Penetration Testing Reading Order: Skills, Certifications, and Tools#

Why this topic matters: the advice most beginners hear is "learn networking, learn Linux, then start hacking." That is a fine shelf. This note is the order of the books on it.

Ethics and scope: everything below assumes authorized practice: your own labs, intentionally vulnerable machines, and written scope for anything live. The same class of checks shows up in the other notes here, so this one is the table of contents rather than a tutorial.

Phase 1: Foundations#

Networking#

• OSI and TCP/IP as mental models, not as memorization.
• HTTP and DNS as the two protocols you will read daily.
• Nmap for discovery, Wireshark for confirmation. See the Wireshark notes.

Systems#

• Linux basics: shell, processes, permissions, packages.
• Windows basics: services, registry, Active Directory.
• The filesystem as the ground truth.

Scripting#

• Python for quick checks and readers.
• Bash for the shell loops.
• JavaScript for reading web clients; it pays back fast.

Phase 2: The Web Classes#

• Broken access control: the most common and the least tested. Start with the BOLA matrix.
• Injection: SQL injection notes.
• Markup injection: XSS types compared.
• Client-side object traps: prototype pollution notes.
• Stored sinks in secondary contexts: attacking secondary contexts.

Phase 3: The Tool Loop#

• Proxy work: Burp basics.
• Open-source twin: ZAP review notes.
• Packet reading: Wireshark notes.
• Module-based work: Metasploit notes.

One loop, three tools: capture, replay, compare, record.

Phase 4: Beyond the Browser#

Phase 5: The Workflow Notes#

• Access control: API access control test plan.
• Role matrices through Intruder: access matrix work.
• Finding quality: finding scoring.
• Logging for the places you looked: security logging design.
• Hidden APIs: shadow API inventory.
• Server actions: server actions authorization.
• Private pages: noindex is not auth.
• Triage: denied request alert triage.

Certifications, Framed Honestly#

• A cert is a syllabus plus a lab. It is not a job.
• Pick one after a foundation phase, not before.
• OSCP is the grueling one; PNPT and eJPT are the pragmatic ones.
• The lab hours beat the exam hours for learning.

Practice Platforms#

What to Build Along the Way#

• A notes repo: one folder per target, one line per finding.
• A payloads file: inert probes for every class.
• A scope template: one line per authorized host.
• A report template: category, observation, fix, verification date.

The Notes Repo, One Line at a Time#

Copy code
target: example.com, scope: see scope.md
2026-10-05  GET /invoice/1234 as user-b -> 200 with user-a's invoice (A01)
2026-10-05  POST /login throttle test: 40 tries, no 429 (A07)
2026-10-06  export csv from finance queue, formula probe prefixed (A03)

Three lines, three classes, three follow-ups. The repo is the study plan.

Study Habits That Hold Up#

• One class per week, one lab per class.
• One writeup per lab, trimmed to the evidence.
• One review of last week's notes.
• One sentence per finding: category, observation, fix.

What a Session Looks Like#

Copy code
10:00  pick one lab from the platform
10:05  set the scope line in notes.md
10:10  run the class's checklist
10:40  write the finding line, trimmed
10:50  write the fix line
11:00  close the lab, note the follow-up

One class, one lab, one line.

Field Mapping for the Report#

Triage Walkthrough#

1. What class am I looking at?
2. What one check proves or disproves it?
3. What one evidence item would I attach?
4. What fix fits the root cause?
5. Which note do I hand this finding to?

Reading Order as a Checklist#

Eight weeks. One class, one lab, one line per week.

Mistakes to Skip#

• Running tools before naming the class.
• Collecting CVE names instead of probes.
• Letting the scanner speak for you.
• Skipping the writeup when the lab breaks.

A Note on Scope#

A study plan doubles as a scope plan. The same list of authorized hosts that frames the labs should frame every live test.

What the List Does Not Cover#

• The law. Get that from the engagement contract.
• Career advice. That is a different note.
• Vendor certifications at scale. One at a time.
• The actual hacking. That is the labs.

Closing Notes#

The order matters less than the habit. Class first, probe second, record third, and the repo fills up faster than the lab does. The rest of the notes in this space are the shelf; this is the reading order.

A Longer Study Table#

Twelve weeks, twelve notes. One line per lab, one folder per class.

A Trimmed Finding Example#

Copy code
Class: A01
Target: GET /items/1042
Probe: replay as user-b
Observed: user-a's record returned
Fix: ownership check on the handler

Five lines. One class, one probe, one observation, one fix, one evidence item behind it.

Small Loops#

• Monday: pick the class, read the note.
• Wednesday: run the lab, one line in the repo.
• Friday: write the report line, and note what did not fail.

The Point#

The roadmap is not a checklist of topics. It is a schedule of reps: one class, one probe, one line, every week. The repo is the resume that comes out of it.

A Note on the Shelf#

Every phase on this page points at a note in the same space. The bow from phase two lands on the injection note. The bow from phase four lands on the AWS note. The order is the reading order; the notes are the books.

What Comes After the Twelve Weeks#

• Repeat the year with the harder classes.
• Turn the repo's trimmed lines into report templates.
• Let one class become the focus for a quarter.
• Teach the loop to someone else; the repo is the curriculum.

A Per-Week Cadence#

Twelve rows, twelve Thursdays. The report writes itself in week twelve.

The Rule Behind the Order#

Class before tool. Probe before payload. Record before review. The order is load-bearing: a tool without a class produces noise, a payload without a probe produces theater, a review without a record produces arguments.

Why the Repo Matters#

Memory selects. The repo selects for you. A line per lab compounds into a portfolio that reads better than a transcript, and every line is a future report paragraph waiting to be trimmed.

The Last Week#

Week twelve is not a summary; it is the polish pass. Trim each line to one sentence. Attach one evidence item per line. The folder becomes the report.

Two Mistakes to Skip#

First, treating a certificate as the credential. The credential is the repo. Second, treating the notes as a diary. The notes are a ledger; each line is a claim with a probe behind it.

One More Thing#

Update the folder name with the year. The classes move; the repo should follow. A yearly rename is the cheapest way to notice what became obsolete.

The Point, Once More#

One class, one probe, one line. That is the whole roadmap.

Final Notes#

The reading order is the space's outline. The notes are the lessons. The repo is the work. The three of them are the practice.

A Sample Repo Line, Again#

Copy code
2026-10-12  A01  invoice handler  user-b 200 on user-a record  fix: ownership check

One line. Date, class, target, probe, fix. That line is the unit everything else is built from.

If You Only Keep One Rule#

Class first. The rest follows from it.

A Last Habit#

End every session by writing the line. If the line is "nothing to record", write "nothing". The repo should hold every week, not just the ones with a bug.

Three Questions Per Lab#

• What class did I expect?
• What probe did I run?
• What line describes the outcome?