Resources

This is not a definitive guide. Cyber Security is an evolving field with infinite knowledge. However, from our experience, covering this roadmap of resources (which is a lot btw) will give you a good grasp of most concepts to make you skilled enough to explore and understand more advanced stuff yourself.

To understand how to exploit, you must first understand the target you are exploiting. This makes the field huge, as you must first have some knowledge of development of the stuff you are attacking. That said, many resources are freely available on the internet with just information to not overwhelm you while giving useful important.

As with learning anything, only reading won’t take you anywhere and you’ll have to practice to understand things. All the best!

Below is a roadmap formed by our experience. If you want a more general list of resources check out Awesome CTF.

General

These are skills which may not seem of direct use in CTFs or in CyberSecurity in general. But when combined with appropriate knowledge, they take a level apart from others. Mastering these skills as early as possible had added benefit specially where you are expected to know some basics of them.

`Linux`

Being comfortable in using Linux is an important first task for every hacker. Understanding of filesystems, processes, users and security principles is also a must. Skill in Bash Scripting will also help you automate lots of tasks while testing.

Learning

The best way to learn linux is to use it, constantly, only with the terminal. Instead of trying to go back to other OS or GUI tools, force yourself to search and learn how to do something via terminal.

Our workshop covered all content you need to start. Access it here

Practice Games

`Programming`

Programming is an essentail skill for all hackers. Understanding basic principles for any code helps to quickly interpret code in different languages. Understanding of C at a deep level, Python, Javascript and Bash will help a long way in terms of CTFs.

Learning

There are some great free online resources for learning all the above mentioned languages. Make sure you keep writing programs and not only read to actually learn.

Language	Resource
C	Beej’s Guide to C Programming
Python	Official Python Tutorial
Javascript	You Don’t Know JS Yet
Bash	Follow anything from Awesome Bash

Practice

The best way to practice these languages is to use them. One of the ways is to build projects (stuff you want to). Another route is to learn Data Structures and Algorithms and apply it in each language. This way you will be able to understand and explore the intricacies of the specific language.

Binary Exploitation

Binary exploitation (known as pwning) is the art of exploiting vulnerabilities in Binaries (eg - PE files in Windows and ELF files in Linux) to get desired unintentional functionailities. This unintentional functionality may vary from printing a hidden variable in the memory to getting a full admin shell on the system. There is practically no limit to types of challenges you can see here - once you believe you have it all, CTF authors throw different architectures for you to work on! (Looking at you RISCV :D). The ultimate learning is therefore not just the methods, but understanding actual working of the system and how to build those methods.

`Prerequisites`

To actually understand these binaries and how they work at an OS level, you definitely need to have some knowledge of OS concepts. You also need to understand some assembly in order to understand the program at instruction level. Knowledge of debugging in tools like gdb give additional help. Scripting knowledge in Python makes things a lot easier using the pwntools library.

`Core Techniques`

There are some awesome resources for you to teach the Core Techniques along with some prerequisistes as well!

Topic	Resource
Operating Systems	Operating Systems: Three Easy Pieces
x86 Assembly	x86 Assembly Guide
Core	LiveOverflow’s Playlist
Core	pwn.college Dojos
Core	ir0nstone’s Notes

Cryptography

Cryptography is the study of encryptions and encodings to make and break them. The modern internet relies on cryptography as a backbone to ensure that the packets are delivered to their intended recipients and to them only. An interest in mathematics will allow you to explore and understand a wide variety of encryption schemes and techniques, along with their weaknesses.

Type	link
To practice and to learn	CryptoHack
RSA Attacks	20 Years of attacks on RSA
Tool to identify and break (un)common ciphers	dcode

Forensics

Forensics deal with investigation of certain events and determining what would have happened. Its mostly related with Reverse Engineering for Malware Analysis. Some other things might include fixing corrupt files, recovering deleted data, network analysis etc. Steganography, the art of hiding data in plain sight is also considered a part of Forensics sometimes. It usually requires knowledge for file formats and their structure. Majority of steganography challenges are based on using a specific tool.

OSINT

OSINT stands for Open Source Intelligence. Gathering information from public data about a target is the job to do. Skillset wise, it doesn’t seem much, but its actually the toughest - patience and observation skills. The only way to develop the correct intuition and learn these skills is practicing and solving challenges in CTFs. You can also take help of some tools to make your life easier.

Type	Resource
List of Common Tools	OSINT Framework
Some OSINT exercises	Sofia Santos’ Exercises
Some more OSINT exercises	OSINT Dojo

Reverse Engineering

Very similiar to Binary Exploitation, Reverse Engineering also deals with Binaries (well not always but you’ll know). But instead of finding vulnerabilities, RE deals with understanding the complete functionality of the given binary. RE is used vastly in real world and is also used in conjunction with many categories like Forensics (for malware analysis) and Binary Exploitation (you need to understand the binary first to find a flaw). Although a lot of knowledge and skill is required to master RE, a lot of the work can be done by tools if you know how to use them.

Type	Resource
RE Principles	Reverse Engineering for Beginners(RE4B) - Last Free Copy
Ghidra	stacksmashing’s Reversing WannaCry

We highly recommend LiveOverflow’s this video which is a very good starting point for learning RE and assembly as well.

Web Exploitation

Web Exploitation, also probably the most heard or imaginated form of hacking deals with hacking web apps. Web Exploitation requires understanding of how the web functions before actually understanding any security concerns. Most developers…cough, cough…don’t understand this and dive directly into frameworks for developing web apps which ultimately leads to botched up security. Although frameworks now are much more secure by design, still there is a lot of scope for finding bugs due to some…cough, cough…uncareful developers.

`Prerequisites`

Understanding basic networking, HTTP requests and any single web development framework(just to know the developer’s POV) would be great. You will need decent knowledge of Javascript, HTML, CSS as well.

Type	Resource
Computer Networking Basics	LiveOverflow’s Computer Networking
Protocols	LiveOverflow’s What is a protocol?
Servers	LiveOverflow’s What is a server?
Web	pwn.college’s Talking Web dojo
Web Dev with Flask	Corey Schafer’s Flask Series

`Core`

There are some really good free practice and learning resources online! We recommend using BurpSuite OR Caido for intercepting requests.

Type	Resource
Holy Grail (Theory + Labs)	PortSwigger Web Security Academy
Basic Vulns + Labs	pwn.college’s Web Security Dojo
Visual Understanding	PwnFunction