Security Roadmaps

A practical progression model for learning security with depth, not noise. These tracks are designed to move from fundamentals to real-world impact without losing structure.

Phase 1

Foundations

Begin with the basics: networking, Linux, web fundamentals, and the way security failures are built.

  • Networking and HTTP
  • Linux command line
  • Web basics and browser behavior
Phase 2

Web Security

Focus on core web attacks, unsafe validation, business logic abuse, auth weaknesses, and misconfigurations.

  • OWASP Top 10
  • IDOR / SSRF / XSS
  • Broken auth and session logic
Phase 3

API Security

Move into modern APIs and understand the risks behind untrusted data, auth models, and object-level access controls.

  • REST and GraphQL
  • BOLA and mass assignment
  • Data exposure and rate limits
Phase 4

Recon & Enumeration

Develop the habit of mapping targets before exploiting anything: subdomains, ports, headers, and exposure paths.

  • OSINT and recon
  • nmap and HTTP probing
  • Fuzzing and hidden endpoints
Phase 5

Privilege Escalation

Expand from web to system-level abuse, local escalation, and understanding how a weak chain leads to compromise.

  • Linux privilege paths
  • Sudo and service abuse
  • Post-exploitation hygiene
Phase 6

Cloud & Modern Attack Surface

Review identity, configuration, public assets, and cloud control planes with a practical attack-defense lens.

  • IAM and access review
  • Storage exposure
  • Identity drift and posture checks

Suggested Learning Timeline

Month 1
Linux basics, networking, HTTP, and safe practice labs.
Month 2
Web security fundamentals with OWASP, internal testing workflow, and structured writeups.
Month 3
API testing, recon automation, and vulnerability validation with realistic scenarios.
Month 4
Privilege escalation, cloud review, and deeper detection of weak trust boundaries.
Month 5+
Apply the method to real programs, write strong reports, and turn findings into repeatable skills.
Back to Updates See Projects