Beginner Roadmap & Prerequisites

Welcome to the Cybersecurity Handbook. This guide provides a structured technical pathway for students, fresh graduates, and software engineers entering the cybersecurity discipline.

Security is not an entry-level concept in computing; it is a specialization built on top of computer networking, operating system internals, and software engineering. To understand how to secure or break a system, you must first understand how that system is built and how it communicates.

---

Technical Prerequisites

Before diving into advanced exploitation or incident response, ensure you have working fluency in these four foundational areas:

1. Computer Networking

• Protocol Stacks: Understand the distinction between the OSI 7-layer model (conceptual) and the TCP/IP 4-layer model (practical).
• Core Protocols: TCP (connection-oriented, 3-way handshake, flags), UDP (connectionless), ICMP, DNS (recursive vs authoritative queries), ARP, and DHCP.
• Addressing & Subnetting: IPv4 headers, CIDR notation (e.g., /24, /16), public vs private RFC 1918 ranges, NAT, and port numbers (0–65535, well-known vs ephemeral).
• Packet Analysis: Inspecting raw frames in Wireshark and filtering traffic using Berkeley Packet Filters (BPF) like tcp.port == 443 or dns.

2. Linux System Administration

• Command Line Competence: File manipulation (find, grep, awk, sed, cut), piping, redirection (|, >, >>, 2>&1).
• Permissions & Access Control: Traditional Unix permissions (rwx, chmod, chown), SUID/SGID bits, sticky bits, and sudoers configuration.
• Processes & Services: Viewing processes (ps aux, top), process hierarchy, signals (kill -9, SIGTERM), and system services (systemctl, journalctl).
• Filesystem Hierarchy: Structure of /etc (configuration), /var/log (telemetry), /proc (kernel/process virtual filesystem), and /dev.

3. Windows Architecture Fundamentals

• Security Model: Security Identifiers (SIDs), Access Tokens, Discretionary Access Control Lists (DACLs), and System Access Control Lists (SACLs).
• Authentication Planes: Local authentication via the Security Account Manager (SAM) database vs domain authentication via Active Directory, Kerberos (TGT/TGS tickets), and NTLMv2.
• System Administration: Windows Registry hives (HKLM, HKCU), Service Control Manager (sc.exe, Get-Service), and PowerShell scripting.

4. Basic Scripting & Programming

• Python: Writing network sockets, parsing JSON/text, automating HTTP requests with requests, and writing custom triage scripts.
• Bash & PowerShell: Automating administrative tasks, querying system status, and parsing log files.
• C / Assembly (Basic): Understanding compiled code structure, memory pointers, stack vs heap allocation, and standard C library calls.

---

4-Stage Learning Path

Follow this structured progression across the modules in this handbook:

  Stage 1: Foundations & Systems (Modules F1 - F12)
    │
    ▼
  Stage 2: Web Application Security (Modules W1 - W22)
    │
    ▼
  Stage 3: Privilege Escalation & Lateral Movement (Modules PE1 - PE15)
    │
    ▼
  Stage 4: Specialized Engineering (Blue Team, Evasion, Threat Emulation)

Stage 1: Foundations & Systems (Modules F1 → F12)

Master the core operating environment before attempting attacks:

• Network protocol mechanics, socket programming, and packet headers.
• Operating system internals for Linux and Windows.
• Foundational cryptography: Symmetric (AES), asymmetric (RSA, ECC), hashing (SHA-256), and HMAC.
• Industry frameworks: MITRE ATT&CK matrix, Cyber Kill Chain, and threat modeling methodologies.

Stage 2: Web Application Security (Modules W1 → W22)

The web interface is the most exposed attack surface of modern organizations:

• HTTP request/response cycle, headers, state management (cookies, sessions, JWTs).
• Injection vulnerabilities: SQL Injection, Command Injection, and Server-Side Template Injection (SSTI).
• Client-side flaws: Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF).
• Server-side architecture vulnerabilities: Server-Side Request Forgery (SSRF), XML External Entity (XXE), and HTTP Request Smuggling.

Stage 3: Privilege Escalation & Lateral Movement (Modules PE1 → PE15)

Once initial access is gained, understanding how to move through an environment is critical:

• Linux privilege escalation: SUID abuse, sudo misconfigurations, cron job hijacking, and path abuse.
• Windows privilege escalation: Unquoted service paths, weak file permissions, and token impersonation (SeImpersonatePrivilege).
• Active Directory enumeration and exploitation: Kerberoasting, AS-REP roasting, BloodHound path analysis, and pass-the-hash.

Stage 4: Specialized Engineering & Defense

Choose your specialization:

• Blue Team & SOC Engineering (BT1 → BT20): SIEM log pipelines, Sigma detection engineering, YARA rule authoring, and incident triage.
• Evasion & Endpoint Internals (E1 → E18): Userland hooking detection, direct system calls, AMSI bypassing, and process injection mechanics.
• Threat Emulation (T1 → T10): Structured adversary emulation plans, C2 infrastructure, and automated atomic testing.

---

Practice Platforms

Complement theoretical study with hands-on practice environments:

1. TryHackMe: Guided learning tracks for beginners (Pre-Security, Complete Beginner, Junior Penetration Tester).
2. PortSwigger Web Security Academy: Free, world-class labs specifically focused on web application security.
3. HackTheBox: Unassisted target machines and enterprise networks for intermediate to advanced learners.
4. Blue Team Labs Online (BTLO): Practical defensive scenarios analyzing actual packet captures, log files, and forensic disk images.