How to Start Learning Ethical Hacking in 2026

If you search "how to become an ethical hacker," you'll get a hundred lists of tools with no order to them. That's the wrong starting point. Tools are the easy part — you can learn Nmap's flags in an afternoon. What actually takes time is the foundation underneath: how networks talk to each other, how operating systems work, and how to think like someone probing for the gap nobody else noticed.

This roadmap is the order that foundation should actually go in. Realistic timeline: 6-12 months of consistent, part-time study to be job-ready at an entry level. Faster if you already have an IT background, slower if you're starting completely cold — and that's fine.

Step 1: Networking and Linux fundamentals (4-6 weeks)

You cannot skip this. Nearly every technique later in this roadmap assumes you already understand:

TCP/IP basics — what a port is, the three-way handshake, TCP vs UDP
DNS — how a domain resolves to an IP, common record types
HTTP/HTTPS — request/response cycle, headers, status codes, cookies
The Linux command line — file permissions, processes, piping, basic Bash

Free resources that cover this well: TryHackMe's "Pre Security" learning path, and Professor Messer's free Network+ videos if you want more depth on networking specifically.

Step 2: Learn to script, badly at first (2-3 weeks, ongoing after)

You don't need to be a software engineer. You need enough Python or Bash to automate a repetitive task and to read exploit code well enough to understand what it's doing before you run it. Running code you don't understand against a target — even an authorized one — is how people cause damage they didn't intend.

Step 3: Core security concepts (3-4 weeks)

Before touching offensive tools, get familiar with:

The OWASP Top 10 — the ten most common web application vulnerability classes
Authentication vs authorization, and why conflating them causes real bugs
Common misconfiguration patterns (default credentials, exposed admin panels, verbose error messages)

This is the "why" layer. Skipping it is how people end up running tools without understanding what the output means.

Step 4: Hands-on practice — CTFs and labs (ongoing from here)

This is where it clicks. Start with TryHackMe's beginner-friendly rooms, move to HackTheBox once you're comfortable with the basics. Don't just follow write-ups passively — get stuck, stay stuck for a while, then read a write-up and understand why your approach didn't work. That discomfort is the actual learning. See Labs for write-ups on specific rooms and how to approach them.

Worth building good session habits early, too — see why I run every engagement through tmux for a workflow that scales past your first few boxes.

Step 5: Get comfortable with the core toolset

You don't need to master every tool that exists. You need real fluency in a handful:

Nmap — reconnaissance and port scanning
Burp Suite — web application testing
Wireshark — packet-level traffic analysis
Metasploit — exploitation framework (understand what it's doing, don't just run modules blind)
A repeatable method for privilege escalation once you have a foothold — see the script privesc checklist for one specific, common case

Start with Guides for walkthroughs on each of these.

Step 6: Certifications, in a sane order

Certifications aren't required to be good at this, but they matter for getting past HR filters early in a career. A sane order:

CompTIA Security+ — foundational, broadly recognized, good if you're coming from zero IT background
eJPT (eLearnSecurity Junior Penetration Tester) — affordable, genuinely hands-on, good first practical cert
PNPT or OSCP — respected, practical, proof you can actually do the work under time pressure. OSCP in particular still carries real weight with employers.

Don't chase certs before you have the hands-on hours to back them up — a cert without practical skill behind it is a red flag in an interview, not a green light. If OSCP is the target, see the OSCP prep roadmap for how the current exam actually works and how to structure your study time.

Step 7: Build a home lab

Set up a small virtualized lab (VirtualBox or Proxmox, a Kali VM, a couple of deliberately vulnerable target VMs like Metasploitable). This is where you break things without consequence, and it's where a lot of real learning happens outside of structured courses. See the Toolkit for hardware/software that's actually worth buying for this — and once it grows past one box, a domain and Cloudflare Tunnels make it much less annoying to reach from outside your network.

The one rule that matters more than any tool

Authorization is the line. Everything above is legal and valuable when practiced against systems you own, a home lab, or a platform that explicitly authorizes it (CTF platforms, in-scope bug bounty programs). The same skills become a crime the moment you point them at something you don't have permission to test. Get permission first, every time — no exceptions, no "I was just curious."

What to skip

Buying a dozen "hacking tool" bundles before you've used the free stuff enough to know what you actually need
Chasing exotic exploits before you're solid on fundamentals — most real-world findings are boring misconfigurations, not zero-days
Any course or roadmap that skips straight to "tools" without explaining networking and Linux first

Next step: if you haven't touched a terminal much, start with Guides — Linux fundamentals and Nmap first.