/sec/'s learning guide V1

Welcome to /cyb/+/sec/. You wanna get a head start but dont know how? thats alright. Your not alone.

Lets say you dont care about certs and your more concerned with the material? sure that works too

TryHackMe Complete beginner -> TryHackMe Junior penetration tester -> TheCyberMentor's PEH -> HTB Academy CPTS path.

After doing the CPTS path you "SHOULD" be OSCP level in terms of theory, keyword THEORY. all thats left is for you to spend time practicing and training by doing boxes.

What are the alternative paths?

Have a background in networking already:
TryHackMe Junior penetration tester -> TheCyberMentor's PEH -> HTB Academy CPTS path.


You want to get to the end game quick:
(In this chase your gonna be relying alot more on the HTB academy material, which is EXTREMELY good and in-terms of quality and quantity surpasses everything.)
TryHackMe Junior penetration tester -> TheCyberMentor's PEH -> HTB Academy CPTS path.



You just want one Provider and you want to move on:
TheCyberMentor's PEH + WPE + LPE + OSINT + EPP -> HTB Academy CPTS path.


Certificates path from beginner to Mid level

PNPT (Optional) -> OSCP -> CRTP -> CRTO

Quick disclaimer before anything, before you do the OSCP. You will need alot. ALOT of practice. The OSCP is basically a bunch of easy HackTheBox's boxes with afew medium, You will definitely find it difficult due to the time crunch NOT because of the actual box difficulty.

Please refer to the TJNull list on the OSCP PEN 200 V3 tab:
https://docs.google.com/spreadsheets/d/1dwSMIAPIam0PuRBkCiDI88pU3yzrqqHkDtBngUHNCw8/edit?usp=sharing


After CRTO this is where your hitting close to (3/4) Mid level, what's left is for you to find out what you want to do in the field. Either it be Web, Exploit Development, Red teaming, Creating In-house tools for the operators you have to find it and take its certificate and spend another year or two in that specific field.

Web -> AWAE (Offensive security Web Path)
	-> Ports swigger academy Cert (Popular amongst people in the workforce + you will be respected, Getting to HR folk that this is a good cert)
	-> CBBH (HTB bug bounty path, Its in the same. Bug bounty but it still teaches some REALLY good web techniques, I cant speak on the quality since I have not tried it myself)

Red teaming -> CRTL (Zer0 Point security) + CRTE (Altered security course)
			-> Phishing
			-> Learning some malware evasion techniques

Exploit development -> All EXP-XXX courses from Offensive security
					-> Good in coding too
					-> This is very closely tied to the inhouse developers so take advantage learn from them


In house development -> Nothing in terms of HR. Your gonna need to talk to the best operator they have and prove yourself, Coding skills must be god like + good at pentesting in some cases.
  					 -> Your responsibilities (Obviously) will completely shift, It will no longer be trying to find a way to get in but rather finding the best way to equip the operators to not get caught. Basically cutting through AV/EDR like butter.
					 -> This role still is very unknown to me and I'm gonna need some more time before I am able to give proper insights
					 -> You will probably adopt the responsibilities of the Exploit developer if none are present, shouldnt be too difficult, just more responsibilities sadly.


These paths of course vary, everyone's learning experience is different. Their knowledge is different and their lives, responsibilities and free time is different. Pick what suits you best.

What about Certificates + Material?

Tryhackme Paths Complete beginner -> Tryhackeme Junior penetration tester -> PNPT -> Alot of practice doing boxes -> OSCP -> Move on to the first Cert pathway

Any of these courses are modular.