A penetration test begins before any tool runs, in a document that says which systems you may touch, when, and what happens if you knock something over. Beginners spend their first months collecting exploits and skip that document entirely, which is how a hobby becomes a criminal offence with a laptop in the evidence bag.
Permission Is the First Tool in the Bag
A penetration tester is hired to attack a system with written authorization, in a defined window, using a defined scope, and then to explain what that attack proved. The authorization is the thing that separates the job from a crime, and every professional habit in this field grows out of it.
The scope document does more work than most beginners expect. It names the hosts and applications in bounds. It names what is out of bounds, which is usually the production payment system, the third-party integration, and anything owned by a different legal entity. It sets the testing window, because a denial-of-service test at eleven in the morning is an outage and at two in the morning is a scheduled maintenance event. It states the emergency contact and the stop condition, which is the sentence that matters when you accidentally take a service down and need to say so within four minutes rather than four hours.
A tester who reads that document carefully will often find the most valuable finding before touching a keyboard. An application in scope that shares a database with an application out of scope is a finding about architecture. A staging environment that holds a copy of production customer data is a finding about data handling. These observations do not require exploitation, and they are frequently worth more to the client than the technical bugs that follow.
The work itself has a rhythm. Reconnaissance, where you learn what exists without triggering alarms. Enumeration, where you map endpoints, parameters, versions, and users. Exploitation, where you try the specific things that the first two phases suggest. Post-exploitation, where you find out how far the access goes, strictly within the agreed limits. And reporting, which is the phase that determines whether any of the previous work changes anything.
Most people entering this field imagine the fourth phase is the job. It is the shortest part of an engagement. A week of testing typically produces a report of twenty to forty pages, and the exploitation that fills two pages takes a fraction of the time. The rest is reading, documenting, retesting, and arguing with a developer who believes the finding is theoretical.
Breaking In, Then Proving It
What a penetration tester is paid for is a reproducible demonstration that a specific weakness has a specific consequence, in a form a non-specialist can act on. Breaking in is the cheaper half of the work.
Consider the difference between two sentences about the same weakness. The first says the application is vulnerable to insecure direct object references. The second says that user A, with a standard account, can read the invoice belonging to user B by changing one number in a request, and here is the request, the response, and the two accounts used. The first sentence is a category. The second is evidence. Clients pay for the second, and they pay again next year if the first is all you can produce.
That standard changes how you practice. Running an exploit against a vulnerable machine and capturing the flag teaches you that the exploit works in that environment. Writing up what you did, why it worked, what an attacker could do next, and what the fix would be teaches you the job. Both are necessary. Only the second is scarce.
The role also sits at a boundary that requires judgment about consequence. A test that proves a server is missing a patch is less useful than a test that proves an unauthenticated user can reach the administrative interface. A finding that requires local access to a machine the attacker already owns is usually not worth the client's attention, even when the technical severity is high. Testers who report by severity score alone produce documents that read as a scanner export. Testers who report by business consequence produce documents that get fixed.
There is a professional distance to maintain as well. A client's system will contain things you should not read: customer messages, medical notes, salary records. The rule that experienced testers follow is to prove access and stop. Take the screenshot of the record count, not the record. Note that the bucket was public, do not download it. That restraint is part of the craft, and clients notice when it is present.
Where a Tester's Knowledge Is Assembled
Four catalog areas feed this role, and the balance between them shifts as a career develops.
Attack technique and its history
Cyber Security is the home area, and the catalog holds 31 live resources in it, with 26 free and 5 paid. This is the body of knowledge about how systems fail: injection, broken authentication, deserialization, misconfiguration, and the long history of techniques that still work because the underlying mistakes keep being made.
PortSwigger Web Security Academy (FREE) is the single most valuable free resource in this field. It is a lab platform with hundreds of exercises, organized by vulnerability class, each requiring you to actually perform the attack rather than answer a quiz. OWASP Top 10 (FREE) supplies the taxonomy that clients and developers use, and OWASP Juice Shop (FREE) is a deliberately broken application you can run locally and attack repeatedly. MITRE ATT&CK (FREE) is the vocabulary that connects a technical finding to the behaviour a detection team would look for.
The application and its inputs
Software Engineering is what turns a tester from a tool operator into somebody who can find the bug the scanner missed. Software Engineering holds 36 live resources, of which 30 are free and 6 are paid. Reading code tells you where the validation lives, which parameter reaches a query, and which endpoint was added last month by somebody in a hurry.
