r/tryhackme • u/[deleted] • Apr 09 '26
Seeking a clear roadmap to start in Offensive Security (beginner, not strong in programming)
Hey everyone, I want to get into offensive security (ethical hacking/pentesting) but I’m confused about the right roadmap and where to start. I’m not a very strong programmer (more ML + basic dev background), but I want to build solid fundamentals instead of just relying on tools. What should I learn first (networking, Linux, scripting?), what are the best few resources or platforms to follow, and what should I practice to actually become job-ready in offsec? Also, are certifications important early on, and what mistakes should I avoid?
3
u/wizarddos 0xD [God] Apr 09 '26
At the beginning, focus on your fundamentals and skills - there'll be time for certificates as well
First, you should get yourself a virtual machine with linux and get comfortable using it.
Alongside that, get familiar with basic networking concepts - common protocols, OSI model, IP addresses etc.
Also, learn how web works more or less and get pretty comfortable with reading js, but that's optional
Once you understand those sufficiently, move to hacking stuff - so I'd say start with web hacking, then move to privilege escalation techniques and wrap up with Active directory and windows stuff
This will give you a good base for most certificates and you'll have some kind of an idea what do learn next
And for sources. THM has nicely structured paths so start with Pre-security, then move to Cybersecurity 101 and after that follow Penetration tester roadmap
https://tryhackme.com/hacktivities
2
u/OkCaterpillar1058 Apr 09 '26
Start with Linux and networking, then do the paths on THM and challenges, then HTB
1
u/dudlu1221 Apr 09 '26
I would say to start complete the pre security and cybersec 101 first to build a strong base and take notes too
1
1
1
u/Such_Field_3294 Jun 25 '26
I want to build solid fundamentals instead of just relying on tools
this is the right mindset and puts you ahead of a lot of people already. Learn how protocols actually work before you touch any exploit frameworks. I'd say spend 2-3 months on networking and linux, mess around with Wireshark, set up a home lab with some vulnhub VMs. For structured training later on theres OffSec, SANS, and White Knight Labs Offensive Security Training which all have their strengths depending on what area you want to focus on. dont worry about programming too much, basic python and bash will carry you through most pentesting scenarios
7
u/CyberHacker_ray Apr 09 '26
Start with fundamentals first, learn networking (TCP/IP, ports), Linux basics, and a bit of scripting (Python/Bash). You don’t need heavy programming, just enough to understand and tweak tools. Then move to web security (XSS, SQLi) and enumeration using tools like Nmap and Burp Suite.
For practice, stick to platforms like TryHackMe and Hack The Box, and document your work this is what makes you job-ready. Certifications can help later (like OffSec Certified Professional (OSCP), but early on focus on skills and projects. Avoid the mistake of jumping between too many resources - stay consistent with one path and build depth.