Ethical Hacking for Beginners: A 7-Day Starter Plan to Begin Legally

Key takeaways

• Seven days is enough to set up a lab and learn the vocabulary, not to become job-ready. Plan on months of practice.
• Permission is what makes hacking ethical. Without written authorisation, testing is illegal under India's IT Act.
• Linux and networking are the foundation. Weak networking is the most common reason beginners get stuck.
• Practise only on your own lab: a Kali VM with intentionally vulnerable targets such as DVWA and Metasploitable.
• Write notes and short reports as you go. Reporting is half the job.

What is ethical hacking?

Ethical hacking, also called penetration testing or white-hat hacking, is the practice of testing systems for security weaknesses with permission from the owner, then reporting how to fix them. The methods overlap with those of attackers. The authorisation, scope and reporting are what separate it from a crime. Roles that use these skills include penetration tester, security analyst, vulnerability assessor and red team member.

Is ethical hacking legal in India?

It is legal when you have clear, written permission to test a defined target. Accessing a computer system without permission is an offence under India's Information Technology Act, even if you mean no harm and even if you report it. So the rule for the whole course is simple: test only your own machines, lab targets built for practice, and clients who have signed a scope document.

Your 7-day starter plan

This plan gets you oriented. It does not make you a hacker in a week, and nobody should promise that. Spend one to two hours a day.

Which tools should beginners know?

• Kali Linux as a ready-made toolbox (see the Kali documentation).
• Nmap for host and service discovery (Nmap reference guide).
• Wireshark for seeing what travels on the network (docs).
• Burp Suite or OWASP ZAP for web testing.

Learn what a tool does and why before you worry about all its options.

Where do beginners go wrong in the first week?

• Jumping to exploitation before they can read an Nmap result or explain a port.
• Running tools they do not understand against sites they do not own.
• Copying commands from videos with no notes.
• Skipping networking and Linux because they feel less exciting.

What should you study after the first week?

1. Weeks 2 to 4: deeper Linux and networking, plus Python or Bash basics.
2. Months 2 to 3: web application security with the OWASP Top 10, then network and system testing in guided labs.
3. After that: pick a certification route such as CEH or, later, OffSec PEN-200 (the OSCP exam). CEH is currently version 13, and CEH Practical is a separate hands-on exam.

Do you need to know programming?

You can start without it. Basic Python or Bash soon becomes useful for automating tasks and reading exploit code. Learn it alongside, not before.

Next steps

When you want structured, hands-on training with a trainer, see WebAsha's ethical hacking and CEH course. Read next: ethical hacking career roadmap for beginners.

Related reading

• How to Get Into Ethical Hacking with No Experience? A Complete Beginner’s Guide to Start a Cybersecurity Career
• How to Learn Ethical Hacking in 3 Months? A Complete Beginner’s Guide to Mastering Cybersecurity
• What Is the First Step to Learning Cybersecurity? A Beginner’s Roadmap to a Successful Cybersecurity Career