Security-Engineer-Roadmap-2026 - A structured 12-18 month roadmap from zero to job-

项目说明

Zero to Job-Ready Security Engineer: 2026 Roadmap

!Role
!Track
!Frameworks
!Timeline
!License
!Philosophy

> *"Theory without labs is worthless. Every concept gets practiced."*

A structured, technical roadmap from zero to job-ready as a Security Engineer — co Offensi, Defensi, and Purple Teaming. Built on OWASP, MITRE ATT&CK v14, NIST SP 800-53 Rev 5, and SANS Institute curriculum.

Target Roles: Application Security Engineer | Penetration Tester | Detection Engineer | Purple Team Analyst | Security Operations Engineer

---

Table of Contents

Ground Rules

Phase 1: Foundations

- 1.1 Networking Fundamentals
- 1.2 Linux Mastery
- 1.3 Windows Internals
- 1.4 Programming for Security

Phase 2: Offensi

- 2.1 Reconnaissance
- 2.2 Network Attacks
- 2.3 Web Application Security
- 2.4 System Exploitation
- 2.5 Acti Attacks

Phase 3: Defensi

- 3.1 SIEM and Detection Engineering
- 3.2 Threat Hunting
- 3.3 DFIR
- 3.4 Security Architecture

Phase 4: Purple Teaming

- 4.1 Purple Team Operations
- 4.2 Cloud Security
- 4.3 Secure Code Review
- 4.4 API Security

Phase 5: Certs, Portfolio, and Jobs

Phase 6: Continuous De

Lab En

90-Day Quick-Start Schedule

Additional Resources

Author

---

Ground Rules

> [!IMPORTANT]
> These are non-negotiable prerequisites before starting. Skip them and you will struggle.

| Rule | Detail |
|---|---|
| Labs o | Every concept must be practiced. Reading is not enough. |
| Dedicated lab machine | Minimum 16GB RAM, 500GB SSD. Workstation Pro or . |
| Security journal | Document every exploit, bypass, and detection mechanism you discover. |
| GitHub reflects your work | Employers look at commits, not certificates alone. |

---

Phase 1: Foundations — The Non-Negotiables

Duration: 6 to 8 Weeks

Goal: Build the technical bedrock that every security concept will rest on. No shortcuts.

---

1.1 Networking Fundamentals

Concept: TCP/IP Stack, Protocols, and Packet Analysis

Technical Depth:

OSI model (all 7 layers) — understand what breaks at each layer during an attack

TCP 3-way handshake, connection states, RST/FIN attacks

IP addressing, subnetting (CIDR), routing tables, NAT

DNS: full resolution chain, zone transfers, DNS o

HTTP/1.1, HTTP/2, HTTP/3 — headers, methods, status codes, keep-alive

TLS 1.2 vs TLS 1.3 — cipher suites, certificate chains, handshake process

ARP, ICMP, DHCP — how these are abused (ARP spoofing, ICMP tunneling)

Protocols: FTP, SMTP, SSH, RDP, SMB and their weaknesses by design

> [!NOTE]
> The Security Why: Every network attack — from MITM to lateral mo — operates on these protocols. Defenders who do not understand packet-le cannot write detection rules. Attackers who do can exfiltrate through DNS or tunnel C2 o undetected.

Labs and Resources:

| Resource | Focus |
|---|---|
| Wireshark | Capture and analyze real traffic on your home network |
| TryHackMe: "Pre-Security" + "Network Fundamentals" | Guided path |
| O: Bandit | Networking concepts embedded in wargame |
| Book: Computer Networks by Tanenbaum (Ch. 1-5) | Deep theory |
| pfSense as firewall | Route and inspect traffic hands-on |

---

1.2 Linux Mastery

Concept: Linux OS Internals and Command-Line Proficiency

Technical Depth:

Filesystem hierarchy: /proc, /sys, /etc, /var/log — what li and why

File permissions: rwx, SUID/SGID bits, sticky bit, ACLs

Process management: ps, top, htop, /proc/[PID]/, inter-process communication

User/group management, sudo mechanics, PAM (Pluggable Authentication Modules)

Bash scripting: loops, conditionals, functions, regex with grep/sed/awk

cron, systemd services, init systems — persistence mechanisms live here

Network tools: netstat, ss, ip, iptables, nftables, tcpdump

Log files: /var/log/auth.log, /var/log/syslog, journalctl

> [!NOTE]
> The Security Why: Linux runs ~96% of the internet's servers. Post-exploitation means reading /etc/shadow, abusing SUID binaries, and li with nati. MITRE ATT&CK T1548 (Abuse Ele Control) is a Linux-nati.

