Cybersecurity Roadmap (Offensive + Defensive)

Offensive

Job roles in Offensive

Vulnerability Assessment (You will find vulnerabilities and generate a report).

Penetration tester (You will find vulnerabilities and exploit them. Penetration testing is in specific field
e.g web, android, network etc).

Ethical Hacker (You will find vulnerabilities and exploit them. A Ethical hacker is specialized in all
modules. Ethical Hackers can test everything not a specific module.)

Offensive Roadmap:

Module 1

NETWORKING CONCEPTS

What is Computer Networking?

How does Networking Work?

Types of Networks

What is IP Address?

IPv4 vs IPv6

Types of IP Address

Role of Ports in Networking

What is OSI Model and How does It Work?

What is TCP/IP Model and How does It Work?

OSI vs TCP/IP Model

What are Network Protocols?

Types of Protocols
How does TCP Work?

TCP vs UDP

What is Domain Name?

What is DNS?

DNS Records and Their Uses

What is Zone File?

HTML Request and Response

Types of Request Methods

Module 2

INTRODUCTION TO ETHICAL HACKING

What is Ethical Hacking?

Types of Hackers

Types of Attacks on a System

Cybersecurity Laws

What is Linux?

Basic File System of Linux

Linux Commands (ls, cd, pwd, cp, mv, rm, chmod, chown, cat, grep, find, ps, top, netstat, ssh,
ifconfig, iptables)

Module 3

SETTING UP ETHICAL HACKING LAB

Installing Kali Linux in VMWare

Configuring Kali Linux

Installing Discover Tool

Downloading a Good Wordlist

Anonymous Configuration in Linux

Configuring Proxy

Configuring VPN

Changing MAC Address

Changing Wi-Fi MAC Address

Module 4

FOOTPRINTING AND RECONNAISSANCE

What are Footprinting and Reconnaissance?

Types of Footprinting & Reconnaissance

Use of Footprinting & Reconnaissance

Footprinting Through Search Engines

Footprinting using Advanced Google Hacking Techniques (Google Dorking)

Footprinting Through Social Networking Sites

Website Footprinting

Email Footprinting

DNS Footprinting

WHOIS Footprinting

NS Lookup

Module 5

SCANNING NETWORKS
What is Network Scanning?

Network Scanning Methodology

Types of Network Scans

Checking for Live Systems and Buffer Size

Checking for Open Ports

Checking for Services on Ports

OS Fingerprinting & Banner Grabbing

Module 6

ENUMERATION

What is Enumeration?

Types of Enumeration

Default Ports

How to Enumerate NetBIOS?

How to Enumerate SNMP?

How to Enumerate SMTP?

How to Enumerate NFS?

How to Enumerate DNS?

Module 7

VULNERABILITY ASSESSMENT

What is Vulnerability Assessment?

Classification of Vulnerability
Vulnerability Assessment Lifecycle

Vulnerability Assessment Solutions

Vulnerability Scoring Systems

Scanning for Vulnerability in Nmap scans

result?

Vulnerability Scanning - ZAP (OWASP)

(After learning all above topics you can do vulnerability assessment)

Module 8

SYSTEM HACKING

What is System Hacking?

System Hacking Methodology

Cracking Windows Password

Creating a Good Password list

Escalate Privileges in Linux

Escalate Privileges in Windows OS

System Hacking using URL

System Hacking using Open Ports

What is Steganography?

Types of Steganography

Steganography Practical

Module 9
MALWARE THREATS

What is Malware?

Example of Malware

What is Trojan?

What are Viruses and Worms?

Types of Malware Analysis

Static Malware Analysis

Dynamic Malware Analysis

How to Create RAT Trojan?

Creating Payloads

Creating Undetectable Payloads

Module 10

SNIFFING

What is Sniffing?

How an Attacker Hacks the Network using Sniffers

Active Scanning Techniques

Types of Sniffing

Protocols Vulnerable to Sniffing

MAC Spoofing

MAC Flooding

DHCP Flooding

Setup DHCP Rouge

MITM Attack
Sniffing with Wireshark

Module 11

SOCIAL ENGINEERING

What is Social Engineering?

Types of Social Engineering

Human-based Social Engineering

Computer-based Social Engineering

Mobile-based Social Engineering

Social Engineering Using SET

Module 12

DOS & DDOS ATTACKS

What is DoS Attack?

What is DDoS Attack?

Basic Categories of DoS/DDoS Attack Vectors

UDP Flood Attack

ICMP Flood Attack

SMURF Attack

SYN Flood Attack

SYN Flood Attack

What is DRDOS Attack?

Performing DoS Attack

Performing DDoS Attack

Performing DoS/DDoS on Mobiles

Performing MAC Flooding

Performing DHCP Flooding

Module 13

SESSION HIJACKING

What is Session Hijacking?

