Step-by-Step Ethical Hacking Learning Roadmap in India

Key takeaways

• Order matters: networking and Linux before tools, practice before certification.
• Ethical hacking is legal in India only with written authorisation; the IT Act, 2000 (Sections 43 and 66) applies otherwise.
• Most people enter through SOC, security analyst, network or system administrator roles, not as penetration testers.
• A portfolio of write-ups, a documented lab and a sample report counts for more than a pile of certificates.

What is ethical hacking, and what is the job really like?

Ethical hacking means testing systems, networks and applications for weaknesses using an attacker's techniques, with the owner's written permission, so that the weaknesses get fixed. The skills match malicious hacking. The permission and the purpose are what differ.

The work is less dramatic than films suggest. A typical engagement agrees what may be tested, maps what exists, probes for misconfigurations and known weaknesses, shows the impact of anything found, and ends in a written report that an administrator or developer can act on. The report matters more than beginners expect. A finding nobody can reproduce does not get fixed, and clear writing is one of the biggest differences between candidates with similar technical skill.

Is ethical hacking legal in India?

Only with explicit, written authorisation from the system owner. Without it, the Information Technology Act, 2000 applies: Section 43 covers unauthorised access, downloading and damage, and Section 66 makes those acts a criminal offence when done dishonestly or fraudulently. CERT-In is the national agency for cyber security incidents. This is general information, not legal advice.

• The technique does not decide legality. A port scan on your own machine is fine. The same scan on a company that has not agreed is not, whatever your intentions and even if you report what you find.
• Get permission in writing that names the systems, dates and allowed techniques. Verbal approval protects nobody.
• Stay in scope. Straying onto an out-of-scope host is the usual way well-meaning testers get into trouble.
• Do not test your employer's systems out of curiosity. Having a job is not authorisation.
• Read bug bounty scopes carefully. A programme authorises only the assets it lists.

If you are structuring paid testing work, take legal advice on your contract.

How long does it take to learn ethical hacking?

Plan for 12 to 18 months of steady study to become employable at entry level from a standing start, or 6 to 9 months if you already work in IT, networking or system administration. These are our planning estimates, not measured figures; they assume 10 to 15 hours a week. Leading engagements alone takes years of real work beyond that. Hours per week, sustained, matters more than which course you buy. Ten hours a week for a year beats forty hours a week for two months, because security skills fade quickly without use.

The roadmap at a glance

Stages overlap in practice, but the order of first exposure should hold. Skipping to tools is the most common mistake, and it produces people who can run commands but cannot interpret the output.

Stage 1: Computer and operating system fundamentals

Learn how computers work: processes, memory, filesystems, users and permissions, and the difference between an operating system and the applications on it. Learn to create and snapshot virtual machines. Do not skip Windows, including the registry and Active Directory basics. Online security content leans towards Linux, but many corporate networks you will be paid to test run Windows with Active Directory, and candidates who know only Linux interview poorly for internal network roles.

Stage 2: Networking

This is the most important stage and the one people rush. Learn the OSI and TCP/IP models, addressing and subnetting, DNS, HTTP and HTTPS, TCP and UDP, ports, routing, switching, NAT and firewalls. Nearly every attack concept is a networking concept underneath.

A good self-test: describe, packet by packet, everything that happens between typing a URL and the page appearing. If you cannot, stay in this stage.

Stage 3: Linux

Reach comfort, not mere familiarity: the command line, filesystem hierarchy, permissions, users and groups, package management, services, networking commands, logs and shell scripting. The test is that you can navigate, inspect and change a system from a terminal without stopping to search for basic commands. If you want this stage structured and examined, the Red Hat RHCSA track gives real administration depth and carries independent weight on a CV.

Stage 4: Programming and scripting

You need scripting, not software engineering. The aim is to automate repetitive work and read other people's code.

A useful first project: a script that takes a list of hosts you own, runs a scan on each and prints a readable summary. It forces you to handle real output and is easy to talk about in an interview.

Stage 5: Security fundamentals

Before offensive tools, learn the defensive ideas they test: the CIA triad, authentication versus authorisation, hashing versus encryption, symmetric versus asymmetric cryptography, TLS, secure configuration, logging and monitoring. Know the common vulnerability classes: injection, broken access control, misconfiguration, weak authentication, insecure deserialisation and exposure of sensitive data. The OWASP Top 10 is the standard free reference for web risks, and the NIST Cybersecurity Framework supplies the defensive vocabulary clients use. Understanding why something is a weakness is what lets you find new ones as well as known ones.

Stage 6: The tools of the trade

Learn a few tools properly. A network scanner, an intercepting web proxy, a packet analyser, a password-cracking tool and an exploitation framework cover most entry-level work. For each, learn what it does at protocol level first.