Labs and Resources:

| Resource | Focus |
|---|---|
| O: Bandit (all 34 levels) then Narnia | Linux fundamentals |
| TryHackMe: "Linux Fundamentals" (all 3 parts) | Guided learning |
| TryHackMe: "Linux Pri Escalation" | Offensi |
| Kali Linux or Parrot OS as primary lab VM | Attack platform |
| linpeas.sh | Study every check it performs and understand why |

---

1.3 Windows Internals

Concept: Windows OS Architecture and Acti Fundamentals

Technical Depth:

Windows architecture: kernel mode vs user mode, WIN32 API, NTDLL

Registry: hi, run keys, common malware persistence locations

NTFS: alternate data streams, file permissions, inheritance

Windows authentication: NTLM, Kerberos (TGT, TGS, PAC), SAM database

Acti: forests, domains, trusts, OUs, GPOs, LDAP structure

Critical Event IDs: 4624 (logon), 4625 (failed logon), 4688 (process creation), 4776 (NTLM auth)

PowerShell: execution policies, constrained language mode, AMSI

Windows Defender internals: how it detects, what it misses

> [!NOTE]
> The Security Why: 90%+ of enterprise en run Windows with Acti. Credential dumping (MITRE T1003), Pass-the-Hash, Kerberoasting, DCSync — all exploit Windows-specific authentication mechanisms.

Labs and Resources:

| Resource | Focus |
|---|---|
| TryHackMe: "Windows Fundamentals" (all 3) + "Acti Basics" | Core Windows knowledge |
| Windows Server 2019 + Windows 10 VM in a domain | Hands-on AD lab |
| Sysinternals Suite (Process Monitor, Autoruns) | Deep OS |
| HackTheBox: "Active" and "Forest" | AD-focused beginner machines |

---

1.4 Programming for Security

Concept: Python, Bash, and PowerShell for Security Automation

Technical Depth:

Python: sockets, subprocess, os/sys, requests, scapy for packet crafting, JSON/XML parsing, writing exploits

Bash: recon automation scripts, log parsing, chaining tools with pipes

PowerShell: cmdlets, WinRM remoting, .NET access, AMSI bypass techniques, red team one-liners

Basic C/C++: memory layout (stack, heap, BSS), pointers — essential for exploit de later

Reading and understanding existing exploit code (Python, Ruby Metasploit modules)

> [!WARNING]
> The Security Why: A security engineer who cannot script is a liability. MITRE T1059 (Command and Scripting Interpreter) is one of the most-used ATT&CK techniques. Custom exploits, detection rules, and bypass tools all require code.

Labs and Resources:

| Resource | Focus |
|---|---|
| Write a Python port scanner from scratch (no nmap) | Core skill builder |
| Write a Python subdomain bruteforcer | Automation practice |
| Book: Black Hat Python by Justin Seitz | Work through every chapter |
| HackTheBox challenges requiring custom scripts | Applied scripting |

---

Phase 2: Offensi

Duration: 10 to 14 Weeks

Goal: Understand every major attack class at a technical depth sufficient to both exploit AND detect it.

---

2.1 Reconnaissance

Concept: OSINT and Acti Techniques

Technical Depth:

Passi: WHOIS, certificate transparency logs (crt.sh), Shodan, Censys, LinkedIn, GitHub dorking

Google dorks: site:, filetype:, inurl:, intitle: — building complex dork chains

DNS enumeration: zone transfers, subdomain brute-forcing, record analysis (A, MX, TXT, CNAME, SRV)

Acti: Nmap (SYN, UDP, , script scans), service fingerprinting

Web tech fingerprinting: Wappalyzer, WhatWeb, HTTP headers, cookie analysis

Cloud recon: S3 bucket enumeration, Azure/GCP exposed endpoints

GitHub/GitLab recon: leaked API keys, .env files, commit history with sensitive data

> [!IMPORTANT]
> The Security Why: MITRE ATT&CK TA0043 (Reconnaissance) is where every real-world breach starts. A single exposed .env file on GitHub has caused multi-million dollar breaches.