Why is Session Hijacking Successful?

Session Hijacking Process

Types of session Hijacking

Performing Session Hijacking

Module 14

HACKING WEB SERVERS & WEB APPS

What is Web Server?

Web Server Attacks

Web Server Attack Methodology

Web Application Concepts

Web Application Hacking Methodology

Vulnerability Scanning with Acunetix

Module 15

HACKING WIRELESS NETWORKS

What is Wireless Networking?

Types of Wireless Encryption

Types of Wireless Threats

Wireless Hacking Methodology

Complete Hacking WEP (WI-FI)

Basic to Advanced Hacking WPA/WPA2

How to Jam Wi-Fi?

Module 16

HACKING WIRELESS NETWORKS

Mobile Platform Attack Vectors

OWASP Top-10 Mobile Risks- 2016

Mobile Platform Vulnerability and Risks

Mobile Security Guidelines

Calls, SMS, Email Bombing on Android

Generating Payloads

Using Keylogger app

Info Gathering from G-Accounts

Module 17

CRYPTOGRAPHY

What is Cryptography?
Difference Between Encoding, Hashing & Cryptography

Types of Cryptography

How it works?

Cryptography tools

Hashing Tools

Encoding Tools

Defensive

(Note: If you want to learn Cybersecurity only and not go for Offensive
site then first learn CCNA and then learn Linux. I added Linux roadmap
and lap setup in Offensive roadmap on Module 2. Check Module 2 of
Offensive roadmap. )

Job roles in Defensive

Security Analyst

Security Engineer

Penetration Tester (Ethical Hacker)

Security Architect

Chief Information Security Officer (CISO)

Incident Responder

Defensive Roadmap:
Module 1

Introduction to Cybersecurity

Understanding Cybersecurity Terminology

Common Cyber Threats and Vulnerabilities

Importance of Cyber Hygiene (Strong Passwords, Software Updates)

Module 2

Introduction to Ethical Hacking (If you already learned Offensive then skip this and if you not learned
offensive then this is important.)

Foot-printing and Reconnaissance

Scanning Networks

Enumeration

Vulnerability Analysis

System Hacking

Malware Threats

Sniffing

Social Engineering

Denial-of-Service

Session Hijacking

Evading IDS, Firewalls, and Honeypots

Hacking Web Servers

Hacking Web Applications

SQL Injection

Hacking Wireless Networks

Hacking Mobile Platforms

Cryptography

Module 3

PENETRATION TEST (If you already learned Offensive then skip this and if you not learned offensive then
this is important.)

Internal Pen testing

Personal Skills

Download Links and Support Files

Virtual Images

Hardware Configuration Files

Computer Crime Laws

Types of Laws

Type of Computer Crimes and Attacks

Confidentiality Agreement

Company Obligations

Contractor Obligations

Learn Bash scripting

Learn Python

Here is python topics;

Strings and expressions

Functions and conditionals

Variables and lists

Loops

Module 4

Network Security

Note: In-depth Study of TCP/IP and Networking Protocols are required for network security.

Network Security Concepts (Firewalls, IDS/IPS, VPNs)

Secure Network Design and Architecture

Module 5

System Security

Understanding Operating System Security

Implementing Access Controls and User Permissions

System Hardening Techniques

Introduction to Scripting (Python, Bash)

Module 6

Application Security

Secure Software Development Practices

Common Vulnerabilities (OWASP Top 10)

Web Application Security (SQL Injection, XSS, CSRF)

Introduction to Secure Coding (JavaScript, Python, etc.)

Module 7

Cryptography

Basic Cryptographic Concepts (Symmetric vs. Asymmetric Encryption)

Understanding Hash Functions and Digital Signatures

Public Key Infrastructure (PKI)

Module 8

Incident Response and Forensics

Incident Response Lifecycle

Digital Forensics Fundamentals

Analyzing Malware and Exploit Kits

Memory Forensics and Disk Imaging

Module 9

Advanced Cryptography

In-depth Study of Cryptographic Algorithms

Cryptanalysis Techniques

Implementing Cryptographic Protocols (SSL/TLS)

Module 10

Cloud Security

Understanding Cloud Computing Models (IaaS, PaaS, SaaS)

Cloud Security Best Practices

Securing Cloud Infrastructure (AWS, Azure, Google Cloud)

Identity and Access Management (IAM) in the Cloud

Module 11

Cybersecurity Management and Compliance

Cybersecurity Policies and Frameworks (ISO 27001, NIST)

Risk Management and Assessment

Understanding Compliance Requirements (GDPR, HIPAA)

Business Continuity and Disaster Recovery Planning