Important things to know
A no-fluff guide from someone who's been in the trenches and made all the mistakes so you don't have to. Let's be honest for a second.
You probably got interested in penetration testing after watching some hacker movie, seeing a Black Hat talk on YouTube, or stumbling across someone's TikTok where they "hacked" a website in 30 seconds with three commands. The screen was probably glowing green. There may have been a hoodie involved. And now you're convinced: learn Kali Linux, run some tools, get paid six figures.
I wish it were that simple. The uncomfortable truth is that real penetration testing; the kind clients actually pay for, has very little to do with running Metasploit on a vulnerable VM and calling it a career. The tools are the easy part. They're abundant, free, and Googled by everyone. What separates the professionals from the script kiddies is a deep, hard-earned skill stack that most beginners never bother to build.
Social media hasn't helped. The cybersecurity corner of the internet loves to glamorize hacking: flashy terminal sessions, dramatic CVE announcements, "I hacked X in 5 minutes" posts that omit the three weeks of grinding that came before it. It's exciting content, but a terrible curriculum.
This article is for the people who want the real picture. The actual skills. The honest roadmap. No fluff, no gatekeeping, just the stuff that genuinely matters when you're trying to build a career in offensive security.
Pull up a chair. This is going to take a minute and it's going to be worth it.
Why Most Beginners Learn The Wrong Things First
Here's a scene you might recognize:
You decide to get serious about pentesting. You install Kali Linux (or maybe Parrot OS, because that's what the cool kids use). You spend the first two hours getting the terminal to look exactly the right custom color scheme, a slick shell prompt that shows your git branch, maybe a cool ASCII art welcome message. You're practically a hacker already.
Then you open Burp Suite and have no idea what you're looking at. This is the beginner trap, and almost everyone falls into it.
The Tool Obsession Problem
New penetration testers tend to chase tools the way kids collect Pokémon cards. Nmap, Metasploit, SQLmap, Gobuster, Nikto, Hydra — the list goes on. If it has a cool name and ships pre-installed on Kali, it must be important, right?
The problem is that tools are just mechanisms. They don't teach you why something is vulnerable. They don't help you adapt when a tool fails, a firewall blocks your scanner, or you're dealing with a custom application that no tool in the world was built for. Knowing how to point SQLmap at a URL and press Enter is not the same as understanding SQL injection.
Memorizing Commands Without Understanding
Closely related is the habit of copy-pasting commands from walkthroughs without absorbing what's actually happening. You run a tool, it works, you move on. Three weeks later you're in a real engagement and you can't remember the flag syntax more importantly, you don't understand what the tool was even doing.
The professionals who can work in unfamiliar environments and improvise on the fly? They're not doing it because they memorized more commands. They're doing it because they understand the underlying concepts deeply enough to reason from first principles.
The "TryHackMe-Only" Trap
TryHackMe is a genuinely excellent platform for beginners. It's guided, approachable, and gives you a structured path. But there's a failure mode that catches a lot of people: using it as a permanent crutch instead of a launching pad.
Some learners finish dozens of rooms, accumulate points and badges, and feel like they're making massive progress, without ever stepping into a less hand-held environment. Real assessments don't have guided hints. Real targets don't tell you which service to attack first. Platforms like TryHackMe should get you started, not finish your education.
The Comparison Trap
And then there's LinkedIn, where everyone is either sharing their OSCP achievement or announcing a critical RCE they found in some major platform. If you're a beginner, this can feel crushing. Those people seem light-years ahead.
Here's the reality: every single one of them once had no idea what a three-way TCP handshake was. Every expert was once a confused beginner Googling "what is a port." Measuring your beginning against someone else's middle is a great way to quit before you've started.
The Real Skill Stack You Need
Alright. Let's get into it. Here's the actual foundation you need to build and more importantly, why each layer matters in a real engagement.
1. Networking Fundamentals : The Backbone of Everything
If penetration testing is a house, networking is the foundation. Not a nice-to-have foundation. The foundation that determines whether the house stands at all.
Think about it: every attack, every vulnerability, every lateral movement happens over a network. If you don't understand how data moves between systems, you're essentially trying to navigate a city without knowing what roads exist.
What you need to understand:
- TCP/IP — How the internet's fundamental communication protocol works. The three-way handshake (SYN, SYN-ACK, ACK) isn't just trivia, it explains why SYN flood attacks work. Understanding TCP state also helps you interpret Nmap scan results properly.
