How I Got Into Cybersecurity — My Roadmap

I started learning cybersecurity in 9th standard. At that time, I was quite new to it. All I knew about was Linux and other cybersecurity tools like Nmap, John the Ripper, etc.

There was just one problem. I was confused. It was all too difficult for me to use the Linux operating system and other security tools.

I was familiar with the purpose of those tools but not the process which takes place while using them.

Hence, rather than jumping directly onto learning how to use various security tools, I decided to start with basics of Linux first. That entailed learning some basic commands, navigating through the file system, manipulating files and directories, and getting accustomed to using the terminal.

As I became more comfortable with Linux, it started to make sense.

Then I took one year gap for studying for my 10th standard board exams.

And after finishing them, I continued with cybersecurity once again. But this time it was going to be different.

This time, I learned web security, where I came across Burp suite.

As opposed to the command line-based tools I was using earlier, the interface of Burp suite was easier for me to comprehend. And now I could analyze and tamper with HTTP requests and responses and send them back.

This made web security a much more interesting topic for me.

That is when I realized the importance of having an organized learning path.

My Cybersecurity Roadmap

1. Learn Linux first First, learn the basics of Linux before diving into any cybersecurity topic. For example, learn about:

. Basic Linux commands . Files and directories . Permissions . Processes . Networking commands . Package management . Terminal operations

After becoming familiar with basic concepts, try experimenting with security tools like Nmap and John the Ripper.

The objective is not to remember hundreds of commands.

It is to know how the tool works.

2. Learn Networking Once I got a handle on Linux, the next thing I wanted to learn was networking.

It is one of the most crucial building blocks of cybersecurity. This includes understanding about:

. IP addresses . MAC addresses . Ports . TCP and UDP . DNS . HTTP and HTTPS . TCP/IP . OSI model . Routing . Proxies

You do not have to know everything that a network engineer knows to move on to other things.

However, you should at least know what takes place when your computer talks to another computer.

What really happens behind the scenes when you type a website address in your browser?

3. Burp Suite Finally, after Linux and networks, I shifted towards web security.

Here is when Burp Suite started being one of the most significant tools in the process of my learning.

How to do the following: . Intercept requests . Modify requests . Replay requests . Work with parameters . Understand headers and cookies . Work with Repeater . Work with Intruder . Analyze responses . Work with the proxy

But don't concentrate on finding out where all buttons in Burp Suite are located.

What is crucial here is to understand the behavior of HTTP traffic and applications.

4. Do the PortSwigger Web Security Academy After gaining the knowledge and skills using Burp Suite, I would recommend to move to the next level — the PortSwigger Web Security Academy.

This has proven to be one of the most beneficial components of my learning experience since you will not only study the information about vulnerabilities but will actually use vulnerable applications in practice to discover them.

Complete all the labs and study the following vulnerabilities: . SQL injection . Cross-site scripting . Authentication vulnerabilities . Access control . IDOR . CSRF . SSRF . File upload vulnerabilities . Business logic vulnerabilities . API vulnerabilities

Remember that completing labs does not mean simply completing them but trying to understand why the particular vulnerability is possible and why the particular exploit can work.

5. Bug Bounty Hunt

After you have gained some understanding regarding web vulnerabilities, you can proceed to explore bug bounty programs.

At this stage, the practical application of what you learned becomes evident.

Real-life applications cannot be equated to lab environments.

You have to know how the application works, find out the endpoints, and analyze the way in which features communicate with one another.

That is when I began to understand that hunting for vulnerabilities does not mean being aware of payloads only.

Sometimes understanding the application itself is much more important.

6. Go for Mobile Security Testing After some time spent in web security and bug bounties, my interest began turning towards mobile application security.

The next course of action would be to learn how to test Android and iOS applications.

For Android, you could begin by working on the Android emulator and learn how to proxy the traffic of the application using Burp Suite.

This will enable you to know about the HTTP/HTTPS requests made by the application and get an insight into how the mobile application communicates with its backend.

Further, you can move ahead and learn about various mobile application concepts like:

. APK analysis . Android application structure . Certificate pinning . Deep links . Local storage . API security . Authentication . Mobile vulnerabilities

Road map in short

LINUX BASICS
     ↓
NETWORKING
     ↓
BURP SUITE
     ↓
PORTSWIGGER LABS
     ↓
BUG BOUNTY
     ↓
MOBILE SECURITY
(Android / iOS)

LINUX BASICS
     ↓
NETWORKING
     ↓
BURP SUITE
     ↓
PORTSWIGGER LABS
     ↓
BUG BOUNTY
     ↓
MOBILE SECURITY
(Android / iOS)

Looking back, my roadmap wasn't something I had planned from the beginning.

I started with Linux because I was confused by the command line.

Then I learned networking to understand how systems communicate.

I discovered Burp Suite and started learning web security.

I practiced through PortSwigger's labs.

Then I moved into bug bounty hunting.

And eventually, I started exploring mobile security.

I didn't start with a perfect roadmap. I built it as I learned.