Introduction
Cybersecurity is a broad field that includes networking, operating systems, programming, security tools, penetration testing, and threat detection.
This roadmap covers the fundamental concepts, tools, practical labs, and security frameworks to study while building a foundation in cybersecurity.
1. Computer Fundamentals
How computers works
CPU, RAM, ROM, and storage
Operating systems and applications
Virtualizations and virtual machines
Basic computer troubleshooting
2. Networking
OSI model
TCP/IP model
TCP vs. UDP
IP addresses: IPv4 and IPv6
Private vs. public IP addresses
MAC addresses
Subnetting
Default gateway
DNS, DHCP, ARP, ICMP, and other network protocols
HTTP vs. HTTPS
SSL/TLS
SSH, FTP, SMTP, and other protocols
Ports and protocols
VLANs and firewalls
Proxies and reverse proxies
VPNs
Wi-Fi security
Network security
Network traffic analysis
Packet capture
3. Linux Fundamentals
Linux architecture
Linux distributions
Linux filesystem
Basic terminal commands
File and directory management
Users and groups
File permissions
System logs
SSH configuration
Linux network commands
4. Windows Fundamentals
Windows architecture
Windows filesystem
Users and groups
NTFS permissions
Local and administrator accounts
Task Manager
Processes and services
Windows Registry
Event Viewer
PowerShell
Microsoft Defender
Windows Firewall
5. Programming and Scripting
Programming fundamentals
Variables and data types
Conditional statements and loops
For loops and iteration
Functions
Object-oriented programming (OOP) concepts
Python
Bash scripting
SQL fundamentals
JSON and XML
REST APIs
Git and GitHub
6. Cybersecurity Fundamentals
What is cybersecurity?
CIA Triad: Confidentiality, Integrity, and Availability
Authentication and authorization
Principle of least privilege
Threats, vulnerabilities, and risks
Security controls
Risk assessment
Common attack types
Malware
Phishing
Social engineering
CVE, CWE, and CVSS
OWASP Top 10
MITRE ATT&CK
7. Cryptography
Plaintext and ciphertext
Encryption and decryption
Symmetric and asymmetric encryption
Hashing and salting
Encryption vs. hashing
Public and private keys
TLS certificates
Password hashing
8. Web Technologies
How websites work
Frontend and backend
HTML, CSS, and JavaScript
HTTP requests and responses
HTTP status codes
HTTP methods
HTTP headers and cookies
Sessions
Same-Origin Policy
Web servers
Reverse proxies
9. Common Vulnerabilities
You can find common vulnerabilities in these :
OWASP Top 10 for web applications
OWASP Top 10 for mobile applications
OWASP Top 10 for APIs
10. Security Tools
Nmap
Metasploit
John the Ripper
Wireshark
Gobuster
Hydra
Burp Suite
SQLmap
Netcat
OWASP ZAP
Nessus
There is also other tools more than these
11. Web Application Penetration Testing
Penetration testing methodologies
Information gathering
Passive and active reconnaissance
Authentication and authorization testing
OWASP Top 10 for web applications
API testing
Risk rating
Reporting and remediation
For practice use portswigger web security academy and also refer owasp top 10 for web
12. Network Penetration Testing
Port scanning
Service scanning
Version detection
Vulnerability scanning
Exploitation
Lateral movement
Privilege escalation
Reporting
13. Active Directory Security
Windows domains
Active Directory architecture
Domain Controllers
Active Directory Users and Computers
Organizational Units (OUs)
Group Policy Objects (GPOs)
Kerberos authentication
NTLM authentication
LDAP
Service Principal Names (SPNs)
BloodHound
Impacket
Kerbrute
Pass-the-Hash
Golden Ticket attacks
14. SOC and Blue Team
Security Operations Center (SOC)
Security Information and Event Management (SIEM)
Security logs
Alert triage
Threat monitoring
Threat hunting
Incident response
Intrusion Detection and Prevention Systems (IDS/IPS)
Endpoint Detection and Response (EDR)
Network Detection and Response (NDR)
Alert investigation
MITRE ATT&CK
Security documentation
15. SOC Tools
Wazuh
Splunk
Microsoft Sentinel
Sysmon (Windows)
Windows Event Viewer
Auditd (Linux)
Suricata
Wireshark
YARA
Sigma rules
16. Mobile Application Security
Android architecture
Android application concepts
Android permissions
OWASP Top 10 for mobile applications
Reverse engineering
Static and dynamic analysis
Frida
Drozer
MobSF
JADX-GUI
Android Debug Bridge (ADB)
Objection
SSL pinning
17. Security Standards and Frameworks
OWASP Top 10
MITRE ATT&CK
Common Weakness Enumeration (CWE)
Common Vulnerabilities and Exposures (CVE)
Common Vulnerability Scoring System (CVSS)
NIST standards
ISO/IEC 27001
Osintframeworks
18. Practical Labs and Learning Platforms
Hands-on Cybersecurity Labs
TryHackMe
Hack The Box
PortSwigger Web Security Academy
OverTheWire
OWASP Juice Shop
DVWA
Metasploitable
VulnHub
PicoCTF
SOC and Blue Team Practice
Blue Team Labs Online
Tryhackme
LetsDefend
Linux and Security References
Linux Journey
Pentestmonkey
Wappalyzer
GTFOBins
Cisco Networking Academy
Vulnerability Disclosure and Bug Bounty Platforms
Bugcrowd
HackerOne
YesWeHack
Intigriti
Bugbase
Final Roadmap Checklist
Computer fundamentals
Networking
Linux fundamentals
Windows fundamentals
Programming and scripting
Cybersecurity fundamentals
Cryptography
Web technologies
Common vulnerabilities
Security tools
Web application penetration testing
Network penetration testing
Active Directory security
SOC and Blue Team
SOC tools
Mobile application security
Security standards and frameworks
Practical labs and learning platforms
If you have any doubt you can contact me:
Buy Me a Coffee: buymeacoffee.com/jaseervk
GitHub: github.com/jaseervk
Portfolio: www.jaseervk.com
Blog: blog.jaseervk.com
LinkedIn: linkedin.com/in/jaseer-vk-
Medium: https://medium.com/@jaseervk321