MDN Web Docs (FREE) is the reference for how the browser parses and executes what you send it, and most web findings depend on that behavior. CS50x: Introduction to Computer Science (FREE) builds the programming base if you are arriving from a networking or helpdesk background. Software Engineering at Google (free ebook) (FREE) explains how large codebases are structured and reviewed, which is where you learn why a particular input is trusted. TypeScript: Basics to Advanced (Mohin Sheikh) (FREE) covers the language most modern web applications ship, including the client-side code an attacker reads first.
The estate the application sits in
DevOps & Cloud explains the environment around the application. DevOps & Cloud lists 30 live resources, including 26 free and 4 paid. Most real engagements now include cloud infrastructure, and the finding is often not in the application at all but in the identity policy attached to it.
Linux Foundation: Introduction to Linux (LFS101) (FREE) is the foundation, because privilege escalation happens on hosts and hosts run Linux. Docker Get Started (FREE) covers containers, which is where a large share of modern deployment mistakes live. Kubernetes Basics Tutorial (FREE) explains the orchestration layer, and Ansible Resources (FREE) covers the configuration management that often reveals credentials in plain text. Microsoft Learn (FREE) is the free route into the identity and cloud tooling that enterprise clients actually run.
Proof that survives a hostile reading
Critical Thinking & Problem Solving is the area that decides whether your report gets acted on or argued down. Critical Thinking & Problem Solving carries 30 live resources, with 26 free and 4 paid. A finding is an argument, and the person reading it is often the developer who wrote the code.
Logically Fallacious (FREE) catalogues the reasoning errors that appear in a dispute about severity, including the appeal to a compensating control nobody has verified. ASQ Five Whys (FREE) is the habit of chasing a cause past the first convenient answer, which is what turns a symptom into a root cause. Kialo (FREE) is a free tool for laying out a contested claim as a tree, and it is useful for structuring a report's impact section. Cognitive Bias Codex (FREE) names the shortcuts that make a tester stop testing once the first shell lands.
Read together, the four areas describe the path from a technique to a defensible finding. The attack knowledge tells you what to try. The application knowledge tells you where to look. The infrastructure knowledge tells you what it means. The reasoning discipline tells you how to write it so it holds.
Drilling in the Order an Engagement Runs
The stages below follow a real engagement, from reconnaissance to retest. Each has a test you can apply to your own work.
Stage one: know the systems you intend to break. Linux Foundation: Introduction to Linux (LFS101) (FREE) covers the file system, permissions, and process model you will be abusing. OverTheWire Bandit (FREE) is a sequence of shell challenges that teaches the command line through problems rather than videos. NetworkChuck (YouTube) (FREE) fills in networking at a beginner-friendly pace. Done means you can move around a Linux host, read a service's configuration, and explain why a permission setting matters.
Stage two: learn the web application thoroughly. PortSwigger Web Security Academy (FREE) is the core of this stage and deserves months rather than weeks. OWASP Top 10 (FREE) gives the categories names, and OWASP Juice Shop (FREE) gives you a target that produces realistic responses. MDN Web Docs (FREE) answers the platform questions as they appear. Done means you have completed at least thirty academy labs across five vulnerability classes, and you can explain each one without looking at the solution.
Stage three: practice under challenge conditions. Hacker101 (FREE) is a free video curriculum from a bug bounty platform, and its material on real-world web vulnerabilities is better sequenced than most paid courses. picoCTF (FREE) and CyLab Security Academy (picoCTF) (FREE) provide challenges across categories, which is useful for finding out which specialty suits you. Cryptopals (FREE) is the cryptography track, and it is the one that separates people who understand encoding from people who paste payloads. Done means you have solved challenges in at least three categories and written up two of them properly.
Stage four: add infrastructure and cloud to the range. Docker Curriculum (FREE) teaches you to build and break containers. Kubernetes Basics Tutorial (FREE) covers the orchestration layer where modern privilege escalation often lives. Play with Docker (FREE) and Killercoda (FREE) give you disposable environments. AWS Skill Builder (PAID) and Google Cloud Training (PAID) are the paid provider shelves, worth buying when a client's estate runs on that provider and you need to understand its identity model. Done means you can identify an over-permissive cloud role and explain what an attacker would do with it.
Stage five: work paid labs that behave like engagements. Hack The Box (PAID) is the best-known offensive platform, with machines and challenges that range from approachable to unreasonable. Blue Team Labs Online (PAID) and LetsDefend (PAID) are defensive platforms, and they are worth the money for a different reason: seeing what a defender's console shows teaches you which of your actions are loud. OpenSecurityTraining2 (FREE) holds free deep technical courses for the topics the platforms skip. Done means you have completed a full machine or engagement-style lab, from reconnaissance to written findings.
