Why learn this: To understand how operating systems, file systems, and processes work — all targets of attacks.
Where it is used: Gaining access, privilege escalation, post-exploitation steps.
Why learn this: Hackers exploit communication protocols to sniff, redirect, or interrupt data flows.
Where it is used: Reconnaissance, packet analysis, firewall evasion.
TCP/IP, UDP, DNS, HTTP(S), FTP, SMTP.
Ports and protocols.
Basic Security Concepts:
Encryption (SSL/TLS basics)
Hashing (SHA-256, bcrypt)
Authentication vs Authorization
Why learn this: Understanding encryption, hashing, authentication helps avoid breaking good security and identifying weak ones.
Where it is used: Attacking or protecting data in transit, verifying password security, secure login systems.
Why learn this: Tools like Nmap, Burp Suite, Metasploit automate and enhance ethical hacking capabilities.
Where it is used: Network scanning, web app fuzzing, vulnerability exploitation.
Linux (especially Kali Linux or Parrot OS)
Nmap: Network scanning.
Wireshark: Network packet analysis.
Burp Suite: Web application testing.
Metasploit: Exploitation framework.
John the Ripper: Password cracking.
Why learn this: To understand how real-world attacks are executed and how to detect or stop them.
Where it is used: Penetration tests, red teaming, malware analysis.
Reconnaissance (Footprinting): Information gathering about the target.
Scanning and Enumeration: Finding open ports, services, weaknesses.
Exploitation: Gaining access through vulnerabilities.
Post-Exploitation: Maintaining access, pivoting, escalating privileges.
Web Application Hacking:
SQL Injection
Cross Site Scripting (XSS)
Cross Site Request Forgery (CSRF)
Authentication bypasses
Why learn this: It's the industry standard for web app security — mastering these helps you test and protect web apps effectively.
Where it is used: Website and API testing, bug bounties, audits.
OWASP Top 10: Understand the 10 most critical web vulnerabilities.
API Testing: How to find vulnerabilities in APIs.
Mobile App Testing (optional but valuable): Android/iOS basic attacks.
Cloud Security (optional): AWS, Azure basics if the platform is cloud-hosted.
Why learn this: Most modern platforms use APIs and cloud — knowing their weaknesses is essential for full-scope testing.
Where it is used: SaaS platform testing, cloud pentesting, API monitoring.
Why learn this: Ethical hackers must follow strict legal boundaries to avoid committing crimes.
Where it is used: Preparing for client engagements, working under NDAs, avoiding legal risks.