Resources
Practise legally. Learn deliberately.
Every link here points to a consenting, isolated environment. None of it is permission to test a system you do not own.
Legal practice platforms
These platforms own the targets and consent to you attacking them inside their exercises. That consent does not extend to their infrastructure, other users or any real system.
TryHackMe
Guided beginner rooms and structured paths
Large free tierThe friendliest starting point if you have never opened a terminal.
Hack The Box Academy
Structured modules and interactive labs
Some free modulesGood once you are comfortable with Linux and HTTP basics.
PortSwigger Web Security Academy
Web security labs and explanations
FreeThe best free web security resource on the internet. Start with the apprentice labs.
picoCTF
Beginner capture-the-flag challenges
FreeLearn by solving small, self-contained puzzles with a gentle difficulty curve.
OverTheWire
Linux and security wargames
FreeBandit is a classic way to make the command line stick.
Blue Team Labs Online
Defensive investigations and log analysis
Free challengesPractice the work a SOC analyst actually does, not just offensive tools.
Build a home lab that cannot hurt anyone
A lab is the fastest way to learn, provided it is isolated. Treat every lab machine as compromised from the moment you start experimenting.
- 1Install a hypervisor: VirtualBox, VMware, Hyper-V or Proxmox.
- 2Create a host-only or internal network. Do not bridge lab machines to your home LAN.
- 3Install an intentionally vulnerable VM and a clean analysis VM on that network.
- 4Snapshot both before experiments, then roll back instead of rebuilding.
- 5Keep notes: command, result, hypothesis, next step.
- 6Never port-forward a lab machine from your router to the internet.
- Scan only networks you own or have written permission to test.
- Do not expose vulnerable machines to the public internet.
- Do not use real customer, colleague or family data in a lab.
- If a lab exercise involves a technique you do not understand, stop and read first.
Certifications, in a sensible order
A certificate proves you can pass an exam. It does not replace a lab you built or a problem you debugged. Use them as structure, not as a personality.
CompTIA A+
Absolute startHardware, operating systems, troubleshooting and support basics.
Useful if you have no IT work experience. Skip it if you already work in support.
CompTIA Network+
FoundationNetworking concepts that every security role assumes.
A solid structured goal after the foundations track.
CompTIA Security+
FoundationBroad security vocabulary and baseline concepts.
Commonly requested in job adverts, especially in the US and UK.
Blue Team Level 1
Blue teamPractical investigation and response skills.
More hands-on than Security+ if a SOC role is the goal.
eJPT
Red teamEntry-level, practical penetration testing.
Only after you understand networking, Linux and HTTP properly.
OSCP
LaterA demanding practical offensive certification.
Not a first certificate. It assumes real lab hours and report discipline.
Worth bookmarking
OWASP Top 10
The common web vulnerability categories, with plain explanations.
MITRE ATT&CK
A map of attacker behaviours used by defenders worldwide.
CISA Known Exploited Vulnerabilities
What is actually being exploited, not just what is theoretically vulnerable.
Have I Been Pwned
Check whether your accounts appear in known breaches.
No budget? Good.
Everything you need to start is free: this track, a hypervisor, a Linux distribution, a vulnerable VM and the platforms above. Spend money on a certification only when you have a specific reason.
Start the free track