Stage six: write and defend the report. Google Site Reliability Engineering Book (FREE) is the free text on postmortems and clear technical writing under pressure. Software Engineering at Google (free ebook) (FREE) covers the review culture your report enters. Introduction to Logic (Stanford) on edX (FREE) is the formal version of the argument skill, and it pays off in the meeting where a developer disputes a severity rating. Done means you have written a report with an executive summary, a technical section, reproduction steps, and a remediation recommendation, and had somebody else read it critically.
The order matters. A tester who starts with paid labs before learning the web fundamentals solves machines by following write-ups and learns nothing transferable. A tester who starts with exploitation before understanding the operating system cannot explain the impact of the access they obtained. A tester who never writes a report has a hobby rather than a practice.
There is also a repetition rule worth stating. Every lab you complete should produce a short written record, even if nobody reads it. The record is what turns a hundred solved machines into a body of knowledge rather than a score. Testers who can explain a vulnerability class from memory, including the fix and the detection, are the ones clients ask for by name.
Ranges, Write-Ups, and the Reading Between Them
A few entries earn permanent space regardless of stage.
CyberChef (FREE) is the browser tool that decodes, decrypts, and dissects almost anything, and it is the fastest way to understand an obfuscated payload. Crypto 101 (FREE) explains the cryptographic primitives that appear in findings about session cookies and signed requests. Darknet Diaries (FREE) is a podcast of real intrusions, and its value to a tester is the human detail: how a misconfiguration was noticed, how long the defenders took, what the attacker did with the access.
r/netsec Wiki (FREE) is a curated route into security research, and Professor Messer Security+ Videos (FREE) covers the certification body of knowledge at no cost if a client or employer requires one. NCSC Guidance (FREE) is a free reference for the controls your findings will be measured against, and NIST Cybersecurity Framework (FREE) supplies the organizational vocabulary.
The paid shelves deserve a note about what they actually sell. Cybrary (PAID) sells breadth and career tracks. Jiki (PAID) is an interactive coding platform, useful if you need programming fluency and will not build it from documentation. Coddy (PAID) is a paid drill platform, and it is worth the money only if you are preparing for a hiring loop that screens on algorithmic exercises. None of these replace a lab you had to think your way out of.
Lab Subscriptions, Exam Fees, and the Slow First Client
Money in this field is mostly spent on access. Cyber Security keeps 26 resources open at no cost, and a learner can reach a professional standard without paying anything. DevOps & Cloud adds 26 free entries, which covers the infrastructure side. Software Engineering contributes 30 free resources for reading code. Critical Thinking & Problem Solving holds 26 free entries for the reasoning side.
The paid entries cluster into labs, courses, and exams. A lab subscription is worth its fee when you have exhausted the free ranges and need harder targets. An exam voucher is worth its fee when a specific employer requires the certificate, and not before. A course subscription is worth its fee when you need a sequence and will not build one yourself. The one purchase that rarely pays off is a course that promises a job, because the hiring conversation is about what you can demonstrate rather than what you completed.
Time is the honest constraint. At ten hours a week, stages one and two take six to nine months, and stage two alone can absorb a year if you work through the academy labs properly rather than skimming. Stages three and four add another six months. Stage five never really ends, because the platforms keep adding machines and the field keeps adding techniques.
The first results are small. You can complete a lab machine without a walkthrough. You can write a finding that a developer accepts without a meeting. You can explain the difference between a vulnerability that requires authentication and one that does not. You can name the business consequence of a technical weakness in one sentence. Those four capabilities are the entry ticket, and each one can be shown rather than claimed.
What not to expect is a first client who hands you a network and a week. Most people enter through an internship, a junior seat at a consultancy, an internal security team, or a bug bounty programme that pays in small amounts and teaches in large ones. The internal route is underrated, because testing your own employer's systems with permission gives you real scope, real stakeholders, and a retest cycle.
There is a gap between lab skill and client work that catches almost everybody, and it is worth naming before you hit it. A lab machine has one intended path and a flag at the end. A client engagement has an ambiguous scope, a stakeholder who wants a specific answer, a developer who is proud of the code you are about to criticise, and a deadline that was set before anybody looked at the application. The technical work is often the easy part. The hard part is deciding what to test first when the week is shorter than the list, and then writing the result so that the person who approves the fix budget understands why it matters.
Subcontracting is the usual bridge. Consultancies hire junior testers to run the repetitive parts of a large engagement, which is unglamorous and extremely educational, because you see a senior tester's scope document, their note-taking habit, and the way they handle a finding that turns out to be a false positive. Take those jobs when they appear. The pay is modest and the pattern is worth more than any course you could buy with the difference.