Tools to Master: Nmap Amass Subfinder theHar Shodan CLI dnsrecon

---

2.2 Network Attacks

Concept: Network-Le and Traffic Manipulation

Technical Depth:

ARP spoofing and MITM: intercepting LAN traffic, SSL stripping

VLAN hopping: double tagging, switch spoofing

Sniffing: capturing credentials from Telnet, FTP, HTTP, SMTP

Service exploitation: EternalBlue (MS17-010), BlueKeep — understanding the vuln, not just running Metasploit

Password attacks: Hydra, Medusa for SSH, RDP, SMB, FTP brute-forcing

Wireless: WPA2 4-way handshake capture, offline cracking with Hashcat, PMKID attack, evil twin AP

Labs:

| Resource | Focus |
|---|---|
| Metasploitable 2/3 | Deliberately targets |
| HackTheBox: "Blue" (EternalBlue), "Legacy" | SMB exploits |
| Ettercap, Bettercap | MITM lab work |

---

2.3 Web Application Security (AppSec Core)

OWASP Top 10 — Full Technical Exploitation and Defense

Each section below is a separate mastery unit.

---

#### 2.3.1 Injection Attacks

OWASP A03:2021

Technical Depth:

SQLi: error-based, blind boolean, blind time-based, UNION-based, out-of-band

WAF bypass: comment , encoding, case manipulation, chunked transfer

Command injection: ;, &&, ||, |, backtick execution, blind via time delays

NoSQL injection: MongoDB operator injection ($where, $gt, $regex)

LDAP injection: authentication bypass, information disclosure

Remediation: parameterized queries, ORM usage, input — implement in code

Labs: PortSwigger "SQL Injection" (all 18 labs) | DVWA | Juice Shop | WebGoat

---

#### 2.3.2 Authentication and Session Attacks

OWASP A07:2021

Technical Depth:

Session fixation, session hijacking via XSS, cookie theft

JWT: alg:none attack, RS256 to HS256 confusion, weak secret brute-forcing, kid header injection

OAuth 2.0: open redirect abuse, CSRF in OAuth flow, token leakage in referrer headers

Password reset flow attacks: predictable tokens, host header injection

Account enumeration differences, error messages, response sizes

MFA bypasses: OTP reuse, backup code exposure

Labs: PortSwigger "Authentication" (all 14 labs) | PortSwigger "JWT Attacks" (all 8 labs) | Juice Shop

---

#### 2.3.3 Cross-Site Scripting (XSS)

OWASP A03:2021

Technical Depth:

Reflected XSS: input reflection, filter bypass (encoding, polyglots, HTML entities)

Stored XSS: persistent database , admin panel impact, worm propagation

DOM-based XSS: document.write, innerHTML, eval, location.hash sinks

Ad: XSS to CSRF, XSS to session hijacking, XSS to internal port scanning via fetch

CSP bypass: unsafe-inline, unsafe-eval, JSONP endpoints, script gadgets, nonce bypass

Labs: PortSwigger "Cross-Site Scripting" (all 30 labs including DOM and CSP bypass) | Juice Shop

---

#### 2.3.4 Broken Access Control

OWASP A01:2021 (Number 1)

Technical Depth:

IDOR: sequential ID manipulation, GUID prediction, hash cracking for IDs

Horizontal pri escalation: accessing other users' data at same pri level

pri escalation: accessing admin functions as a regular user

Mass assignment: parameter pollution to set isAdmin=true, role=admin

Path tra: ../ sequences, null byte injection, URL encoding bypasses

BOLA (Broken Object Le): API-specific IDOR dominant in REST APIs

JWT sub claim manipulation to access other accounts

Labs: PortSwigger "Access Control" (all 13 labs) | OWASP crAPI | Juice Shop

---

#### 2.3.5 Security Misconfiguration and XXE

OWASP A05:2021

Technical Depth:

