penetration-testing-roadmap - 🎯 A structured 60-week penetration testing curricu

项目说明

🎯 Penetration Testing Roadmap (2026 Edition)

<di="center">

![Stars]()
![Forks]()
![Last Commit]()

A structured, comprehensi curriculum to master penetration testing, web security, network hacking, and ethical hacking from scratch.

🌐 Support The Open Source Ecosystem • 🥽 500+ Free Labs • 🛠️ Tools Directory • 🤝 Contribute

</div>

---

📖 O

Feeling o by the vast world of cybersecurity? You are not alone. Penetration testing requires a blend of networking, Linux/Windows administration, web architecture, and security methodology.

This repository provides a step-by-step, self-paced learning path designed to take you from absolute zero to a market-ready penetration tester through hands-on practice, labs, real-world CTFs, and free certifications.

---

🗺️ Learning Flowchart

---

⚡ What's New in the 2026 Edition?

Cybersecurity moves fast. The 2026 edition introduces modern attack and defense paradigms:

* 🤖 AI & LLM Security: Prompt injection attacks, indirect prompt hijacking, model in, and auditing OWASP Top 10 for LLM Applications.
* ☁️ Cloud Pentesting: AWS/Azure/GCP identity misconfigurations, IAM pri escalation, and container escape techniques (Docker/K8s).
* 🔌 API & Microservices: GraphQL introspection abuse, gRPC security testing, OAuth 2.0 / JWT misconfigurations, and BOLA (Broken Object Le).
* 📦 Supply Chain & CI/CD Security: Poisoned pipeline execution (PPE), dependency confusion, and auditing GitHub Actions workflows.
* 🛡️ Zero Trust Architecture: Bypassing identity-aware proxies, Mutual TLS (mTLS) testing, and microsegmentation e.

---

🌟 Featured Highlight: 500+ Free TryHackMe Rooms

One of the largest open-source collections of free security labs:

👉 Access the Full Checklist & Progress Tracker

---

📜 Certification & Career Roadmap

👉 Access the Full Certifications & Career Guide

> 🧭 Looking for career roadmaps across 35 distinct roles?
> Check out Awesome Cybersecurity Paths for a complete breakdown of 35 roles across Offensi, and GRC, 100+ tools, cert paths, and 10 enterprise architectures.

---

⚖️ Legal & Ethical Disclaimer

> [!CAUTION]
> Authorized Testing Only: Penetration testing without explicit written authorization is illegal and punishable under computer crime laws (e.g., Computer Fraud and Abuse Act). Always perform testing strictly within authorized en, lab VMs, or approved bug bounty scopes. Follow responsible disclosure practices at all times.

---
<a id="companion-ecosystem"></a><a id="flagship-ecosystem"></a><a id="Support-the-Open-Source-Ecosystem"></a>

⭐ Support the Open-Source Ecosystem

If you find this roadmap or our companion resources helpful, please consider starring ⭐ the repositories on GitHub! Your support increases , helps more aspiring security professionals discover free high-quality education, and keeps these community projects thriving:

🥷 The BlackHAT Roadmap 2027

The complete hacking & penetration testing roadmap from beginner to elite.
* Massi Scope: 44,982 lines of rigorous technical documentation accompanied by 150+ diagrams co attack chains, systems architecture, and exploitation flows.
* Specialized Offensi: In-depth co of OPSEC survival, web security, Acti dominance, binary exploitation, EDR e mechanisms, and 0-day research.
* Arsenal & Payloads: 300+ cataloged tools, 200+ MITRE ATT&CK techniques, custom weaponized C & Rust payloads, and modern AI security resources.
* Learning Assets: Hands-on lab setup guides, curated books, top courses, technical blogs, and CTF/practice platform recommendations.

👉 Access The BlackHAT Roadmap 2027

---

🧭 Awesome Cybersecurity Paths

A comprehensi career roadmap and handbook.
* 35 Industry Roles: Comprehensive role breakdowns and skill profiles across Offensi, Defensi (SOC Analyst, Incident Responder, Threat Hunter), and Go, Risk & Compliance (GRC).
* Tool & Skill Matrix: 100+ industry tools mapped directly to job expectations, daily responsibilities, and technical proficiencies.
* Certification Milestones: Tailored credential tracks guiding learners from entry-le certs to specialized professional credentials.
* Enterprise Architectures: 10 real-world cybersecurity architecture blueprints showing enterprise defense and operational workflows.

👉 Access Awesome Cybersecurity Paths

---

📚 Awesome Cybersecurity Books

A curated collection of 70+ free cybersecurity books organized by domain and difficulty.
* Difficulty Progression: Structured learning tracks organized from 🟢 Beginner → 🟡 Intermediate → 🔴 Ad to build knowledge step by step.
* Comprehensi: Curated titles co ethical hacking, penetration testing, exploit de, malware analysis, reverse engineering, web security, and mobile security.
* Zero Paywall: 100% free, community-maintained collection ensuring high-quality security literature is accessible without paywalls or subscriptions.

👉 Access Awesome Cybersecurity Books

---

📓 Research Notebooks & Field Manuals

Curated technical notebooks and field manuals with an interacti reader.
* Interacti Reader: Over 32 modular notebooks, field manuals, and study equipped with dark-mode reading and code demonstrations.
* Core Cybersecurity & OSINT: Handbooks including Google Dorks: The Complete Handbook, Understanding Phishing, and strategic career path guides.
* Networking & Infrastructure: Technical field manuals detailing computer networking fundamentals, DNS architecture, and network protocols.
* Programming for Security: Complete practical tracks for Python in cybersecurity, Bash automation, C/C++ data structures, and web technologies.

👉 Access Research Notebooks & Field Manuals

---

🤝 Contributing & Community

Contributions make this roadmap better for e! Whether you want to add a new TryHackMe room, fix a broken link, or translate a section:

---

<di="right">

*Maintained with ❤️ by -MultiHAT and the global InfoSec community under the CC BY-SA 4.0 License.*

</div>

---

项目信息

开发语言：未知

Star 数：69

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕🎯 A structured 60-week penetration testing curriculum with 500+ free TryHackMe labs, OWASP Top 10 deep dives, tool mastery guides, and certification roadmaps. Three learning paths from zero to professional pentester. 2026 Edition; includes AI/LLM, Cloud & API security.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。