Short answer: To learn ethical hacking in 2026, follow a step-by-step roadmap: master networking, Linux and scripting first, then web and network security fundamentals, then hands-on exploitation with Kali, Burp Suite and Metasploit, and finally earn CEH or OSCP while building a lab portfolio. Expect 8–14 months to reach job-ready level.
Ethical hacking — legally testing systems to find and fix vulnerabilities before criminals do — is one of the most exciting and well-paid careers in cyber security. But it is also the field where beginners get lost fastest. This roadmap gives you the exact order to learn things, the real tools professionals use, and the certifications that get you hired in India.
What is ethical hacking, really?
An ethical hacker (also called a penetration tester or white-hat hacker) uses the same techniques as malicious attackers, but with written permission and a goal of fixing weaknesses. The work is legal only when you have authorization. Without it, the same actions are crimes under India's IT Act, 2000. If you are new to the concept, read what is ethical hacking first.
The demand is real and growing. As Indian banks, fintechs, healthcare providers and government departments digitize, they are legally and commercially obligated to test their systems for weaknesses before criminals exploit them. That testing is what ethical hackers do — and there are far more openings than there are skilled people to fill them. This roadmap turns you from curious beginner into one of those skilled people.
Who can become an ethical hacker?
You do not need a computer science degree or a genius IQ. What you need is curiosity, patience and persistence. People from BCA, BSc IT, engineering, and even non-technical backgrounds succeed in this field every year. The common trait among those who make it is not talent — it is the willingness to keep practising in the lab after the theory is done.
The step-by-step ethical hacking roadmap
Phase 1: Foundations — networking and systems (6–8 weeks)
- TCP/IP, ports, protocols (HTTP, DNS, SMB, FTP), and how packets travel.
- How operating systems, processes and permissions work on Windows and Linux.
- Set up a home lab with VirtualBox: a Kali attacker VM and vulnerable target VMs.
Phase 2: Linux and scripting (4–6 weeks)
- Command-line mastery in Kali Linux: navigation, permissions, networking commands.
- Bash scripting for automation.
- Python for writing your own scanners and exploit tooling.
Phase 3: Reconnaissance and scanning (3–4 weeks)
- Passive recon: OSINT, Google dorking, WHOIS, subdomain enumeration.
- Active scanning with Nmap — host discovery, port scanning, service and version detection.
- Vulnerability scanning with tools like Nessus and Nikto.
Phase 4: Web application hacking (6–8 weeks)
Most real-world penetration testing work is web-based. Master the OWASP Top 10.
- SQL injection, Cross-Site Scripting (XSS), CSRF, broken authentication, IDOR.
- Intercept and manipulate traffic with Burp Suite.
- Automate injection testing with sqlmap.
- Practice on PortSwigger Web Security Academy and DVWA.
Phase 5: Network and system exploitation (4–6 weeks)
- Exploit vulnerabilities with the Metasploit framework.
- Password attacks with Hydra and John the Ripper; hash cracking with Hashcat.
- Privilege escalation on Windows and Linux.
- Post-exploitation, pivoting and maintaining access (in authorized labs).
Phase 6: Certifications (3–6 months)
Earn credentials that Indian employers recognise — detailed below.
Phase 7: Labs, CTFs and portfolio (ongoing)
- Grind machines on Hack The Box and TryHackMe.
- Play Capture The Flag (CTF) competitions.
- Start ethical bug bounty hunting on platforms like HackerOne and Bugcrowd.
- Document everything — write-ups prove your skill to employers.
Ethical hacking tools by phase
| Phase | Purpose | Tools |
|---|---|---|
| Recon | Information gathering | Nmap, theHarvester, WHOIS |
| Web hacking | App exploitation | Burp Suite, sqlmap, OWASP ZAP |
| Exploitation | System compromise | Metasploit, Kali Linux |
| Passwords | Credential attacks | Hydra, John, Hashcat |
| Traffic analysis | Packet inspection | Wireshark |
Which certifications should an ethical hacker get?
CEH (Certified Ethical Hacker) from EC-Council is the most recognised entry credential in India and is often required for government and enterprise roles. OSCP (Offensive Security Certified Professional) is the gold-standard practical exam — 24 hours of live hacking — and it commands respect and higher salaries. A common path is CEH first to open doors, then OSCP to prove real, hands-on ability.
Ethical hacker salaries in India (2026)
| Role | Experience | Salary (INR/year) |
|---|---|---|
| Junior Penetration Tester | 0–2 yrs | ₹4–7 LPA |
| Penetration Tester / VAPT | 2–5 yrs | ₹6–12 LPA |
| Senior Pentester / Red Team | 5–8 yrs | ₹12–25 LPA |
| Bug Bounty Hunter | Variable | Performance-based |
These are realistic 2026 India figures. OSCP holders and strong bug bounty track records push earnings toward the top of each band.
