How to use the Ethical Hacking Roadmap
- 1. Tick what you knowOpen each stage and tick the topics you can already do confidently.
- 2. Pick your paceChoose how many hours a week you can study; the estimate updates for what's left.
- 3. Get your planSee time left per stage and your next three topics, and download the checklist.
Who this roadmap is for
Ethical hackers test systems with permission to find weaknesses before criminals do. This roadmap is for students and IT professionals moving into security. It starts with networking, Linux and Windows, because you can't test what you don't understand.
Important: testing any system without written permission is illegal in India under the IT Act and in most countries. Every practical milestone here uses your own lab, deliberately vulnerable apps or legal practice platforms.
The 8 stages
Each of the 8 stages of the Ethical Hacker path ends with a milestone project, because building something is what turns topics into skills.
- Foundations (about 4 weeks): Networking: OSI, TCP/IP, ports, DNS, HTTP, Linux command line and permissions, Windows basics: users, services, registry and more. Milestone: Home lab: two virtual machines on an isolated network.
- Security concepts (about 2 weeks): CIA triad, threats and vulnerabilities, Laws and ethics: only test with written permission, Cryptography basics: hashing, encryption, TLS and more. Milestone: Write a rules-of-engagement document for your lab.
- Reconnaissance and scanning (about 3 weeks): Passive recon and OSINT basics, Nmap scanning and service detection, Vulnerability scanners and their limits and more. Milestone: Scan and document your own lab machines.
- Web application security (about 5 weeks): OWASP Top 10, Burp Suite: proxy, repeater, intruder, Injection, XSS and access control flaws and more. Milestone: Find and write up 10 issues in OWASP Juice Shop.
- System and network attacks (about 4 weeks): Exploitation frameworks in a lab, Password attacks and why strong hashing matters, Privilege escalation on Linux and Windows and more. Milestone: Root three beginner boxes on a legal practice platform.
- Defence and detection (about 2 weeks): Logs, SIEM basics and alerts, Hardening and patching, Incident response steps and more. Milestone: Detect one of your own lab attacks in the logs.
- Reporting (about 1 week): Structure of a pentest report, Severity ratings (CVSS idea), Clear reproduction steps and fixes and more. Milestone: Professional report for your Juice Shop findings.
- Job ready (about 3 weeks): Entry certifications: Security+ or CEH, Capture the flag events, Bug bounty basics and programme rules and more. Milestone: Publish 5 write-ups of retired lab machines.
How the time estimate works
Worked example: with nothing ticked and 10 hours a week, the plan shows about 24 weeks for all 33 topics. Choose 20 hours a week and it becomes about 12 weeks. Tick every topic in the first stage, Foundations, and that row shows "done" while the total at 10 hours a week drops by 4 weeks to about 20.
Week counts are our suggestion for steady self-study of the Ethical Hacker path, based on how much each stage covers. They are not survey data or a promise; use them to plan, not to judge yourself.
Tips for following it
- Build a home lab with virtual machines on an isolated network and practise only there.
- Write up everything you do; reporting is a large part of the real job.
- Learn defence too; understanding detection makes you a better tester.
Frequently asked questions
Is ethical hacking legal?
Yes, when you have explicit written permission from the owner of the system, and you stay inside the agreed scope.
Which certification should I aim for?
CompTIA Security+ and CEH are common entry points; our practice tests cover both. Hands-on lab work matters as much as the certificate.
Where are my ticks saved?
Your Ethical Hacking Roadmap ticks are kept only in this browser on this device, so nothing you tick is sent anywhere. Clearing site data or switching browsers starts you fresh; download your checklist to keep a copy.
Is the Ethical Hacking Roadmap free?
Yes. Reading the Ethical Hacking Roadmap and ticking topics is open to everyone. Viewing your plan the first time asks for your name and WhatsApp number once; after that every Uncodemy tool is free and open to you.