182 lines
5.8 KiB
Markdown
182 lines
5.8 KiB
Markdown
# Penetration Tester Certification Roadmap
|
|
|
|
A structured path to becoming a professional penetration tester, from foundations through advanced offensive security expertise.
|
|
|
|
## Career Path Overview
|
|
|
|
Penetration testers ethically hack systems to identify vulnerabilities before malicious actors can exploit them. This roadmap progresses from basic security knowledge to advanced exploit development and penetration testing.
|
|
|
|
---
|
|
|
|
> **Studying for the certifications below?** [CertGames](https://certgames.com) is the platform I built to run this whole journey in one place: 25,000+ practice questions across 20 certifications (CompTIA, AWS, Cisco, ISC2), Learn lessons that teach each exam objective, guided projects you build from scratch, these career roadmaps with progress tracking, and deep analytics like an exam readiness score. Free, no credit card required. **[Start practicing free](https://certgames.com)**
|
|
|
|
---
|
|
|
|
## Certification Path
|
|
|
|
| Level | Certification | Organization | Link |
|
|
|-------|--------------|--------------|------|
|
|
| **Foundation** | **Security+** | CompTIA | [Website](https://www.comptia.org/certifications/security) |
|
|
| **Entry-Level Pentest** | **PenTest+** | CompTIA | [Website](https://www.comptia.org/certifications/pentest) |
|
|
| **Intermediate** | **CEH** (Certified Ethical Hacker) | EC-Council | [Website](https://www.eccouncil.org/train-certify/certified-ethical-hacker-ceh-v12/) |
|
|
| **Advanced** | **OSCP** (Gold Standard) | Offensive Security | [Website](https://www.offsec.com/courses-and-certifications/oscp-certification) |
|
|
| **Expert** | **OSEP** | Offensive Security | [Website](https://www.offsec.com/courses-and-certifications/osep-certification) |
|
|
| **Expert** | **GXPN** (Exploit Researcher) | GIAC | [Website](https://www.giac.org/certification/exploit-researcher-advanced-penetration-tester-gxpn/) |
|
|
|
|
---
|
|
|
|
## Recommended Learning Path
|
|
|
|
### Phase 1: Security Foundations (2-4 months)
|
|
**Target:** Security+
|
|
|
|
Build fundamental knowledge in:
|
|
- Network protocols and architecture
|
|
- Operating systems (Windows/Linux)
|
|
- Security concepts and terminology
|
|
- Basic cryptography
|
|
- Security tools fundamentals
|
|
|
|
**Resources:**
|
|
- CompTIA Security+ official materials
|
|
- Basic networking courses
|
|
- Linux fundamentals training
|
|
|
|
### Phase 2: Pentesting Basics (3-6 months)
|
|
**Target:** PenTest+
|
|
|
|
Learn core penetration testing:
|
|
- Reconnaissance and enumeration
|
|
- Vulnerability scanning
|
|
- Exploitation basics
|
|
- Post-exploitation techniques
|
|
- Reporting and documentation
|
|
|
|
**Resources:**
|
|
- CompTIA PenTest+ study materials
|
|
- TryHackMe beginner paths
|
|
- HackTheBox easy machines
|
|
|
|
### Phase 3: Ethical Hacking (4-8 months)
|
|
**Target:** CEH
|
|
|
|
Expand attack methodology:
|
|
- Advanced footprinting
|
|
- System hacking techniques
|
|
- Web application attacks
|
|
- Wireless network attacks
|
|
- Social engineering
|
|
- Malware analysis basics
|
|
|
|
**Resources:**
|
|
- EC-Council CEH training
|
|
- Practical hacking labs
|
|
- CTF competitions
|
|
|
|
### Phase 4: Advanced Penetration Testing (6-12 months)
|
|
**Target:** OSCP (Industry Gold Standard)
|
|
|
|
Master practical penetration testing:
|
|
- Manual exploitation techniques
|
|
- Buffer overflow exploitation
|
|
- Privilege escalation (Windows/Linux)
