CTF Path: Beginner → Advanced
🎯 Stage 1: Foundation (Beginner)
Goal: Understand basics of systems, networks, and Linux.
Area Skills / Tools
Linux Shell commands, bash scripting, permissions
🔐 Security Basics CIA triad, common attack vectors
🧱 Networking TCP/IP, ports, services, DNS, ping, traceroute
🧪 Tools nmap, netcat, wireshark, curl, tcpdump
Practice OverTheWire: Bandit, TryHackMe: Pre-Security
🧨 Stage 2: Core Hacking Skills
Goal: Learn exploitation fundamentals.
Domain Focus
🔎 Recon Enumeration: nmap, dirsearch, enum4linux, whatweb, gobuster
💻 Web Exploitation XSS, LFI, RFI, SQLi, CSRF, SSTI
🧬 Reverse Engineering Ghidra, GDB, radare2, IDA Free
🧩 Binary Exploits Buffer overflows, format string bugs
🐚 Privilege Escalation Linux and Windows enumeration scripts, kernel exploits
🔐 Hash Cracking John the Ripper, Hashcat, wordlists
📦 Forensics Stego, memory dumps, PCAP analysis
🔁 Practice: HackTheBox, TryHackMe, CTFtime.org
🚩 Stage 3: Specialization & Team CTFs
Goal: Go deeper into specialties like red teaming, reversing, web app hacking.
Specialization Focus & Resources
Web Burp Suite Pro, bug bounty writeups
🔁 Reversing CTF challenges, Crackmes
🧬 Pwn Exploit Development, ROP, ASLR/DEP bypass
🧠 Crypto Stream ciphers, RSA flaws, XOR, custom algorithms
OSINT Trace Labs CTFs, people search, metadata
🔧 Tools to Learn: pwntools, peda, metasploit, impacket, BloodHound, kerbrute,
mimikatz
🎓 Stage 4: Real-World & Red Team Ops
Goal: Apply skills in professional, red team, or offensive environments.
Build lab with AD + Kali + vulnerable VMs
Practice Kerberos attacks, Golden/Silver Tickets, DCShadow, Lateral Movement
Use Cobalt Strike, Sliver, Empire, SharpHound, Certify
Explore Purple Teaming, MITRE ATT&CK mapping
Start Bug Bounty or OSCP prep
🧪 Practice Platforms by Stage
Platform Best For
OverTheWire CLI + Linux fundamentals
TryHackMe Guided learning, beginner to mid-level
HackTheBox Realistic labs, medium to advanced
PicoCTF Beginner puzzles, high school friendly
CTFtime.org Official competitions (Jeopardy & Attack/Defense)
Root-Me Wide variety of CTF challenges
VulnHub Offline vulnerable machines
PortSwigger Labs Web hacking mastery
🎒 Recommended Learning Resources
📚 Books:
"The Web Application Hacker’s Handbook"
"Hacking: The Art of Exploitation"
"Practical Binary Analysis"
📺 YouTube:
IppSec (HTB walkthroughs)
John Hammond
LiveOverflow
📦 Tools:
Burp Suite, Kali Linux, Metasploit, Wireshark
📌 Suggested Timeline
Month Focus
1–2 Linux + Web + Enumeration basics
3–4 Buffs, privesc, basic scripting
5–6 Binary exploitation, advanced web, red team
Ongoing Compete in CTFs monthly (use CTFtime)
