Cybersecurity looks intimidating when you first enter the field.

You see people talking about red teaming, malware analysis, reverse engineering, web exploitation, SIEMs, zero-days, Active Directory, and bug bounties — and suddenly it feels impossible to know where to begin.

The truth?

Every skilled hacker, SOC analyst, pentester, or security engineer started with the exact same basics:

• Networking

• Linux

• The web

• Operating systems

• Curiosity

• Practice

The biggest mistake beginners make is trying to learn “hacking” before learning how computers actually work.

That’s why this roadmap focuses on building fundamentals first, then gradually moving into offensive security using hands-on labs from TryHackMe.

---

Why TryHackMe is the Best Place to Start

Unlike traditional courses that are purely theoretical, TryHackMe teaches cybersecurity through:

• Interactive labs

• Real attack simulations

• Browser-based machines

• Guided walkthroughs

• Practical exercises

Their beginner learning paths are specifically designed for complete newcomers. (TryHackMe)

Even the cybersecurity community on Reddit consistently recommends starting with Pre Security and foundational learning paths before jumping into advanced hacking. (Reddit)

---

The Cybersecurity Roadmap That Actually Works

Here’s the progression I recommend:

1. Learn Computer Basics
2. Learn Networking
3. Learn Linux + Windows
4. Learn How Websites Work
5. Learn Basic Security Concepts
6. Learn Web Hacking
7. Learn Enumeration & Scanning
8. Learn Exploitation
9. Learn Privilege Escalation
10. Practice Real Machines

And yes — you can do all of this for free or very cheaply.

---

Phase 1 — Build Your Foundation

Before hacking anything, understand:

• IP addresses

• DNS

• HTTP

• Linux commands

• Windows basics

• Servers

• Databases

• Browsers

• Packets

This is where most beginners skip ahead and struggle later.

Recommended Path: Pre Security

TryHackMe Pre Security Path

The Pre Security path covers:

• Networking basics

• Linux fundamentals

• Windows basics

• How websites work

• Cybersecurity concepts

According to TryHackMe, this path is designed specifically for beginners with no experience. (TryHackMe)

---

Labs You MUST Complete in Pre Security

Networking Labs

• What is Networking?

• Intro to LAN

• OSI Model

• Packets & Frames

• Extending Your Network

What You’ll Learn

• How devices communicate

• Routers & switches

• TCP/IP

• Ports & protocols

• Packet flow

Without networking, hacking makes no sense.

---

Linux Fundamentals

Complete:

• Linux Fundamentals Part 1

• Linux Fundamentals Part 2

• Linux Fundamentals Part 3

Focus On

ls
cd
pwd
cat
grep
chmod
sudo
find
nano
curl
wget

Mini Walkthrough

Example:

find / -name passwords.txt 2>/dev/null

This searches the entire filesystem for a file called passwords.txt.

You’ll use commands like this constantly during pentesting.

---

Windows Fundamentals

Complete:

• Windows Fundamentals 1

• Windows Fundamentals 2

• Windows Fundamentals 3

Learn:

• Windows file system

• Users & permissions

• PowerShell basics

• Registry

• Services

• Event Viewer

Many corporate environments run on Windows + Active Directory.

---

Phase 2 — Learn How Websites Work

Most beginners want to become web hackers or bug bounty hunters.

Before learning attacks, understand:

• HTTP requests

• Cookies

• Sessions

• Authentication

• APIs

• Databases

Essential Labs

• DNS in Detail

• HTTP in Detail

• How Websites Work

• Putting It All Together

(TryHackMe)

---

Understanding HTTP (Most Important Web Concept)

Example HTTP Request:

GET /login HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0
Cookie: session=abc123

Learn:

• GET vs POST

• Headers

• Cookies

• Status codes

• Sessions

• Tokens

This is the foundation of web exploitation.

---

Phase 3 — Start Real Hacking

Once you understand the basics, move into offensive security.

Recommended Path: Jr Penetration Tester

TryHackMe Jr Penetration Tester Path

This path teaches:

• Web hacking

• Nmap

• Burp Suite

• Enumeration

• Metasploit

• Privilege escalation

• Real pentesting workflows

It’s considered one of the best beginner offensive security paths available. (TryHackMe)

---

Labs You ABSOLUTELY Need to Complete

1. Nmap

Learn:

• Port scanning

• Service enumeration

• Version detection

Example:

nmap -sV -sC 10.10.10.10

This runs:

• Default scripts

• Version detection

You’ll use Nmap in almost every engagement.