- DNS — The phonebook of the internet. DNS enumeration is often one of the richest sources of information in a reconnaissance phase. Subdomain discovery, zone transfers, DNS cache poisoning. All of it requires you to actually understand what DNS is doing.
- HTTP/HTTPS — You're going to spend a lot of your career in web applications. HTTP is their language. Headers, methods (GET, POST, PUT, DELETE), status codes, redirects, cookies. Understanding this at a protocol level (not just a "browser magic" level) is essential.
- Ports and Services — Ports aren't random. They're conventions. Knowing that 445 is SMB, 3389 is RDP, 3306 is MySQL, and 22 is SSH helps you read scan results like a map instead of a wall of numbers.
- VPNs and Proxies — Both as concepts for your own operational security and as targets. Understanding how VPNs authenticate and how proxies intercept traffic directly feeds into attacks and configurations.
A practical example: During an internal network assessment, you notice a host with port 5985 open. If you don't know that's WinRM (Windows Remote Management), you might completely miss a critical lateral movement opportunity. If you do know and you understand how WinRM authentication works — you know exactly what to test next.
Networking knowledge turns scan output from noise into intelligence.
Resources: Professor Messer's CompTIA Network+ material (free on YouTube), the classic Computer Networking: A Top-Down Approach by Kurose & Ross, and just... building a home lab with a couple of virtual machines and actually routing traffic between them.
2. Linux Skills — You Cannot Avoid This
The offensive security world runs on Linux. Your attack machines run Linux. A huge percentage of your targets run Linux. Many of the tools you'll use were built for Linux. This is non-negotiable.
The good news: you don't need to be a Linux systems administrator. You need to be comfortable — able to navigate the environment, find what you need, and troubleshoot when things break.
The fundamentals you need:
- File permissions — rwxr-xr-x is not decorative text. Understanding ownership, permission bits, and special bits like SUID is directly relevant to privilege escalation. Misconfigured permissions are one of the most common local privilege escalation vectors.
- Bash basics — Command pipelines (|), redirection (>, >>), loops, conditionals. Not advanced scripting just enough to chain commands together and manipulate output.
- SSH — Key-based authentication, SSH tunneling, port forwarding. You'll use this constantly.
- Process management — ps, top, kill, background jobs. Knowing what's running on a system and how to manage processes is fundamental to post-exploitation work.
- Logs — Where they live (/var/log/), how to read them, and yes, how to clean them up when you're doing an authorized assessment and testing detection capabilities.
- Package management — apt, dnf, pacman. Being able to install tools and dependencies without melting down is a baseline skill.
The realistic beginner struggle: Everyone, at some point, accidentally deletes something important with rm -rf. Everyone accidentally uses > when they meant >> and overwrites a file they needed. It's a rite of passage. The trick is to learn from it rather than abandoning ship.
Pro tip: Use Linux as your daily driver for a while. Not just in a VM for hacking — as your actual operating system. Nothing builds Linux proficiency faster than needing to solve real problems in it every day.
3. Web Application Fundamentals — Where Most Modern Pentesting Lives
According to the Verizon Data Breach Investigations Report, web application attacks consistently account for a significant portion of confirmed data breaches year over year. There's a reason web application penetration testing is one of the most in-demand specializations in the field.
Modern businesses live on web applications. Their ERPs, CRMs, customer portals, APIs, and internal tools are all web-based. That's where the money is, and that's where the vulnerabilities are.
What you actually need to understand:
- Authentication — How login systems work. Session tokens, JWT tokens, OAuth flows, password reset mechanisms. Understanding the logic of authentication lets you spot where it breaks down.
- Sessions and Cookies — How the server keeps track of who you are between requests. Session fixation, session hijacking, insecure cookie attributes — all of this flows from understanding how sessions work.
- APIs — REST APIs are everywhere, and they're frequently undertested. Understanding how APIs authenticate (API keys, OAuth, Bearer tokens), how they serialize data, and how they enforce access control is increasingly essential.
- Input Validation — Or the lack thereof. SQL injection, Cross-Site Scripting (XSS), XML injection, command injection — these vulnerabilities exist because applications trust user input they shouldn't. Understanding why they happen is more valuable than knowing which tool to run.