XXE: file read, SSRF via XXE, blind XXE with out-of-band exfiltration, XXE via file upload (SVG, DOCX, XLSX)

SSRF: accessing AWS metadata at 169.254.169.254, bypassing filters chains and DNS rebinding

Security misconfigs: default credentials, debug endpoints, stack trace exposure, directory listing

Cloud misconfigs: public S3 buckets, exposed Azure Blob storage, GCP bucket ACLs

Missing HTTP security headers: HSTS, X-Frame-Options, CORS, Referrer-Policy

Labs: PortSwigger "XXE Injection" (all 9 labs) | PortSwigger "SSRF" (all 7 labs)

---

#### 2.3.6 Cryptographic Failures

OWASP A02:2021

Technical Depth:

Identifying weak algorithms: MD5, SHA1, DES, ECB mode — why each is broken

Padding oracle attacks: CBC mode decryption, POODLE, BEAST

Hash cracking: rainbow tables, salted hashes, cost factors in bcrypt/argon2

TLS misconfigurations: DROWN, ROBOT, BEAST, Heartbleed (C)

Data exposure: plaintext passwords in logs, PII in URL parameters, unencrypted database fields

Insecure random number generation: predictable session tokens, API keys

Labs: CryptoHack (cryptohack.org) | PortSwigger "Cryptography" | Hashcat practice

---

#### 2.3.7 Ad AppSec Topics

Technical Depth:

SSTI: Jinja2, Twig, Freemarker — identifying template engines, RCE payloads, sandbox escape

Insecure Deserialization: Ja chains (ysoserial), PHP object injection, Python pickle RCE

Race Conditions: TOCTOU in financial transactions, coupon reuse, limit bypass

WebSocket Security: hijacking, injection, authentication bypass

GraphQL: introspection abuse, batch query DoS, field-le bypass

HTTP Request Smuggling: CL-TE, TE-CL desync, cache poisoning

Prototype Pollution: Ja client-side and ser

> [!WARNING]
> These are the high-se that separate junior testers from senior engineers. SSTI leads to direct RCE. Deserialization caused the Equifax breach (147M records). These appear in senior AppSec interviews.

Labs: PortSwigger "SSTI" (all 7) | "Insecure Deserialization" (all 10) | "HTTP Request Smuggling" (all 22)

---

2.4 System Exploitation

Concept: Research, Exploit De, and Post-Exploitation

Technical Depth:

Metasploit Framework: architecture (modules, payloads, handlers), writing custom modules

Manual exploitation: using and modifying public PoC code without Metasploit

Buffer o (32-bit Linux): stack layout, finding offset with pattern_create, controlling EIP, ret2libc

Shellcode: staged payloads, NASM basics

Post-exploitation: Meterpreter, pi (route, socks4a), port forwarding, file exfiltration

Credential har: hashdump, Mimikatz (sekurlsa::logonpasswords, lsadump::sam), LSASS dump

Linux privesc: SUID abuse, sudo misconfig, writable /etc/passwd, cron jobs, PATH hijacking

Windows privesc: unquoted service paths, token impersonation, AlwaysInstallElevated, Potato attacks

Labs: TryHackMe "Buffer O Prep" | HackTheBox "Lame", "Legacy", "Devel", "Grandpa" | PWNCollege

---

2.5 Acti Attacks

Concept: AD Enumeration, Credential Attacks, and Domain Dominance

Technical Depth:

AD enumeration: BloodHound/SharpHound — graph-based attack path analysis, PowerView cmdlets

Kerberoasting: requesting TGS for SPNs, extracting and cracking service account hashes offline

ASREPRoasting: attacking accounts with pre-authentication disabled

Pass-the-Hash (PtH): NTLM hash reuse without cracking, SMBexec, WMIexec, PSexec

Pass-the-Ticket (PtT): Kerberos TGT/TGS ticket injection with Mimikatz

Golden Ticket: forging TGTs with the KRBTGT hash — domain persistence

DCSync: replicating domain controller to extract all hashes without local access

ACL/ACE abuse: WriteDACL, GenericAll, GenericWrite — abusing AD permissions

> [!IMPORTANT]
> The Security Why: The SolarWinds attack used Golden Tickets. MITRE ATT&CK TA0006 (Credential Access) and TA0008 (Lateral Mo) are dominated by AD techniques.