---

2. Burp Suite

Complete:

• Burp Suite Basics

• Repeater

• Intruder

• Extensions

Burp Suite is essential for:

• Web pentesting

• Bug bounty

• API testing

• Request manipulation

---

3. SQL Injection

This is the attack that introduces most people to web hacking.

Example vulnerable query:

SELECT * FROM users
WHERE username = 'admin'
AND password = '1234';

Payload:

' OR 1=1 --

Can bypass authentication in vulnerable systems.

Labs

• SQL Injection

• Authentication Bypass

• IDOR

• File Inclusion

---

4. Cross-Site Scripting (XSS)

Example:

<script>alert(1)</script>

Learn:

• Stored XSS

• Reflected XSS

• DOM XSS

• Cookie theft

• Session hijacking

---

Phase 4 — Learn Enumeration

New hackers obsess over exploits.

Experienced hackers obsess over enumeration.

Enumeration means:

• Gathering information

• Mapping systems

• Discovering services

• Finding hidden functionality

Labs

• Active Reconnaissance

• Passive Reconnaissance

• Subdomain Enumeration

• Content Discovery

---

Phase 5 — Learn Privilege Escalation

Getting access is only step one.

The real goal is escalating privileges.

Linux PrivEsc

Learn:

• SUID binaries

• Weak permissions

• Cron jobs

• PATH hijacking

Windows PrivEsc

Learn:

• Weak services

• Unquoted paths

• Token impersonation

• Misconfigurations

---

Build Your Home Lab

Since you're already interested in home labs and offensive security, this becomes a massive advantage.

Install:

• Kali Linux

• Ubuntu Server

• Metasploitable

• OWASP Juice Shop

• DVWA

Practice:

• Scanning

• Exploitation

• Privilege escalation

• Web attacks

---

Best Beginner Tools to Learn

Tool	Purpose
Nmap	Scanning
Burp Suite	Web testing
Gobuster	Directory brute forcing
Wireshark	Packet analysis
Metasploit	Exploitation
Hydra	Password attacks
SQLMap	SQL injection
FFUF	Fast fuzzing
Netcat	Shell handling

---

Learn By Doing (Not Watching)

One of the biggest traps in cybersecurity:

Watching endless tutorials without touching labs.

You do NOT learn hacking by:

• Watching YouTube all day

• Reading theory only

• Memorizing commands

You learn by:

• Breaking things

• Failing

• Debugging

• Enumerating

• Repeating labs

---

Recommended Daily Routine

1 Hour Daily Plan

20 Minutes

Theory

• Networking

• HTTP

• Linux

30 Minutes

Hands-on lab

10 Minutes

Take notes

This consistency matters more than grinding 12 hours once a month.

---

Should You Learn Programming?

Yes — but not immediately.

Start with:

• Bash

• Python basics

• JavaScript basics

Focus on:

• Reading code

• Understanding requests

• Automating tasks

You do NOT need to become a software engineer first.

---

Beginner Mistakes to Avoid

1. Skipping Fundamentals

Biggest mistake.

2. Jumping Into Advanced Exploits

Master basics first.

3. Tool Dependency

Understand WHY tools work.

4. Not Taking Notes

Create your own knowledge base.

5. Comparing Yourself to Experts

Everyone starts confused.

---

Best YouTube Channels for Beginners

• John Hammond

• The Cyber Mentor

• LiveOverflow

• IppSec

• NetworkChuck

---

What Comes After Jr Penetration Tester?

After finishing:

• Pre Security

• Cyber Security fundamentals

• Jr Penetration Tester

Move into:

• Bug bounty

• Red teaming

• SOC analysis

• Active Directory

• Cloud security

• Malware analysis

---

Final Advice

Cybersecurity rewards curiosity more than talent.

The people who succeed are usually the ones who:

• Keep practicing

• Stay consistent

• Build labs

• Break things

• Take notes

• Stay patient

You do not need:

• Expensive certifications

• A CS degree

• Genius-level programming

You need:

• Consistency

• Hands-on practice

• Real curiosity

Start small.

Complete one room.

Then another.

Six months later, you’ll realize you can:

• Enumerate machines

• Exploit vulnerabilities

• Understand web traffic

• Use professional tools

• Think like an attacker

And that’s where the real fun begins.

---

Essential Links

• TryHackMe Pre Security

• TryHackMe Jr Penetration Tester

• OWASP Top 10

• Hack The Box Academy

(TryHackMe)