- Common Vulnerabilities — The OWASP Top 10 isn't just a list to memorize; it's a framework for understanding the categories of failure that web applications repeatedly fall into. Study each one deeply, not just the name.
The critical mindset shift: Understanding web application security is about understanding business logic, not just technical exploits. The most interesting vulnerabilities often aren't technical at all. They're cases where the application does exactly what it was programmed to do, but in a way the developers never intended users to leverage.
Running a scanner blindly and reading the output is not web application pentesting. Understanding an application's authentication flow well enough to find a privilege escalation that no scanner would ever catch? That's the real work.
4. Scripting & Automation — Stop Doing Things Manually
At some point in every penetration tester's early career, they find themselves doing something repetitive. Testing the same parameter across 50 endpoints. Trying a list of usernames against a login form one at a time. Reformatting scan output for a report.
This is where scripting changes everything.
You don't need to be a software engineer. You need to be comfortable enough to automate tedious tasks, customize tools, and write simple utilities that make your life easier.
The practical lineup:
- Python — The lingua franca of offensive security tooling. Requests library for HTTP interactions, socket programming for network tasks, argument parsing for building your own tools. Start here.
- Bash — For stringing together command-line operations and automating workflows in Linux environments. Writing a quick Bash script to iterate through a list of hosts is faster than doing it manually every time.
- PowerShell — Essential if you're doing Windows assessments. Post-exploitation on Windows systems often lives and dies by PowerShell. Understanding how to write and execute PowerShell scripts (and how defenders try to block them) is a real competitive advantage.
- The automation mindset — Before writing any script, ask: "Will I do this more than twice? Could a script do this better?" The answer is often yes.
A realistic example: You're doing a web assessment and you need to test whether a parameter on 30 different API endpoints is vulnerable to a specific manipulation. You could do this manually in Burp Suite for the next four hours. Or you could write a 20-line Python script that does it in 90 seconds and logs the interesting responses. That's not just efficiency — it also reduces human error.
The best penetration testers I've seen are not prolific coders. They're pragmatic ones. They write ugly, functional scripts that get the job done.
5. Cloud & Modern Infrastructure Awareness — The New Normal
Here's a statistic that should shift your perspective: by some estimates, over 60% of enterprise workloads are now running in the cloud, and that number keeps climbing. If you're learning penetration testing with exclusively on-premise mindset, you're learning for an industry that's rapidly moving on without you.
Cloud environments introduce entirely new attack surfaces. Misconfigurations are the dominant vulnerability class — not exotic memory corruption bugs. And the blast radius of a single misconfigured S3 bucket or overly permissive IAM role can be catastrophic.
What you need to be aware of:
- AWS (Amazon Web Services) — IAM (Identity and Access Management) misconfigurations, S3 bucket exposure, SSRF attacks that hit the EC2 metadata service, Lambda function vulnerabilities. AWS is the dominant cloud provider and knowing its security model is increasingly essential.
- Azure — Similar concepts, different implementation. Azure Active Directory misconfigurations, storage account exposure, service principal abuse.
- Containers — Docker is everywhere. Understanding container escape, privileged containers, and exposed Docker sockets opens up entire new attack paths.
- Kubernetes — The dominant container orchestration platform. Kubernetes misconfigurations (exposed dashboards, insecure RBAC policies) are alarmingly common and can result in full cluster compromise.
- CI/CD Pipelines — GitHub Actions, Jenkins, GitLab CI — these pipelines often run with elevated permissions and can be abused to pivot from a compromised code repository to production environments.
You don't need to be a cloud architect. But you need to understand these environments well enough to recognize where the attack surface is and where misconfigurations tend to hide.
Free resources to start: AWS has a free tier — spin up an account and break things. CloudGoat by Rhino Security Labs is a deliberately vulnerable AWS environment designed for learning. flaws.cloud is a fantastic, free learning platform built around real AWS security scenarios.
6. Communication & Reporting Skills — The One Everyone Ignores
Let me tell you about the most underrated skill in penetration testing.
It's not the ability to chain a zero-day with a logic flaw for a full RCE. It's not knowing every technique in MITRE ATT&CK. It's not even having the best custom tooling.
It's being able to explain what you found, why it matters, and what should be done about it — clearly, professionally, and in a way that the right people actually act on.
Reports are the product that clients receive. They're what leadership reads. They're what gets remediation funded or ignored. A brilliant finding that's buried in jargon, poorly organized, or missing business context is a finding that might never get fixed.
