Roadmap to Becoming a Successful Penetration Tester: Skills, Labs and Certifications by Stage

Key takeaways

• Fundamentals decide how far you go. Networking, Linux, Windows and a scripting language matter more than any single tool.
• Practise only on systems you own or have written permission to test, such as your own virtual machines and training labs.
• Reporting is half the job. A finding the client cannot understand or fix is not a finding.
• Certifications open interviews. Practical proof, such as lab write-ups and a strong OSCP-style exam result, opens offers.
• The experience bands below are a rough guide. Real careers move at different speeds.

What does a penetration tester actually do?

A penetration tester is paid to find weaknesses in a system before a criminal does, then explain how to fix them. The work is agreed in writing: what you may test, when, and what is out of bounds. You scan, probe and exploit within that scope, then write a report that a developer and a manager can both act on.

In India the written authorisation is not a formality. Accessing a computer system without permission can be an offence under the Information Technology Act, 2000, even if your intention is good. The permission letter protects you and the client.

What is the roadmap, stage by stage?

The table is a rough guide to how the career is usually described. Use it to see what to learn next, not to judge your pace.

Stage 1: Junior penetration tester

Your goal here is a foundation you can build on. Do not rush to exploits.

Skills to build

• Networking: TCP/IP, subnets, routing, DNS, HTTP. If you cannot explain what happens when you type a URL, tools will confuse you.
• Operating systems: Linux command line, file permissions, services, and Windows basics such as users, services and the registry.
• Web basics: the OWASP Top 10 and how each category happens in code. Start at the OWASP Top 10.
• Tools: Nmap for discovery, Wireshark for packets, Burp Suite for web traffic.
• Scripting: enough Python or Bash to automate a repetitive task.

How to practise

1. Study networking basics, for example through CompTIA Network+ topics or our Computer Network course.
2. Build a home lab with VirtualBox or VMware: a Kali Linux VM and deliberately vulnerable targets such as DVWA and Metasploitable.
3. Work through legal practice platforms such as TryHackMe and Hack The Box.
4. Write up every machine you solve, with the commands, the output, and the fix you would recommend. This becomes your portfolio.

Certification to consider: CompTIA Security+ for the security vocabulary. Many beginners also take CEH or CompTIA PenTest+ at this stage. See the CompTIA certification list and the EC-Council CEH page. The current CEH is v13.

Stage 2: Penetration tester

You can now run an engagement with some supervision. The goal is to work faster and understand what your tools do underneath.

• Use Metasploit, SQLMap and Nessus knowingly, and know the manual steps they automate.
• Script reconnaissance and parsing in Python or PowerShell.
• Learn privilege escalation on both Windows and Linux.
• Start Active Directory labs. Most corporate networks run on it.
• Pick up wireless and mobile basics.

Certification to consider: OSCP, the hands-on exam from OffSec. Read our overview of tester skills and certifications for how it compares.

Stage 3: Senior penetration tester

You now think like both attacker and adviser. You lead engagements, mentor juniors, and explain business risk to people who do not read code.

• Threat modelling and risk assessment.
• Social engineering assessments such as phishing simulations, run with explicit approval.
• Red-team techniques: lateral movement and post-exploitation.
• Cloud security testing on AWS, Azure and GCP, following each provider's testing rules.
• Purple-team work with defenders to tune detection.

Certifications to consider: Certified Red Team Professional (CRTP), GIAC Penetration Tester (GPEN), and OffSec's OSWA or OSEP.

Stage 4: Lead penetration tester

The job shifts from doing tests to running them well.

• Scoping, estimating effort, and writing statements of work.
• Building or extending the team's internal tooling.
• Tying findings to business impact and to standards such as PCI DSS, HIPAA and GDPR where the client is subject to them.
• Fitting security testing into DevSecOps pipelines.

Certifications to consider: OSEP for advanced offensive skills, and CISSP if you want broader security leadership. See ISC2 certifications.

Stage 5: Head of red team operations

At this level you set the direction of offensive security for an organisation: strategy, budget, hiring, and agreement with legal, risk and defence teams. Technical depth still matters, because you must judge your team's work. For the path beyond testing, read our intern to CISO career guide.

A first-year plan for a beginner

This is a suggested plan, not a promise of a result. Adjust it to the hours you can give each week.

1. Months 1 to 3: networking, Linux command line, Windows basics, Python or Bash.
2. Months 4 to 6: web vulnerabilities in DVWA, then Burp Suite. Start a notes repository.
3. Months 7 to 9: a foundation certification, plus regular lab machines, each written up.
4. Months 10 to 12: Active Directory basics, a full mock report, and job applications for junior or SOC roles.

Soft skills that decide promotions

• Writing: an executive summary one page long, and technical detail that another tester can reproduce.
• Explaining risk: say what an attacker gains, not only which CVE applies.
• Ethics and discipline: stay inside scope, protect client data, report what you find even when it embarrasses someone.
• Curiosity and patience: most testing is dead ends until it is not.

Common mistakes

• Collecting certificates without lab practice.
• Learning tools before networking.
• Testing a real website "just to practise". That is unauthorised access.
• Ignoring report writing until the first job.

Next steps

If you want structured training with labs, look at WebAsha's VAPT course. For the ethical hacking route in more detail, read the ethical hacking career roadmap for beginners.

Related reading

• How to Transition from IT Support to Cybersecurity | A Complete Roadmap for Career Growth