// SYSTEM ONLINE — TRAINING MODE

Hack to learn.
Not to harm.

A free, zero-to-hero roadmap for complete beginners. Learn how real attackers think — so you can become the person who stops them.

[ START THE ROADMAP ] [ TRY THE LIVE LAB ]
  • 06learning phases
  • 40+skills mapped
  • 100%free resources
  • 01rule: stay legal
boot_sequence.sh — bash

// 01

Read this first. Seriously.

⚠ LEGAL

Unauthorized access to any computer system is a crime in almost every country. Everything on this site is for learning on systems you own or have written permission to test.

  1. 01

    Get written permission

    No contract, no consent, no hacking. Practice only in legal labs: TryHackMe, HackTheBox, OverTheWire, your own virtual machines.

  2. 02

    Do no harm

    Never crash services, delete data, or touch real user information.

  3. 03

    Report, don't exploit

    Found a bug in someone's site? Use their bug-bounty program or disclose responsibly.

// 02

The Roadmap

Six phases. Do them in order. Skipping fundamentals is the #1 reason beginners quit.

00
~1 weekdifficulty ▪○○○○

Mindset & Ethics

Understand white-hat vs black-hat. Set up your study habit, note-taking, and learn to research like an engineer.

  • Threat models
  • White-hat mindset
  • Research skills

→ TryHackMe: Intro to Cyber Security

01
Computer hardware fundamentals
4–6 weeksdifficulty ▪▪○○○

Computer Fundamentals

How computers actually work: hardware, OS, processes, memory, files and permissions.

  • Windows internals
  • File systems
  • Processes & services
  • VirtualBox

→ Professor Messer — CompTIA A+ (free videos)

02
Linux terminal
6–8 weeksdifficulty ▪▪○○○

Linux & the Command Line

Install Ubuntu or Kali in a virtual machine and live in the terminal. 90% of security tools run on Linux.

  • Bash navigation
  • Permissions
  • Pipes & redirects
  • SSH

→ OverTheWire: Bandit wargame

03
Network server room
6–8 weeksdifficulty ▪▪▪○○

Networking Deep-Dive

IP addresses, ports, DNS, HTTP, the OSI model — and how to watch traffic with Wireshark.

  • TCP/IP & OSI
  • DNS / HTTP / TLS
  • Subnetting
  • Wireshark

→ TryHackMe: Intro to Networking

04
Programming code on screen
8 weeksdifficulty ▪▪▪○○

Scripting: Python & Bash

Automate everything. Write port scanners, brute-forcers and parsers. Small scripts, big power.

  • Python basics
  • Sockets
  • Requests library
  • Bash scripting

→ Automate the Boring Stuff (free book)

05
Web application security
8–12 weeksdifficulty ▪▪▪▪○

Web Application Security

The OWASP Top 10: SQL injection, XSS, broken auth. Hunt bugs on legal labs with Burp Suite.

  • OWASP Top 10
  • Burp Suite
  • SQLi & XSS
  • Recon

→ PortSwigger Web Security Academy (free)

06
CTF competition
foreverdifficulty ▪▪▪▪▪

CTFs, Labs & Certifications

Sharpen everything against real (legal) targets, write up your solves, and aim for your first certification.

  • picoCTF
  • HackTheBox
  • Write-ups
  • eJPT → Security+ → OSCP

→ picoCTF — beginner-friendly competitions

// 03

What you'll actually learn

Networking

Packets, ports, protocols. Learn what happens between your keyboard and the server — then learn to intercept it.

CORE

Linux

The hacker's operating system. Master the shell and you master the tools.

CORE

Web Hacking

SQL injection, XSS, CSRF, auth bypass — the bugs behind real breaches.

OFFENSE

Cryptography

Hashes, encoding, encryption. Learn why admin123 falls in milliseconds.

THEORY

OSINT / Recon

Open-source intelligence: legally gathering information from public sources.

RECON

Defense (Blue Team)

Detection, logs, hardening. Most first jobs are on the blue side.

DEFENSE

CTF & Labs — your legal playground

TryHackMe · HackTheBox · OverTheWire · picoCTF · PortSwigger Academy · DVWA — all free, all legal.

PRACTICE

// 04

The toolkit

Click any tool to see its install commands + usage code. All free.

RECON

Nmap

Network scanner. Finds hosts, open ports and services.

VIEW CODE →
ANALYSIS

Wireshark

Captures and inspects network traffic live.

VIEW CODE →
WEB

Burp Suite

Web proxy to intercept and modify HTTP requests.

VIEW CODE →
EXPLOIT

Metasploit

Framework of known exploits — authorized labs only.

VIEW CODE →
PASSWORDS

John the Ripper

Offline password cracker for learning hash attacks.

VIEW CODE →
PASSWORDS

Hashcat

GPU-powered hash cracking. Blazing fast.

VIEW CODE →
WEB

SQLMap

Detects and demonstrates SQL injection flaws.

VIEW CODE →
RECON

FFuF / Gobuster

Brute-forces hidden files & directories on web servers.

VIEW CODE →

// 05

Live Lab — your first CTF

A safe, simulated terminal. Type help to begin. Find the flag 🚩

guest@nullbyte: ~/lab
guest@nullbyte:~$

// 06

Questions every beginner asks

Yes — when you have permission. Attacking systems without written authorization is illegal everywhere. Stick to labs like TryHackMe and your own VMs.

No heavy math. You'll need some scripting eventually (Python), but you can start phases 0–3 with zero coding.

Realistically 1–3 years of consistent study. Certifications (Security+, eJPT) and CTF write-ups speed this up.

Any machine with 8GB+ RAM can run Kali Linux in a virtual machine. Old laptops are perfect for home labs.

Not at first. TryHackMe, PortSwigger Academy, OverTheWire and picoCTF are free and excellent.

// glossary.txt

White-hat
Ethical hacker who works with permission.
Exploit
Code that takes advantage of a vulnerability.
Payload
The code delivered by an exploit.
Recon
Information gathering before an attack.
Hash
One-way fingerprint of data (e.g. passwords).
Pentest
Authorized simulated attack on a system.
CTF
Capture The Flag — hacking competitions.
Zero-day
A bug unknown to the vendor, no patch yet.