How to get started in ethical hacking: a practical guide
A realistic four-phase path from zero to your first offensive certification, with the specific resources for each stage.
Many people who want to learn ethical hacking start by installing Kali and firing off tools without understanding what they do. It is the slowest path. Here is a route that works.
1. Fundamentals (1-3 months)
No networking, Linux and web means no hacking. You need to understand TCP/IP, DNS and HTTP, be comfortable in the terminal and write small Bash or Python scripts.
- Linux: OverTheWire wargames (Bandit) are the best way to learn the terminal by playing.
- Web: PortSwigger Web Security Academy is free and among the best available.
- Networking: any introductory CCNA course or Professor Messer's.
2. Guided practice (2-4 months)
TryHackMe has guided paths that are perfect to start. Once comfortable, move to HackTheBox. If you get stuck, watch IppSec's video or read 0xdf's writeup after genuinely trying.
3. Master the tools
Now it's time: Nmap, Burp Suite or Caido, ffuf, NetExec, BloodHound... Learn how each one works under the hood. Keep HackTricks, GTFOBins and PayloadsAllTheThings close.
4. Get certified
For an affordable first step, eJPT. To prove real skill, PNPT, CPTS or OSCP. What matters is that they are hands-on: a multiple-choice exam does not prove you can compromise a machine.
Tip: document everything you learn. Your notes will be your best resource in any practical exam.