Labs: Build your own AD lab (Windows Server 2019 DC + 2x Windows 10 Pro) | HackTheBox "Active", "Forest", "Sauna", "Resolute"

---

Phase 3: Defensi

Duration: 8 to 10 Weeks

Goal: Mirror every Phase 2 attack with a detection rule and defensi. Purple team mindset.

---

3.1 Security Operations and SIEM

Concept: Log Analysis, SIEM Architecture, and Detection Engineering

Critical Windows Event IDs:

| Event ID | Meaning |
|---|---|
| 4624 | Successful logon |
| 4625 | Failed logon |
| 4688 | Process creation |
| 4776 | NTLM authentication |
| 4768/4769 | Kerberos TGT/TGS request |
| 7045 | New service installed |
| 4698 | Scheduled task created |

Technical Depth:

Log sources: Windows Event Logs, Linux auth.log/syslog, web server logs, DNS logs, firewall logs

Sysmon: install, configure, understand all 30 event types (Event ID 1: process, 3: network, 8: CreateRemoteThread, 10: ProcessAccess)

SIEM platforms: Splunk (SPL), Elastic Stack (ECS, KQL), Microsoft Sentinel (KQL)

Sigma rule format — convert Sigma to SIEM-specific query language

Log aggregation pipeline: Beats → Logstash → Elasticsearch → Kibana

Alert triage: true positive positi fatigue, priority tuning

Labs: TryHackMe "Splunk: Basics", "In with ELK 101", "Sysmon" | HELK Project | Sigma GitHub

---

3.2 Threat Hunting

Concept: Proacti Hunting Using MITRE ATT&CK

Key TTPs to Hunt:

| ATT&CK TTP | Signal | Hunt Query Focus |
|---|---|---|
| T1003 (Credential Dumping) | LSASS access, SAM hi | ProcessAccess to lsass.exe |
| T1059 (Scripting) | PowerShell in, encoded commands | Encoded -enc parameters |
| T1071 (C2 Protocol) | Beaconing in DNS, HTTP, HTTPS | Periodic outbound connections |
| T1021 (Lateral Mo) | Unusual SMB, WMI, PSexec patterns | Network logon events |
| T1543 (System Process) | New services, scheduled tasks | Event ID 7045, 4698 |

Labs: ATT&CK Na | ThreatHunter-Playbook (GitHub) | Splunk BOTS (Boss of the SOC) | E

---

3.3 Digital Forensics and Incident Response (DFIR)

Concept: E Acquisition, Forensic Analysis, and Incident Handling

Technical Depth:

Disk Forensics: chain of custody, dd/FTK Imager, Autopsy, MFT analysis, deleted file recovery

Memory Forensics: 3 — pslist, netscan, cmdline, malfind, dlllist

Network Forensics: PCAP analysis in Wireshark, Zeek for network logging

Artifact Analysis: Windows prefetch, shimcache, amcache, LNK files, browser history

Malware Triage: static analysis (strings, PE header, ), dynamic analysis (any.run, Cuckoo)

IR Process: PICERL framework (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned)

Ransomware IR: isolating infected systems, identifying patient zero, e preser

Tool Stack: Autopsy 3 Wireshark Eric Zimmerman Tools REMnux Linux

Labs: TryHackMe "", "Autopsy", "Redline" | CyberDefenders | BlueTeamLabs Online

---

3.4 Security Architecture and Hardening

Concept: Implementing Defense-in-Depth Controls Mapped to NIST 800-53

Technical Depth:

Network segmentation: VLANs, micro-segmentation, Zero Trust Network Architecture (ZTNA)

Endpoint hardening: CIS Benchmarks for Windows/Linux

Application hardening: CSP, HSTS, X-Frame-Options, WAF configuration, input at code level

