InSkillSecRoadmap
Roadmap
One road, eleven stages, and the honest version of the order to take them in. Five stages of main road take you from a first lab to holding a Windows domain; after that the road forks and you pick a speciality. It starts with a free course, and nothing here requires a prior one to be bought.
Where you areIn progressCleared
Main road
Getting your hands dirty
A lab on your own machine, the command line, and a first end-to-end intrusion. This is the only stop that assumes nothing, and it costs nothing.
1 course
Main road
Reading a network
Before touching anything you have to see it: what answers, what version it runs, what leaks. Two of these three courses are free.
3 courses~45h
Main road
Owning the system
Linux and Windows from the inside: permissions, services, scheduled tasks. Every escalation you will ever run starts with this.
3 courses~75h
Main road
The web, first surface
The largest exposed surface, and the one clients ask about first. Applications, APIs, authentication, and the tooling that goes with them.
8 courses~185h
Main road
Taking the domain
Active Directory, pivoting, persistence, evasion. This is where a tester becomes a red teamer, and where the day rate changes.
9 courses~275h
Specialisation
Cloud & containers
AWS, Azure, Kubernetes and container escapes — where the infrastructure now lives.
6 courses~165h
Specialisation
Mobile & IoT
Android, iOS and connected devices: what runs in a pocket and what runs in a factory.
4 courses~100h
Specialisation
Wireless & hardware
Wi-Fi, Bluetooth, software-defined radio, and boards you can hold in your hand.
4 courses~95h
Specialisation
Binaries & offensive tooling
Reverse engineering, memory corruption, and writing your own payloads and command-and-control. The steepest branch of the road.
5 courses~200h
Specialisation
People & secrets
Social engineering, applied cryptography and covert channels: the attacks that go around the technology rather than through it.
4 courses~85h
Main road
Defend, and prove it
Hardening and forensics close the loop: you cannot defend an infrastructure you have never attacked. Each finished course issues a verifiable certificate.
2 courses~55h
The road starts for free
Four courses are open on sign-up, and they cover the first two stages. Take them, see whether the work suits you, and only then decide what the rest is worth.