste the template above]
AI drafts it. You verify it. A report you didn't check is worse than no report.
Certifications: the honest ladder
Certs help you get past HR filters and give you structure. You don't need them to start, and skills beat paper, but here's the sensible order, cheap to expensive:
CompTIA Security+, broad entry-level, good for job filters. comptia.org
eJPT (INE), beginner, hands-on, affordable. Great first pentest cert. eJPT
PNPT (TCM Security), practical, real report required, good value. PNPT
Bug bounties are the legal way to hack real companies: they invite you, you find bugs, they pay. It's hard at first: don't expect money fast. How to begin:
Finish PortSwigger Academy first. You can't hunt what you can't recognise.