Identity hardening: MFA, Pri Access Workstations (PAWs), AD tiering model

Management: CVE/C, patch prioritization, scan-to-patch SLAs

Secret management: HashiCorp Vault, AWS Secrets Manager — eliminating hardcoded credentials

Container security: non-root containers, read-only filesystems, seccomp, Kubernetes RBAC, Tri

Labs: CIS Benchmarks (free PDF) | AWS 3-tier app with GuardDuty + CloudTrail | HashiCorp Vault local install

---

Phase 4: Purple Teaming and Ad Specializations

Duration: 8 to 10 Weeks

Goal: Integrate offensive and defensi into a unified professional practice.

---

4.1 Purple Team Operations

Concept: ATT&CK-Mapped Ad Simulation and Detection

Technical Depth:

Purple team methodology: coordinated red/blue exercises red team

Atomic Red Team: executing specific ATT&CK technique tests, SIEM co

VECTR: tracking purple team exercises, documenting detection co

Ad emulation: APT29, FIN7 emulation using ATT&CK E methodology

Gap analysis: ATT&CK Na o — covered techniques

Breach and Attack Simulation (BAS) tools: Caldera, Prelude Operator

Building a purple team report: executi + technical e + detection co metrics

Labs: Atomic Red Team (GitHub) | CALDERA (MITRE Engenuity) | VECTR (vectr.io) | TryHackMe "Purple Team" pathway

---

4.2 Cloud Security

Concept: AWS/Azure Cloud Attack and Defense

Technical Depth:

AWS attacks: IAM pri escalation, S3 bucket attacks, Lambda abuse, EC2 metadata SSRF (169.254.169.254), CloudTrail e

Azure attacks: password spray, token theft, PRT theft, Managed Identity abuse

Cloud IAM: principle of least pri, cross-account roles

Cloud forensics: CloudTrail analysis, S3 access logs, VPC Flow Logs

Kubernetes attacks: RBAC misconfig, service account token theft, container escape, etcd access

> [!IMPORTANT]
> The Security Why: 85%+ of enterprise workloads are in the cloud by 2026. IAM misconfiguration has caused the largest cloud breaches. This is a fast-growing, high-salary specialization.

Labs: CloudGoat (Rhino Security Labs) | flaws.cloud | flaws2.cloud | CONVEX (Azure) | PMapper

---

4.3 Secure Code Review

Concept: Manual and Automated Source Code Security Analysis

Dangerous Function Patterns to Identify:

Technical Depth:

SAST tools: Semgrep (writing custom rules), Bandit (Python), SonarQube, CodeQL

Dependency scanning: OWASP Dependency-Check, Snyk, npm audit

Secrets scanning: TruffleHog, GitLeaks — finding exposed secrets in repositories

Threat modeling: STRIDE, PASTA, attack trees — modeling threats during design phase

DAST integration: OWASP ZAP, Burp Suite Enterprise in CI/CD pipeline

Labs: Semgrep playground | OWASP Code Review Guide (free PDF) | D code review before exploiting

---

4.4 API Security

Concept: REST and GraphQL API Security Testing — OWASP API Top 10 (2023)

| OWASP API Risk | Description |
|---|---|
| API1: BOLA | Broken Object Le — accessing other users' objects |
| API2: Broken Authentication | Weak API key management, JWT flaws |
| API3: Broken Object Property Level Auth | Mass assignment, excessive data exposure |
| API4: Unrestricted Resource Consumption | No rate limiting, DoS queries |
| API5: BFLA | Broken Function Le — horizontal pri escalation |
| API6: Unrestricted Sensiti Flows | Bypassing intended business logic limits |
| API7: SSRF | Ser Request Forgery via API parameters |
| API8: Security Misconfiguration | Default configs, exposed Swagger/GraphQL introspection |
| API9: Improper In Management | Shadow APIs, undocumented endpoints |
| API10: Unsafe API Consumption | Trusting third-party API responses without |

Labs: OWASP crAPI (Docker) | DVWS | vAPI (GitHub: roottusk/vapi) | TryHackMe "OWASP API Security Top 10"

