The Beginner's Guide to Ethical Hacking: A Step-by-Step Learning Path for 2026

Key takeaways

• Ethical hacking sits on top of fundamentals. Skipping networking and Linux is the most common reason beginners get stuck.
• You learn this by doing. Books explain, labs build skill. Build a safe lab on your own computer before you touch any tool.
• Certificates help you get interviews, but a portfolio of write-ups from lab work shows what you can actually do.
• Every test needs the owner's written authorisation. In India, unauthorised access is an offence under the IT Act, 2000.

What does an ethical hacker actually do?

An ethical hacker is a security professional who is hired to find weaknesses in a system by attacking it the way a criminal would, with the owner's written permission, and then to report how to fix them. The work ends with a report, not a stolen database.

Typical job titles are penetration tester, vulnerability analyst, red team member and application security engineer. Day to day it is mostly scoping, scanning, testing, checking findings by hand, and writing clear reports that a developer or manager can act on. The glamorous part is small. The writing and the patience are large.

What is the step-by-step path for a beginner?

Work through the stages below roughly in order. You can overlap them, but do not skip the early ones. How long each takes depends on your background and how many hours you practise each week, so measure progress by what you can do, not by calendar dates.

Step 1: Learn networking

Almost every attack and defence is about how data moves. Learn the OSI and TCP/IP models, IP addressing and subnetting, how DNS, DHCP, ARP, HTTP and TLS work, and what ports are. Install Wireshark and capture your own traffic, because seeing a real handshake teaches more than a diagram. A networking foundation such as the one in CCNA is excellent preparation, even if you never take the exam. See the Wireshark documentation for getting started.

Step 2: Get comfortable with Linux

Most security tools run on Linux, and most servers you will assess run it too. Learn the file system, permissions, users and groups, package management, processes, services, networking commands and basic shell scripting. Use it every day, not occasionally. Kali Linux is the usual distribution for security tools, and its official documentation covers installation. Do not use Kali as your daily system; run it in a virtual machine.

Step 3: Learn some programming and SQL

You do not need to be a software engineer, but you need to read code and automate tasks. Python is the best first choice for scripting, and the official Python tutorial is free. Learn SQL too, because understanding databases is how you understand injection flaws. Later, basic JavaScript helps with web testing, and C helps if you move toward exploit development.

Step 4: Learn core security concepts

Study the CIA triad (confidentiality, integrity, availability), authentication versus authorisation, encryption and hashing, common vulnerability classes and the stages of an attack. The OWASP Top 10 is the standard list of web application risks, and MITRE ATT&CK catalogues real attacker techniques. Learn to look up a vulnerability by its CVE identifier in the National Vulnerability Database.

Step 5: Build a safe home lab

A lab lets you practise legally. The usual setup is virtualisation software on your laptop, a Kali Linux VM as the attacker, and deliberately vulnerable targets on an isolated host-only network, such as Metasploitable and DVWA. Keep the lab off your home network's other devices. Snapshots let you break things and roll back.

Step 6: Learn the tools, and the method behind them

Now use the tools, one at a time, and always ask what the tool is actually doing on the wire.

• Nmap for discovering hosts and services (see the Nmap reference guide).
• Wireshark for packet analysis.
• Burp Suite for intercepting and testing web traffic.
• Metasploit for understanding how exploits and payloads are organised.
• Password and hash tools, only on hashes you created in the lab.

Follow a method rather than random clicking: reconnaissance, scanning and enumeration, vulnerability analysis, exploitation within scope, post-exploitation checks, and reporting. Each stage should feed the next, and you should record what you did.

Step 7: Specialise

Once the basics are solid, pick a direction. Web application testing, network and infrastructure testing, cloud security, wireless, mobile and malware analysis are different skill sets. Web testing is a common starting point because there are many free labs and demand is steady.

Step 8: Practise on legal platforms and write up what you learn

Work through free labs such as the PortSwigger Web Security Academy, intentionally vulnerable apps and capture-the-flag exercises. For every exercise you finish, write a short report: what the flaw was, how you found it, how it would be fixed. A handful of clear write-ups is a better portfolio than a long list of tool names.

Step 9: Get certified when you are ready

Certificates are not required to learn, but many employers use them to filter applicants. Match the certificate to your stage:

Check the vendor's own page for current exam format and requirements, for instance EC-Council's CEH page, OffSec's PEN-200 page and CompTIA's certification list.

What is the legal line?

Everything in this path assumes permission. Accessing a computer system without authorisation is an offence under the Information Technology Act, 2000 in India, whatever your intention. Practise only in your own lab, on legal platforms that invite testing, or within a signed scope of work. Bug bounty programmes publish rules about what you may test, and you must follow them exactly. If you find a flaw by accident, report it, do not explore further, and do not keep or share any data you saw. India's national response team, CERT-In, accepts reports at cert-in.org.in.

Which books help most?

Books are good for depth once you are doing the labs. The titles below were in the original version of this article, and they are still worth knowing, with a note on how each fits the path:

• Penetration Testing: A Hands-On Introduction to Hacking by Georgia Weidman: practical exercises that match steps 5 and 6.
• The Web Application Hacker's Handbook by Dafydd Stuttard and Marcus Pinto: a classic for web testing. It is a 2011 second edition, so use it for concepts and pair it with current labs.
• Hacking: The Art of Exploitation by Jon Erickson: teaches C, memory and exploitation from first principles. Better after step 3.
• Black Hat Python by Justin Seitz: Python for security tasks, for when your scripting is comfortable. Check which edition you are buying, since the code has been updated.
• The Hacker Playbook by Peter Kim: a practical, project-style walk through a test.
• Network Security Assessment by Chris McNab: methods for assessing network services.
• Cybersecurity and Cyberwar by P.W. Singer and Allan Friedman: background reading, not a technical guide.

For longer reading lists by level, see our posts on cybersecurity books for beginners and books for ethical hacking certification prep.

Common beginner mistakes

• Jumping straight to tools with no networking base, then not understanding the output.
• Collecting tutorials without finishing any lab.
• Downloading "hacking tools" from random sites, which often contain malware.
• Testing something real "just to see". That is where careers and finances get damaged.
• Weak reports. If you cannot explain a finding clearly, the finding has not helped the client.

Next steps

If you prefer guided, instructor-led practice, WebAsha offers the Certified Ethical Hacking CEH v13 AI course. If your networking or Linux basics are not yet solid, start with the Linux course first.

Related reading

• Best Books for Learning Cybersecurity and Networking | A Complete Guide from Beginner to Expert