← All roadmaps
Study Roadmap

Offensive Security

books × Hack The Box × labs, foundational → advanced

An offensive-security learning path — a book library crossed with Hack The Box, hands-on labs, and free web resources, sequenced foundational → advanced. Follow the spine top to bottom; each stage builds on the last.

12Stages
0/71Resources done
—Day streak
00
STAGE 00 · validated
Foundations
you finish able to → the vocabulary and threat model the whole path assumes
0 of 3 done
Done HTB CJCA Certified Junior Cybersecurity Associate — passed
Book 1.Foundations of Cybersecurity, 2e
Book 2.Ethical Hacking: A Hands-on Introduction
01
STAGE 01 · pentest workflow
Core Offensive Ops
you finish able to → a repeatable recon → exploit → privesc → pivot → report loop
0 of 6 done
HTB HTB CPTS path + labs AD, privesc, pivoting, reporting — your primary reps
Book 1.Metasploit, 2e
Book 2.Practical Social Engineering
Book 3.Black Hat Bash
Book 4.Black Hat Go offensive tooling in Go
Book 5.Cyberjutsu strategy — light read
02
STAGE 02 · application layer
Web & API
you finish able to → the ability to find and prove web/API vulns end to end
0 of 8 done
HTB HTB CBBH path + labs bug-bounty / web hunting practice
Done Web App Hacker's Handbook already owned — classic, dated; pair with WSTG
Book 1.Bug Bounty Bootcamp
Book 2.Real-World Bug Hunting
Book 3.Hacking APIs
Book 4.Black Hat GraphQL
Web OWASP Web Security Testing Guide↗ free — current web-testing methodology
Web PortSwigger Web Security Academy↗ free — the best interactive web-vuln labs anywhere
03
STAGE 03 · the core cluster
Reverse Engineering & Malware
you finish able to → the ability to take a binary apart and read what it really does
0 of 12 done
Book 1.Practical Binary Analysis
Book 2.Blue Fox: Arm Assembly Internals & RE ARM — bridges to your embedded set
Book 3.The Ghidra Book, 2e
Book 4.Practical Malware Analysis
Book 5.Malware Data Science 2018 — Python-2-era code
Book 6.Rootkits and Bootkits
Book 7.Heavy Wizardry 101
Book 8.Evasive Malware
Book 9.The Art of Mac Malware, Vol 1 & 2
Book 10.The Android Malware Handbook
Book 11.Dissecting the Dark Web
Web Malware Unicorn RE101 / RE102↗ free — hands-on reverse-engineering workshops
04
STAGE 04 · go deeper
Internals, Evasion & Vuln Research
you finish able to → the ability to research a bug and get past modern defenses
0 of 9 done
HTB HTB CAPE path + labs AD attack + evasion capstone
Book 1.Windows Security Internals
Book 2.Android Security Internals
Book 3.Evading EDR
Book 4.Evasion Engineering
Book 5.Fuzzing Android
Book 6.From Day Zero to Zero Day vuln research + fuzzing
Book 7.The Linux Programming Interface (Kerrisk) Linux internals reference — not yet owned
Web Linux kernel exploitation (xairy)↗ free — curated papers, CTF write-ups, tooling
05
STAGE 05 · physical attack surface
Hardware · Embedded · IoT
you finish able to → the ability to attack a device you can hold in your hand
0 of 6 done
Book 1.The Hardware Hacking Handbook
Book 2.Microcontroller Exploits
Book 3.Practical IoT Hacking
Book 4.The Car Hacker's Handbook CAN bus / ECUs
Book 5.The Drone Hacker's Handbook
Book 6.The Spacecraft Hacker's Handbook pre-ordered
06
STAGE 06 · the radio layer
RF · Cellular · Baseband
you finish able to → your own radio lab and the ability to read the spectrum
0 of 6 done
Book 1.The Hobbyist's Guide to the RTL-SDR get an RTL-SDR v4 dongle and capture signals
Book 2.Software-Defined Radio for Engineers↗ free PDF — DSP / SDR base
Book 3.Inside Radio: An Attack and Defense Guide IMSI catchers, GPS spoof, GSM/LTE
Book 4.LTE Security (Forsberg et al.) protocol-security reference
Lab Private LTE / 5G lab↗
Lab setup
  • RX-only start (~$40): RTL-SDR v4 dongle — sniff GSM downlink, decode with gr-gsm.
  • Full TX/RX: USRP B210, BladeRF 2.0 micro, or LimeSDR (needed to run your own base station).
  • RAN: srsRAN Project — software eNB/gNB (link).
  • Core: Open5GS — 5G SA/NSA core & EPC (open5gs.org).
  • DSP/glue: GNU Radio; test SIMs + a programmable SIM writer (sysmoUSIM).
  • Safety: keep it in an RF-shielded box / attenuated cabling — never transmit on licensed bands.
Web Baseband research (5Ghoul, BaseSpec, Comsecuris)↗ no book yet — Weinmann talks + these repos are the syllabus
07
STAGE 07 · iOS + Android
Mobile
you finish able to → a working method for testing a mobile app front to back
0 of 3 done
Book 1.The Mobile Application Hacker's Handbook 2015 — dated; fundamentals only
Book 2.Android Security Internals see Stage 04
Web OWASP MASTG / MASVS↗ free — current mobile standard; your main iOS + Android resource
08
STAGE 08 · the math underneath
Cryptography
you finish able to → enough crypto to recognize and break the misuses in the wild
0 of 3 done
Book 1.Serious Cryptography, 2e
Book 2.Crypto Dictionary reference — dip in
Web Cryptopals Crypto Challenges↗ free — break real crypto by hand, challenge by challenge
09
STAGE 09 · operate at scale
Red Team Program & Purple
you finish able to → the ability to run an engagement, not just pop a box
0 of 6 done
HTB HTB CDSA path detection / blue side to inform red
Book 1.Red Team Engineering
Book 2.The Effective Red Team
Book 3.Practical Purple Teaming
Book 4.Cybersecurity Tabletop Exercises
Book 5.The Art of Cyberwarfare
10
STAGE 10 · cloud · osint · detection
Cross-cutting Domains
you finish able to → coverage of the domains every engagement eventually touches
0 of 7 done
Book Hacking Kubernetes (O'Reilly) cloud / container — not yet owned
Book Container Security (Hausenblas) not yet owned
Web HackTricks Cloud↗ free — AWS / Azure / GCP / K8s attack reference
Lab Cloud pentest lab↗
Lab setup
  • CloudGoat (Rhino Security) — deliberately-vulnerable AWS scenarios, deployed via Terraform to your own account (link).
  • Free web challenges: flaws.cloud and flaws2.cloud — no setup, browser-based.
  • Guardrails: use a throwaway/isolated AWS account, set a billing alarm, and tear down with terraform destroy after each run.
Book OSINT Techniques (Bazzell) not yet owned
Web OSINT Framework↗ free — categorized OSINT tool directory
Web Awesome Detection Engineering↗ optional — pairs with HTB CDSA
+
STAGE + · adjacent interest
Side track · AI/ML
0 of 2 done
Book Build a Large Language Model (From Scratch) not security — separate track
Web ML / AI & Nature of Code roadmap↗ the full AI path lives on its own roadmap — start there