---

Phase 5: Certifications, Portfolio, and Job Preparation

Duration: 4 to 6 Weeks active prep (run parallel to Phases 3 and 4)

Certification Roadmap

| Certification | Focus | Priority | Provider |
|---|---|---|---|
| eJPT | Junior Penetration Testing | Start here | eLearnSecurity |
| CompTIA Security+ | Broad security fundamentals / HR filter | Early | CompTIA |
| PNPT | Practical Network Penetration Testing | Mid-level | TCM Security |
| eWPTXv2 | Web App Penetration Testing Expert | AppSec specialist | eLearnSecurity |
| OSCP | Offensi Certified Professional | Industry gold standard | Offensi |
| CRTO | Certified Red Team Operator | Acti / C2 | Zero-Point Security |
| GWEB | GIAC Web Application Pentester | AppSec + Blue | SANS |
| AWS Security Specialty | Cloud security | Cloud path | AWS |

Recommended Path by Goal:

AppSec Engineer: Security+ → eWPTXv2 → GWEB → OSCP

Red Team: eJPT → PNPT → CRTO → OSCP

Purple Team / Detection: Security+ → BTL1 → CRTO → OSCP

Cloud Security: AWS SAA → AWS Security Specialty → OSCP

---

Portfolio — What Actually Gets You Hired

> [!IMPORTANT]
> One real bug bounty submission (even P4) is worth more than 50 CTF completions on a resume.

| Portfolio Item | What to Build |
|---|---|
| Bug Bounty Writeups | HackerOne or Bugcrowd submissions. Document every finding including non-accepted ones. |
| C | Find a in an open-source project. Responsible disclosure, C. |
| GitHub: Custom Security Tool | Automated subdomain recon pipeline, SSRF scanner, or JWT auditor in Python. |
| GitHub: Detection Rules | Sigma rules mapped to ATT&CK techniques with test cases. |
| Technical Blog | 10 in-depth articles. Each explains an attack from exploit to detection. |
| Lab Documentation | Document your AD lab setup, attacks run, and SIEM queries written. Screenshots and configs. |
| HTB/THM Profile | Pro Hacker rank on HackTheBox. Top 10% on TryHackMe. |

---

Interview Preparation

AppSec Interviews:

"Walk me through exploiting a blind SQL injection from discovery to data extraction"

"How does a padding oracle attack work mathematically?"

"What is the difference between BOLA and BFLA?"

"How would you test an OAuth 2.0 implementation for security issues?"

Infrastructure / Red Team Interviews:

"Explain Kerberoasting from the perspective of the Windows authentication protocol"

"You have a low-pri shell on a Linux box. Walk me through pri escalation methodology"

"How does DCSync work and what AD permissions does it require?"

Blue Team / Detection Interviews:

"What Windows Event IDs would you alert on for a Pass-the-Hash attack?"

"How would you detect Kerberoasting in your SIEM?"

"Write a Sigma rule for detecting LSASS memory dumping"

---

Phase 6: Continuous De

Duration: Ongoing. This phase never ends.

Staying Current

| Resource | Frequency |
|---|---|
| NVD/C (nvd.nist.gov) | Weekly review of high/critical CVEs |
| MITRE ATT&CK Updates | Bi-annual major releases — review all additions |
| SANS Internet Stormcast | Daily 5-minute podcast |
| PortSwigger Research Blog | Best AppSec research publication |
| Project Zero Blog | Ad zero-day research |
| BleepingComputer / The Hacker News | Daily breach and news |

Communities: Discord (TryHackMe, HackTheBox, TCM Security, NahamSec) | Reddit (r/netsec, r/netsecstudents, r/blueteamsec)

---

Ad Research Tracks (Post Job-Ready — Choose ONE)

| Track | Core Skills | Tools |
|---|---|---|
| Exploit De | Binary exploitation, kernel bugs, browser bugs | pwndbg, ROPgadget, angr, IDA Pro/Ghidra |
| Malware Analysis / RE | Static/dynamic analysis, unpacking, deobfuscation | x64dbg, IDA Pro, FLARE |
| Cloud-Nati | AWS/Azure internals, ser, CSPM | Pacu, ScoutSuite, Prowler |
| Mobile AppSec | Android/iOS analysis, Frida, traffic interception | Frida, Objection, Apktool, jadx |
| Red Team Infrastructure | C2 frameworks, malleable profiles, detection e | Cobalt Strike, Havoc C2, Sliver |
| Detection Engineering | SIEM engineering, custom detection logic, threat hunting | Elastic, Sentinel, Splunk ES |