Findings That Get Argued Down
The failures in this work are mostly failures of evidence rather than technique.
The first is the finding that cannot be reproduced. The tester proved it at 2 a.m. with a modified request and a specific session state, and the developer cannot repeat it. Without exact steps, request captures, and the environment details, the finding becomes a story. Reproduction is the whole basis of the profession.
The second is severity inflation. A medium finding reported as critical gets fixed and then gets discounted next quarter, along with everything else from the same tester. Severity should describe consequence: what data, what access, how many users, what detection. A tester who can defend a rating in one paragraph is worth more than one who can only defend it with a scanner score.
The third is scope drift. The engagement says one host, the tester finds a path to another, and the temptation is to follow it because the path is interesting. Following it without asking is how testers lose clients and, in some jurisdictions, licenses. The professional move is to stop, document the path, and ask for written permission to continue.
The fourth is the report with no fix. A finding that names a vulnerability without a remediation recommendation leaves the developer to research the solution, which delays the fix and often produces a partial one. Include the specific change: the parameterized query, the authorization check, the policy restriction.
The fifth is the retest that never happens. Closing a finding takes a retest, where somebody confirms the original attack no longer works and the fix did not open a new path. A shipped fix is a separate event from a closed finding. Testers who offer a retest as part of the engagement get hired again, because they closed the loop the client actually cares about.
From Challenge Points to Signed Engagements
Continue inside the catalog with the four areas this roadmap rests on: Cyber Security, Software Engineering, DevOps & Cloud, and Critical Thinking & Problem Solving. Go deeper in whichever area explains the last lab you solved by following somebody else's write-up.
Compare the neighboring roadmaps for Cybersecurity Analyst, DevOps Engineer, and Cloud Architect. The analyst watches for attacks in progress, the DevOps engineer builds the systems being tested, and the cloud architect decides what the estate will look like. The tester owns the question of what an authorized attacker can prove today, which is a narrower and more evidential authority.
The full index sits at Browse by Profession. One concrete action is worth more than another course: take the last machine you solved, delete your notes, and reproduce it from scratch. Whatever you cannot remember is what you did not learn.
FAQ
Do I need a certification to work as a penetration tester?
No, and the field is unusual in how little it depends on them. Clients ask for evidence: a report you wrote, a lab you completed, a bug bounty submission that was accepted. Some employers and some regulated industries require a specific certificate, and in those cases the requirement is a hiring filter rather than a measure of skill. If you do buy one, buy it after you have reports to show, because the certificate plus three sample reports is a strong application and the certificate alone is a weak one.
Is bug bounty hunting a substitute for professional testing experience?
It is a useful supplement and a poor substitute. Bug bounty teaches you to find high-impact bugs in systems you did not build, with real consequences and no scope document to lean on. It does not teach you to write an executive summary, manage a client relationship, or retest a fix. The most common path is to use bounties to build a public record while working a junior seat that teaches the professional half.
How much programming do I need?
Enough to read an application and write a small script. CS50x: Introduction to Computer Science (FREE) and TypeScript: Basics to Advanced (Mohin Sheikh) (FREE) cover that level. Testers who cannot read code depend on scanners, and scanners find the findings that clients already know about. The findings that pay are the ones a person noticed while reading a function that looked wrong.
Which is better to learn first, web or network testing?
Web, for almost everyone. The majority of engagements are application-focused, the free training is better, and the feedback loop is faster. Network testing remains valuable and is increasingly cloud-shaped, which is why the stages above include infrastructure later rather than never. A tester who is strong in web and competent in cloud infrastructure is employable. A tester who is strong in neither is collecting certificates.
How do I practice legally when I have no client?
Three routes, all defensible. Run deliberately vulnerable applications on your own machine, starting with OWASP Juice Shop (FREE). Use platforms whose terms explicitly authorize testing, such as Hack The Box (PAID) and PortSwigger Web Security Academy (FREE). Ask an organization you already have a relationship with, such as a small charity or your own employer, for written permission to test a specific system in a specific window, with the scope written down before you start.
How long does it take to get good at this?
Two years of deliberate practice is a realistic estimate for competence, and five for the kind of judgment that lets you scope an engagement alone. The first year is mostly technique and labs. The second year is where reporting, scope discipline, and client communication become the differentiator. The people who advance fastest are not the ones who solve the most machines. They are the ones whose reports get read, quoted in a fix ticket, and requested again next year.
SkillCache Editors · Updated November 13, 2026
