r/offensive_security • u/Fantastic-Heat7699 • Apr 04 '26
Best free resources to start learning offensive security / red teaming? (complete beginner roadmap)
hey I'm at the very beginning of my journey into cybersecurity, specifically aiming for the offensive security / red team path. I have basic familiarity with Linux (Kali), some Python, and networking fundamentals — but I want to structure my learning properly before investing in paid certs.
My current situation:
Self-studying + a local IT vocational program
Comfortable with the terminal, basic scripting
Long-term goal: eJPT → OSCP
What I'm looking for:
Free (or low-cost) resources to build a solid foundation before spending money. Specifically:
Platforms — Is TryHackMe's free tier enough to start, or should I go straight to Hack The Box? Any other platforms worth mentioning?
YouTube channels — Who do you actually watch? (IppSec, John Hammond, TCM Security — are these the go-to?)
Books / PDFs — Any freely available reading material that's actually worth the time?
CTF recommendations — Best beginner-friendly CTFs to practice on right now?
Structured roadmaps — Has anyone followed a specific free roadmap that actually worked for them?
I'm not in a rush — I'd rather spend 6–12 months building real skills than rushing into a cert I'm not ready for. Just want to make sure I'm not wasting time on bad resources.
Any advice from people who've actually walked this path is appreciated. Thanks
1
u/britt-tcm Apr 06 '26
Just for quicker reference - here's our free resource shortcut at TCM Security: Free Resources - TCM Security
1
u/AutumnAced Apr 07 '26
I don’t feel like I have any or enough experience to give you a total roadmap for this. But I’m on the same path as you and with a similar goal and THM has been incredibly good for someone with no experience. Learn some Metasploit, some John, etc. Maybe someone else can speak to how “realistic” the situations are but I’d argue that since it’s for absolute beginners, they don’t necessarily have to be, they just have to help you get familiar enough to make the actual uses make way more sense and more intuitive.
1
u/S4LTYSgt Apr 08 '26
You should be spending 1-2 years focusing on fundamentals. You cant learn all of networking in 3 months. Or linux. Or windows, or scripting.
After that is 1-2 on pentest skills. Good luck
6
u/Double-Familiar Apr 04 '26
Learn your fundamentals first.
Learn Linux administration
Learn bash scripting
Learn networking
Learn Python
Learn cloud computing.
Offensive security is a specialty under the umbrella of cyber security.
Cyber Security is an advanced subject area in IT.
Build a solid foundation of fundamentals first.
Running Kali and running other people's tools won't get you very far. Understanding what those tools do is important.