The communication skills that matter:
- Writing clear findings: Every finding should answer: What did you find? How did you find it? What's the realistic impact? How do you reproduce it? How do you fix it? Keep the technical detail in an appropriate section; lead with impact.
- Explaining risk in business terms: "SQL injection on the login page" is a technical description. "An attacker could access and exfiltrate the entire customer database without credentials" is the business impact. Both matter; only the second one gets the CISO's attention.
- Talking to clients: Scoping calls, kickoff meetings, debrief presentations. Being able to speak fluently about your work without either losing the technical audience or alienating the non-technical one is a real skill that separates junior pentesters from senior ones.
- Professionalism: Deadlines, clear communication when issues arise, not surprising clients with scope changes or sensitive findings discovered late. The soft skills you'd need in any professional role still apply here.
A client will remember a pentest that found a critical vulnerability. They'll remember you if you explained it so clearly that they finally got budget to fix their security program.
The Skills Beginners Usually Ignore (But Shouldn't)
Let's talk about the skills that never make the "Top 10 Hacking Tools" lists but quietly determine who actually succeeds in this career.
- Documentation: Get comfortable writing things down as you work. Commands you ran. Output you saw. Timestamps. Screenshots. In a real engagement, your documentation is your work product, your legal protection, and your memory. Many beginners wing it and then spend hours reconstructing what they did for the report. Document as you go. Every time. No exceptions.
- Research Skills: Pentesting is a research-heavy discipline. You will constantly encounter technologies, applications, and configurations you've never seen before. The ability to rapidly learn something new — reading documentation, searching vulnerability databases, digging through GitHub issues — is arguably more important than any fixed body of knowledge.
The professionals who stay ahead aren't the ones who memorized the most. They're the ones who can learn the fastest.
- Patience (Seriously): I once spent nearly five hours trying to get a specific Python exploit to work against a target. Adjusted the payload. Checked encoding. Reconfigured the listener. Rebuilt the environment. Repeated. Finally found the issue: a single extra space in one line of the configuration file.
One. Space. Penetration testing involves a lot of this. Systems that behave unexpectedly. Exploits that fail for mysterious reasons. Rabbit holes that go nowhere. The people who succeed are not the ones who never get frustrated. They're the ones who get frustrated and keep going anyway.
- Reading Technical Documentation: The actual documentation for a technology — RFC specs, official API docs, vendor security guides — is often far more useful than a blog post or YouTube walkthrough. And far fewer people read it, which means the information you get from it is less commoditized.
Get comfortable reading the primary source. It's a competitive advantage.
- Understanding How Systems Actually Work: This sounds obvious, but it's rarer than you'd think. Don't just learn how to attack systems — learn how they're built. Read about how authentication systems are designed. Understand why session tokens work the way they do. Study the threat models that developers are supposed to consider.
When you understand how something is supposed to work, you'll naturally start noticing where it could fail.
- Critical Thinking: Pentesting, at its core, is structured curiosity. You're asking: what happens if I do this? What if the developer didn't consider that? What are the assumptions this system is making, and what happens when those assumptions break?
This kind of thinking can't be automated. It's developed through practice, through reading, through intentionally questioning things. It's what separates people who find interesting vulnerabilities from people who just run scans.
Fun Facts & Interesting Statistics
Here are some numbers that might surprise you — and that should probably shape how you think about where to focus your learning.
- The number of publicly exposed APIs has been growing dramatically and APIs are frequently undertested in security assessments. Firms like Gartner have flagged API security as one of the most significant enterprise risk areas.
- Cloud security job demand has been growing at rates that outpace the rest of cybersecurity. LinkedIn and major recruiting platforms regularly show cloud security and cloud penetration testing roles among the fastest-growing positions in the field.
- OWASP documents the most critical web application security risks. The fact that the same vulnerability classes injection, broken access control, misconfigurations — keep appearing on their Top 10 year after year tells you something important: the fundamentals aren't going anywhere.
The takeaway from all of this? Web applications, cloud environments, and APIs are where the industry is living right now. Build your skills accordingly.
Want to learn about how to get started as a SOC Analyst? Then the Amdari SOC Analysis work experience program helps you build your portfolio with projects that have real business impacts and increase your chances of landing jobs. Click this link to book a free clarity call with our team to be guided on what matches your skills best.