---

Lab En

> [!WARNING]
> Install these locally. No excuses. Labs are not optional — they are the core of this roadmap.

| En | Type | Install Method | Focus |
|---|---|---|---|
| Metasploitable 2 | Linux VM | Download OVA | Network services exploitation |
| Metasploitable 3 | Windows VM | | Windows exploitation, web apps |
| DVWA | Web App | Docker / XAMPP | OWASP Top 10 basics |
| Juice Shop (OWASP) | Web App | docker run -d -p 3000:3000 bkimminich/juice-shop | Full OWASP Top 10 + API |
| WebGoat (OWASP) | Web App | Docker | Guided AppSec training |
| Windows 7 SP1 (x86) | VM | Manual install | Legacy exploits, EternalBlue |
| Windows Server 2019 | VM | Microsoft E | AD attacks |
| crAPI | API | Docker Compose | API security |
| CloudGoat | AWS | Terraform | Cloud attack and defense |
| machines | VMs | .com | Diverse targets |

---

90-Day Quick-Start Schedule

| Week | Focus | Daily Time |
|---|---|---|
| 1 to 2 | Phase 1: Networking + Linux (OTW Bandit complete) | 2 to 3 hrs |
| 3 to 4 | Phase 1: Windows Internals + Python scripting | 2 to 3 hrs |
| 5 to 6 | Phase 2: Recon + Network attacks (Metasploitable 2) | 3 hrs |
| 7 to 9 | Phase 2: Web AppSec — SQLi, XSS, Auth (PortSwigger + Juice Shop) | 3 to 4 hrs |
| 10 to 11 | Phase 2: System exploitation (Metasploitable 3 + Windows 7) | 3 to 4 hrs |
| 12 | Phase 2: Acti attacks (home AD lab) | 4 hrs |
| 13 to 14 | Phase 3: ELK setup, log analysis, detection rule writing | 3 hrs |
| 15 to 16 | Phase 3: DFIR ( + Autopsy on challenge images) | 3 hrs |
| 17 to 18 | Phase 4: Purple team exercises (Atomic Red Team in lab) | 3 to 4 hrs |

---

Additional Resources

📺 Watch the Series: Cybersecurity Deep Dives in Urdu/Hindi

🛡️ Previous Module: OSI Model: Network Architecture & Security Deep-Dive

🌐 Previous Module: TCP & UDP: Protocol Deep-Dive

💼 Connect: LinkedIn: Muhammad Aqib Tayyab

---

Author

Muhammad Aqib Tayyab — AppSec & Purple Team Student | Certified Ethical Hacker | Bug Bounty Hunter

I am an undergraduate BS-IT student at NUML, Pakistan, pursuing a *"Learning in Public"* philosophy to document my technical cybersecurity journey and build high-quality, accessible resources for the community.

![LinkedIn]()
![YouTube]()
![GitHub]()

---

> *Built on: OWASP WSTG v4.2, OWASP API Top 10 2023, MITRE ATT&CK v14, NIST SP 800-53 Rev 5, NIST SP 800-61 Rev 2, SANS Institute Curriculum*

> *Part of the Learning in Public initiative — pro practical cybersecurity tutorials for the Urdu/Hindi-speaking community.*

#Cybersecurity #SecurityEngineer #AppSec #PurpleTeam #EthicalHacking #OWASP #MitreAttack #PenetrationTesting #LearningInPublic #Pakistan #NUML

项目信息

开发语言：未知

Star 数：11

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A structured 12-18 month roadmap from zero to job-ready Security Engineer — covering Offensive Security, Defensive Engineering, and Purple Teaming. Built on OWASP, MITRE ATT&CK, and NIST 800-53.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。