|
|
- Active Directory attacks
|
|
- Lateral movement
|
|
- Real-world lab environments
|
|
|
|
**Resources:**
|
|
- Offensive Security PWK course
|
|
- Proving Grounds practice labs
|
|
- OSCP preparation guides
|
|
|
|
**Note:** OSCP requires hands-on exam - you must compromise multiple machines within 24 hours. No multiple choice.
|
|
|
|
### Phase 5: Advanced Evasion (12+ months experience)
|
|
**Target:** OSEP
|
|
|
|
Learn evasion and advanced techniques:
|
|
- AV/EDR evasion
|
|
- Code signing and obfuscation
|
|
- Process injection
|
|
- Advanced Active Directory attacks
|
|
- Lateral movement techniques
|
|
|
|
**Resources:**
|
|
- Offensive Security PEN-300 course
|
|
- Advanced red team training
|
|
- Real-world penetration testing experience
|
|
|
|
### Phase 6: Exploit Development (2-3 years experience)
|
|
**Target:** GXPN
|
|
|
|
Specialize in exploit research:
|
|
- Vulnerability research
|
|
- Exploit development
|
|
- Reverse engineering
|
|
- Zero-day discovery
|
|
- Advanced binary exploitation
|
|
|
|
**Resources:**
|
|
- SANS exploit development courses
|
|
- Reverse engineering platforms
|
|
- Bug bounty programs
|
|
|
|
---
|
|
|
|
## Skills to Develop
|
|
|
|
**Technical Skills:**
|
|
- Linux command line mastery
|
|
- Scripting (Python, Bash, PowerShell)
|
|
- Web application testing (Burp Suite, OWASP ZAP)
|
|
- Network exploitation (Metasploit, custom exploits)
|
|
- Active Directory attacks
|
|
- Binary exploitation
|
|
- Report writing
|
|
|
|
**Soft Skills:**
|
|
- Critical thinking
|
|
- Attention to detail
|
|
- Problem-solving under pressure
|
|
- Clear communication (technical reports)
|
|
- Ethical judgment
|
|
- Continuous learning mindset
|
|
|
|
---
|
|
|
|
## Estimated Timeline
|
|
|
|
- **Foundation to Entry:** 5-10 months
|
|
- **Entry to Advanced:** 10-18 months
|
|
- **Advanced to Expert:** 1-3 years
|
|
|
|
Total time to expert level: **3-5 years** with continuous practical experience.
|
|
|
|
---
|
|
|
|
## Practice Platforms
|
|
|
|
- **TryHackMe** - Guided learning paths
|
|
- **HackTheBox** - Realistic machines
|
|
- **VulnHub** - Downloadable VMs
|
|
- **PentesterLab** - Web app focused
|
|
- **Proving Grounds** - OSCP-like practice
|
|
|
|
---
|
|
|
|
## Related Projects
|
|
|
|
Build pentesting skills with these projects:
|
|
- [Web Vulnerability Scanner](../SYNOPSES/intermediate/Web.Vulnerability.Scanner.md)
|
|
- [Reverse Shell Handler](../SYNOPSES/intermediate/Reverse.Shell.Handler.md)
|
|
- [Simple Port Scanner](../PROJECTS/beginner/simple-port-scanner)
|
|
- [Automated Penetration Testing](../SYNOPSES/advanced/Automated.Penetration.Testing.md)
|
|
|
|
---
|
|
|
|
> **The certification grind is rough.** Make it less painful with [CertGames](https://certgames.com): gamified practice where you earn XP, level up, build streaks, and compete on leaderboards, plus Learn lessons, guided projects, and roadmaps to keep you moving. 25,000+ questions across 20 certifications. Free, no credit card. **[certgames.com](https://certgames.com)**
|
|
|
|
---
|
|
|
|
[Back to All Roadmaps](./README.md)
|