182 lines
5.4 KiB
Markdown
182 lines
5.4 KiB
Markdown
# Penetration Tester Certification Roadmap
|
|
|
|
A structured path to becoming a professional penetration tester, from foundations through advanced offensive security expertise.
|
|
|
|
## Career Path Overview
|
|
|
|
Penetration testers ethically hack systems to identify vulnerabilities before malicious actors can exploit them. This roadmap progresses from basic security knowledge to advanced exploit development and penetration testing.
|
|
|
|
---
|
|
|
|
> **Want 1-on-1 guidance through this path?** I offer a mentorship program where I personally help you get certified, build real projects for your GitHub, rewrite your resume, and land your first cybersecurity role. **[Learn more](https://certgames.com/mentorship)**
|
|
|
|
---
|
|
|
|
## Certification Path
|
|
|
|
| Level | Certification | Organization | Link |
|
|
|-------|--------------|--------------|------|
|
|
| **Foundation** | **Security+** | CompTIA | [Website](https://www.comptia.org/certifications/security) |
|
|
| **Entry-Level Pentest** | **PenTest+** | CompTIA | [Website](https://www.comptia.org/certifications/pentest) |
|
|
| **Intermediate** | **CEH** (Certified Ethical Hacker) | EC-Council | [Website](https://www.eccouncil.org/train-certify/certified-ethical-hacker-ceh-v12/) |
|
|
| **Advanced** | **OSCP** (Gold Standard) | Offensive Security | [Website](https://www.offsec.com/courses-and-certifications/oscp-certification) |
|
|
| **Expert** | **OSEP** | Offensive Security | [Website](https://www.offsec.com/courses-and-certifications/osep-certification) |
|
|
| **Expert** | **GXPN** (Exploit Researcher) | GIAC | [Website](https://www.giac.org/certification/exploit-researcher-advanced-penetration-tester-gxpn/) |
|
|
|
|
---
|
|
|
|
## Recommended Learning Path
|
|
|
|
### Phase 1: Security Foundations (2-4 months)
|
|
**Target:** Security+
|
|
|
|
Build fundamental knowledge in:
|
|
- Network protocols and architecture
|
|
- Operating systems (Windows/Linux)
|
|
- Security concepts and terminology
|
|
- Basic cryptography
|
|
- Security tools fundamentals
|
|
|
|
**Resources:**
|
|
- CompTIA Security+ official materials
|
|
- Basic networking courses
|
|
- Linux fundamentals training
|
|
|
|
### Phase 2: Pentesting Basics (3-6 months)
|
|
**Target:** PenTest+
|
|
|
|
Learn core penetration testing:
|
|
- Reconnaissance and enumeration
|
|
- Vulnerability scanning
|
|
- Exploitation basics
|
|
- Post-exploitation techniques
|
|
- Reporting and documentation
|
|
|
|
**Resources:**
|
|
- CompTIA PenTest+ study materials
|
|
- TryHackMe beginner paths
|
|
- HackTheBox easy machines
|
|
|
|
### Phase 3: Ethical Hacking (4-8 months)
|
|
**Target:** CEH
|
|
|
|
Expand attack methodology:
|
|
- Advanced footprinting
|
|
- System hacking techniques
|
|
- Web application attacks
|
|
- Wireless network attacks
|
|
- Social engineering
|
|
- Malware analysis basics
|
|
|
|
**Resources:**
|
|
- EC-Council CEH training
|
|
- Practical hacking labs
|
|
- CTF competitions
|
|
|
|
### Phase 4: Advanced Penetration Testing (6-12 months)
|
|
**Target:** OSCP (Industry Gold Standard)
|
|
|
|
Master practical penetration testing:
|
|
- Manual exploitation techniques
|
|
- Buffer overflow exploitation
|
|
- Privilege escalation (Windows/Linux)
|
|
- Active Directory attacks
|
|
- Lateral movement
|
|
- Real-world lab environments
|
|
|
|
**Resources:**
|
|
- Offensive Security PWK course
|
|
- Proving Grounds practice labs
|
|
- OSCP preparation guides
|
|
|
|
**Note:** OSCP requires hands-on exam - you must compromise multiple machines within 24 hours. No multiple choice.
|
|
|
|
### Phase 5: Advanced Evasion (12+ months experience)
|
|
**Target:** OSEP
|
|
|
|
Learn evasion and advanced techniques:
|
|
- AV/EDR evasion
|
|
- Code signing and obfuscation
|
|
- Process injection
|
|
- Advanced Active Directory attacks
|
|
- Lateral movement techniques
|
|
|
|
**Resources:**
|
|
- Offensive Security PEN-300 course
|
|
- Advanced red team training
|
|
- Real-world penetration testing experience
|
|
|
|
### Phase 6: Exploit Development (2-3 years experience)
|
|
**Target:** GXPN
|
|
|
|
Specialize in exploit research:
|
|
- Vulnerability research
|
|
- Exploit development
|
|
- Reverse engineering
|
|
- Zero-day discovery
|
|
- Advanced binary exploitation
|
|
|
|
**Resources:**
|
|
- SANS exploit development courses
|
|
- Reverse engineering platforms
|
|
- Bug bounty programs
|
|
|
|
---
|
|
|
|
## Skills to Develop
|
|
|
|
**Technical Skills:**
|
|
- Linux command line mastery
|
|
- Scripting (Python, Bash, PowerShell)
|
|
- Web application testing (Burp Suite, OWASP ZAP)
|
|
- Network exploitation (Metasploit, custom exploits)
|
|
- Active Directory attacks
|
|
- Binary exploitation
|
|
- Report writing
|
|
|
|
**Soft Skills:**
|
|
- Critical thinking
|
|
- Attention to detail
|
|
- Problem-solving under pressure
|
|
- Clear communication (technical reports)
|
|
- Ethical judgment
|
|
- Continuous learning mindset
|
|
|
|
---
|
|
|
|
## Estimated Timeline
|
|
|
|
- **Foundation to Entry:** 5-10 months
|
|
- **Entry to Advanced:** 10-18 months
|
|
- **Advanced to Expert:** 1-3 years
|
|
|
|
Total time to expert level: **3-5 years** with continuous practical experience.
|
|
|
|
---
|
|
|
|
## Practice Platforms
|
|
|
|
- **TryHackMe** - Guided learning paths
|
|
- **HackTheBox** - Realistic machines
|
|
- **VulnHub** - Downloadable VMs
|
|
- **PentesterLab** - Web app focused
|
|
- **Proving Grounds** - OSCP-like practice
|
|
|
|
---
|
|
|
|
## Related Projects
|
|
|
|
Build pentesting skills with these projects:
|
|
- [Web Vulnerability Scanner](../SYNOPSES/intermediate/Web.Vulnerability.Scanner.md)
|
|
- [Reverse Shell Handler](../SYNOPSES/intermediate/Reverse.Shell.Handler.md)
|
|
- [Simple Port Scanner](../PROJECTS/beginner/simple-port-scanner)
|
|
- [Automated Penetration Testing](../SYNOPSES/advanced/Automated.Penetration.Testing.md)
|
|
|
|
---
|
|
|
|
> **This is a lot to tackle alone.** If you want someone guiding you through the certifications, building your projects, and getting your resume right — my 1-on-1 mentorship covers the full process for 90 days. **[certgames.com/mentorship](https://certgames.com/mentorship)**
|
|
|
|
---
|
|
|
|
[Back to All Roadmaps](./README.md)
|