Cybersecurity Learning Path

Problem

Wanted to build practical offensive security skills in a structured way rather than jumping between random CTF challenges. Needed a progression path that covered web application security in depth while building toward real-world pentesting capability.

What I Built

A documented learning path through three platforms, each targeting a different skill level:

1. TryHackMe — foundational Linux, networking, and security concepts through guided rooms
2. PortSwigger Web Security Academy — deep dive into web application vulnerabilities (SQL injection, XSS, CSRF, authentication bypasses, access control flaws)
3. HackTheBox — practical exploitation of intentionally vulnerable machines with minimal guidance

Each completed module includes notes on the vulnerability type, exploitation technique, and the defensive countermeasure.

Stack

• Platforms: TryHackMe, PortSwigger Web Security Academy, HackTheBox
• Tools: Burp Suite, nmap, Linux command line
• Documentation: Markdown writeups

What I Learned

• PortSwigger’s labs are the most effective web security training available — each lab isolates a single vulnerability class and forces you to exploit it without hints.
• The jump from guided TryHackMe rooms to unguided HackTheBox machines is significant. Enumeration discipline is the key differentiator.
• Writing up findings in a structured format (vulnerability → proof of concept → remediation) is a skill separate from the exploitation itself and equally important for professional work.

Outcome

Ongoing progression through all three platforms with documented writeups covering web vulnerabilities, network exploitation techniques, and defensive recommendations.