OFFENSIVE SECURITY ROADMAPS · HUB
Offensive Security Roadmaps
ALL-IN-ONE PATH MASTER ROADMAP AI + CLOUD RED TEAMING EXPLOIT DEV REVERSE ENGINEERING FREE & LEGAL

One hub for the offensive security roadmaps I build and use. Three connected maps: an All-in-One Offensive Security Path (zero to dangerous, 310+ free resources), a deep Master Roadmap (pentest → reverse engineering → exploit dev → AI red teaming, one connected trunk), and the Offensive AI + Cloud Red Teaming Roadmap 2026 (the specialization detailed below). No fluff. Free-first. Offensive focused.

VIEW ROADMAPS ↓
ROADMAP LIBRARY
All-in-One Offensive Security Path
The manual detailed on this page — zero to dangerous, free-first. Every platform, lab, cert, tool, repo, blog, channel and book across 22 sections, each with a link, what it is, and what it's best for. 310+ resources so anyone can start with no budget.
DOWNLOAD ↓
Offensive Security Master Roadmap
The deep trunk — one connected map from pentesting through reverse engineering and exploit development into AI red teaming. Built for going from operator to specialist without losing the thread between disciplines.
DOWNLOAD ↓
Offensive AI + Cloud Red Teaming Roadmap 2026
The specialization track — AI/LLM red teaming + offensive cloud, a 12-week action plan, labs, portfolio builders, and the certs worth your time. Branch here once the foundations are solid.
DOWNLOAD ↓
HOW TO USE THIS MANUAL
Principle 01
Pick a lane, not everything
Foundations → Web → Active Directory is the highest-ROI beginner path. This is a map, not a novel — jump to a lane and build the skill with your hands. Don't read it front to back.
Principle 02
Free-first
Every entry has a free, legal way in. Official cert pages are listed so you know the target you're working toward — not because you must pay to learn. Pay for nothing but the exam.
Principle 03
Learn by doing
For every concept, find the matching free lab (HTB / THM / PortSwigger) and the matching write-up (IppSec / 0xdf). Watch, then do it yourself with no hints.
Principle 04
Certs = exam + paper, not secret knowledge
Almost everything taught in expensive courses is re-taught, free, by the community. Keep your own methodology repo — the notes you write beat any course PDF. Pay for a cert when you need the credential.

Rules of engagement: everything here is a legitimate, publicly-available learning resource — official sites, open-source repos, free labs, and creators' own published work. Only ever test systems you own or are explicitly authorized to test. Use isolated VMs for malware. The goal is to become the professional who gets hired to break in.

22 SECTIONS · 310+ RESOURCES
Learn & Certify
  • Training Companies & Academies — where structured learning lives
  • Certifications — the targets worth working toward
  • Lab Platforms — HTB, THM, PortSwigger and more
  • Career & Learning Roadmap — how the lanes connect
  • Books & Research Blogs — the deep references
  • YouTube Channels & Free Conference Talks
Attack Surfaces
  • Web Security & API Security — start here for web
  • Active Directory — the highest-ROI internal lane
  • Mobile, Wireless & IoT security
  • Cloud Offensive Security — the modern surface
  • Binary Exploitation (Pwn) & Reverse Engineering
  • Malware Analysis — in isolated VMs only
Practice Grounds
  • Vulnerable Machines — retired boxes + free tiers
  • Active Directory Labs — full domain practice
  • Web Security Labs — PortSwigger, and beyond
  • Bug Bounty Platforms — real targets, legally
The Arsenal
  • Essential GitHub Repositories — the repos that matter
  • Command & Control (C2) Frameworks
  • The Tool Arsenal — recon → root → report
  • Each entry: a link, what it is, and what it's best for
THE HIGHEST-ROI STARTER PATH
Step
Lane
What to do
01
Foundations
Linux, networking, and scripting until they're second nature. HTB Academy Tier 0 + TryHackMe intro paths — all free.
02
Web Security
PortSwigger Web Security Academy end to end — the best free web-hacking course on the internet, from the makers of Burp.
03
Active Directory
The highest-value internal lane. Free AD labs + Nikhil Mittal / RastaMouse tradecraft blogs. Aim at CRTP/CRTO as the target.
04
Pick a specialism
Branch into cloud, mobile, binary/RE, or AI red teaming (see the Master and AI+Cloud roadmaps in the library above).
05
Build in public
Document every box and finding. A methodology repo + write-ups is the portfolio that gets you hired.

The core truth: almost everything taught in expensive courses is re-taught, free, by the community. The full manual lists all 22 sections with 310+ hand-picked links — grab it from the library above.