Learn ethical hacking with Cyber Defence
Cyber Defence's ethical hacking / CEH-aligned program (₹60,000, 6 months) walks through this entire roadmap with guided, hands-on labs — recon, web hacking, exploitation and reporting — taught by founder Amit Kumar (CEH, CRTA), who is defence-trained. The EC-Council exam voucher is purchased separately, and EMI options are available. If you want the fundamentals first, our cyber security course (₹15,000, 3–4 months) builds the base. We are ISO-certified and GeM-registered, teaching both live online and at our Hisar classroom — see our courses or the cyber security course in Hisar.
The five phases of a real penetration test
Beyond learning tools, you must understand the professional methodology that structures every engagement. Employers expect you to follow this process, not just run scanners.
- Reconnaissance: gather information about the target through passive and active means.
- Scanning and enumeration: identify live hosts, open ports, services and versions.
- Exploitation: gain access by exploiting confirmed vulnerabilities.
- Post-exploitation: escalate privileges, assess impact, and (in scope) pivot.
- Reporting: document findings, risk ratings and clear remediation steps.
The final report is what the client pays for. A strong tester who cannot write a clear, prioritized report is far less valuable than one who can, so practice writing professional reports from your very first lab.
A sample ethical hacking learning timeline
| Months | Focus | Outcome |
|---|---|---|
| 1–2 | Networking + systems | Build a working home lab |
| 3–4 | Kali Linux + Python scripting | Write a simple port scanner |
| 5–7 | Web hacking (OWASP Top 10, Burp) | Solve PortSwigger labs |
| 8–10 | Exploitation + CEH study | Pass CEH, root HTB machines |
| 11–14 | OSCP prep + portfolio | Write-ups, bug bounty submissions |
How to build a hacking portfolio that gets you hired
In offensive security, proof of skill matters more than a resume line. Build visible evidence:
- Publish detailed CTF and box write-ups on a personal blog or GitHub.
- Keep a public GitHub of scripts and small tools you have written.
- Document responsible bug bounty findings (redacted where required).
- Maintain a Hack The Box or TryHackMe profile that shows steady progress.
- Contribute to open-source security tools or documentation.
Web hacking is where most jobs are
While movie hackers break into networks, the bulk of real Indian VAPT work is web and API testing. If you have limited time, go deep on the OWASP Top 10, master Burp Suite, and practice injection, access-control and authentication flaws relentlessly. This single focus makes you employable faster than trying to cover every attack surface at once.
How to stay current after you land the job
Ethical hacking is a field where learning never stops — new vulnerabilities, tools and techniques appear constantly. Professionals stay sharp by following security researchers on social media, reading disclosed bug bounty reports, subscribing to newsletters, and continuing to solve new machines and CTFs. Building this habit early separates those who plateau from those who keep advancing into senior red team and specialist roles.
Mindset: think like an attacker, act like a professional
The best ethical hackers combine relentless curiosity with strict discipline. They question every assumption a system makes, but they also respect scope, document carefully, and communicate risk in business terms. Technical skill gets you in the door; this professional mindset is what earns trust, repeat engagements and promotions.
Should you self-study or take a mentored course?
Both routes work. Self-study is free and flexible, but the offensive path is unforgiving for beginners who lack direction — it is easy to spend months on the wrong topics or quit when a lab refuses to crack. A mentored course shortens the journey by giving you a proven sequence, curated labs, live doubt-solving and feedback on your reports, which matters most in the fragile first six months. Whichever you pick, remember that watching tutorials is not the same as doing the work: real skill comes only from repeatedly solving machines, breaking your own lab apps, and writing up what you learned.
Staying legal and ethical
- Only test systems you own or have written permission to test.
- Never use skills for unauthorized access — it is a criminal offence in India.
- Follow responsible disclosure when you find vulnerabilities.
- Keep detailed, professional reports — clear reporting is a core pentester skill.
- Respect scope boundaries; testing beyond an agreed scope can be illegal even during a paid engagement.
FAQ
Is ethical hacking legal in India?
Yes, ethical hacking is legal when you have explicit written authorization to test a system. Testing systems without permission violates the IT Act, 2000 and is a punishable offence, even if your intent is good.
How long does it take to learn ethical hacking?
With consistent daily study and lab practice, most beginners reach a job-ready level in 8–14 months. Exploitation skills come only from repeated hands-on practice on platforms like Hack The Box and TryHackMe.
Do I need CEH to become an ethical hacker?
CEH is not legally required, but it is the most recognised certification for Indian employers and many government roles. For proving practical skill, OSCP carries even more weight among technical hiring teams.
Can I learn ethical hacking without a technical background?
Yes, but you must build the foundations first — networking, Linux and basic scripting. Many successful ethical hackers started from non-technical backgrounds by following a structured roadmap.
What is the difference between ethical hacking and cyber security?
Cyber security is the broad field of protecting systems and data. Ethical hacking is one offensive specialization within it, focused on legally finding vulnerabilities through simulated attacks.
Want to become a certified ethical hacker with real lab experience and mentorship? Call Cyber Defence at +91-75175-72000 to join the next CEH-aligned batch.