Kali Linux bundles most of these; see the Kali documentation and the Nmap reference guide. Resist collecting tools. Interviewers can tell in two questions whether you understand a tool or have only run it.

Stage 7: Practice labs and capture the flag

This is where knowledge becomes skill. A workable home lab needs little: a machine with 8 GB of RAM, free virtualisation software, one attacker VM and one or two deliberately vulnerable targets, such as DVWA or Metasploitable. Snapshot everything so you can break things and roll back. Add legal online lab platforms such as Hack The Box, capture-the-flag events, and, later, bug bounty programmes with clear scope.

Write up everything you solve, even briefly. The write-ups become your portfolio, force you to explain your reasoning, and are what you will discuss in interviews.

Stage 8: Choose a specialisation

The field is too broad to master whole. Web application testing is the common first choice because demand is high and the entry cost is low.

Red teaming attracts beginners because it is visible. It is the worst starting point, because it assumes competence in everything above.

Which certifications matter in India?

Certifications mostly act as a screening filter. Take them in this order, not by prestige: a vendor-neutral foundation, then CEH for HR recognition, then a hands-on practical credential once you have lab practice.

Two cautions. Exam fees change and are significant in rupees, so check current prices with the issuing body, for example EC-Council for CEH and OffSec for PEN-200. Note too that OSCP+ lapses after three years unless renewed. And a certificate with no practical work behind it is obvious in a technical interview within a few questions. Older versions of CEH (v10, v11, v12) are retired, so train for the current one.

Structured training: CEH v13 AI at WebAsha

Self-study works, but it usually fails through lost momentum rather than difficulty. Instructor-led training adds pacing, feedback and someone to ask. WebAsha lists its CEH v13 AI course as follows; confirm current details on the course page before booking.

Read "placement assistance" for what it is: help preparing and finding opportunities. It is not a job guarantee, and no institute can honestly offer one.

Build a portfolio that gets interviews

Most beginners cannot show paid security work, so a portfolio replaces it. Quality beats volume: three thorough write-ups are worth more than thirty one-paragraph notes.

• Write-ups of lab machines and challenges, including approaches that failed. The failures show how you think.
• A public repository of scripts and small tools with clear READMEs.
• A documented home lab: a diagram and a note on what you built and why.
• Bug bounty results. Even two or three accepted reports carry weight.
• A sample report. Write one full penetration test report against a lab target in professional format. Very few candidates do, and it shows the skill employers most often find missing.

Job roles in India

Few people start as penetration testers. The realistic entry points are SOC analyst, security analyst, network engineer, system administrator and IT support. These build the production exposure that penetration testing interviews probe, so treat the first role as part of the roadmap, not a detour.

Hiring is concentrated around Bengaluru, Pune, Hyderabad, Delhi NCR, Mumbai and Chennai, across IT services, product companies, banking and finance, consulting and government-linked bodies. Services firms tend to value breadth and client communication; product companies value depth.

What decides an ethical hacker's salary in India?

Pay varies widely by experience, city, sector, specialisation and client-facing responsibility, so we do not quote a single figure. Factors that consistently raise earnings: demonstrable practical ability over certificate count; a specialisation; client-facing skill such as scoping and explaining risk; good report writing; product companies over services firms, generally; and regulated sectors such as banking. For current numbers, check a salary site such as AmbitionBox, Glassdoor or Naukri, filter by city and experience, and note the date. Be sceptical of any article that quotes precise salaries without a named, dated source.

Mistakes that slow people down

A realistic 12-month plan

At 10 to 15 hours a week: three months of fundamentals, three of Linux and scripting, three of security concepts and tools, three of practice, certification and applications. Adjust the pace, keep the order.

Start applying in month ten, not twelve. Interview feedback tells you what is missing faster than another course.

Who this roadmap suits

• Students and freshers: you have time; spend it on networking and Linux, not tools.
• IT support and NOC engineers: you already understand production behaviour, which is harder to teach than tooling.
• Network and system administrators: the shortest route, since stages 2 and 3 are largely done.
• Developers: you have scripting and application knowledge; add networking and vulnerability classes.
• Career switchers from non-IT backgrounds: possible, but allow around 18 months and build a stronger portfolio to offset the CV gap.

How to start this week

1. Install virtualisation software and create one Linux VM.
2. Begin a structured networking course and finish it.
3. Block fixed study hours in your calendar.
4. Start a write-up document today, even for small things.
5. Do not install offensive tools yet.

Consistency beats intensity by a wide margin in this field. The people who make it are rarely the fastest starters. They are the ones still practising in month nine.

Next steps

If you want guided training, WebAsha's CEH v13 AI course covers the offensive syllabus, and a training advisor can tell you whether to start there or build foundations first. For the Linux stage, see the RHCSA and RHCE course. Related reading: the penetration tester career roadmap, ethical hacking laws and legal boundaries and common penetration testing techniques.