So You Want to Be a Hacker

every few days someone messages me asking how to get into hacking.

it's always roughly the same shape. "bro how do i become a hacker", "what roadmap do i follow", "which course should i buy", "is OSCP worth it", "drop the resources pls". sometimes there's a youtube thumbnail attached, guy in a hoodie, green text raining down behind him. sometimes it's a notion template someone actually paid money for that swears it'll turn them into a "pentester in 90 days". i genuinely love these people. i also have no idea how to help them in a single message.

i used to answer properly. long paragraphs, lists of links, the whole thing. then i noticed almost nobody did any of the stuff. they wanted the roadmap, not the road. they wanted the feeling of having a plan more than they wanted to actually learn anything. which, honestly, is fair, i do the exact same thing with like four programming languages i keep "meaning to learn."

so eventually i just started replying "be curious lol", which is true but completely useless and also makes me sound like a fortune cookie.

this is the long version. the one i'd give you if i had your attention for longer than a discord message. fair warning: it's chaotic, it's way too long, and i wrote most of it around 4am with 200 tabs open and a terminal somewhere on this machine that i have genuinely forgotten about. anyway.

real talk first: most hacking advice is bad. not wrong, exactly. just bad. it's written by people optimising for views, or for selling a course, or for looking employable on linkedin. it tells you to "master networking fundamentals" without ever telling you why, hands you a list of forty tools, and points you at a cert that costs more than my macbook.

and the roadmaps. god, the roadmaps. those giant colourful flowcharts with two hundred little boxes, "phase 1: linux basics -> phase 2: networking -> phase 3: python -> phase 4: become mr robot". people screenshot them, save them, share them in the server, and then never open box one. a roadmap feels like progress. it's the productivity version of buying a gym membership in january.

here's the thing nobody selling you a roadmap will admit: the roadmap is the easy part. you could write a decent one in ten minutes. the hard part is the years of being curious enough to keep clicking on things you don't understand. and curiosity is the one thing a flowchart physically cannot give you.

so this isn't really a roadmap. it's more like, here's how it actually happened to me, plus what i'd change if i were starting again in 2026, when the ground has genuinely shifted under everyone and half the advice online is quietly out of date.

ok. let's go :3

how i accidentally ended up here

i didn't decide to become a hacker. there was no moment. nobody sat me down. i just kept following interesting things and one day looked up and realised i knew how to break into stuff.

it started, embarrassingly, with the internet being weird.

i was the kind of kid who got way too into this stuff embarrassingly early. i was poking at little CTF challenges in like grade 6, way before i understood half of what i was doing, just decoding things and following the puzzle because the puzzle was fun. somewhere in there i also fell into ARGs and cryptic hunts and never really climbed back out. if you don't know what those are: alternate reality games, basically puzzles smeared across real websites and images and audio files and hidden pages. someone posts a creepy youtube video, and in the description there's a string of numbers, and the numbers are coordinates, and the coordinates point at a google doc, and the doc has white text on a white background, and so on until 3am. i loved them. genuinely loved that the internet could have a basement.

and the thing about chasing ARGs is you start doing accidental forensics without noticing. you're viewing page source on random sites because someone said a clue was "hidden". you're dragging images into a hex editor because maybe there's a zip glued onto the end of the jpg (there often was). you learn what base64 looks like by sight, the way some people learn to recognise birds. you're decoding things and fiddling with urls and changing ?id=1 to ?id=2 just to see what happens.

nobody told me that last one was, technically, the foundation of an entire class of web vulnerabilities. i just thought it was fun to poke.

that's the whole origin story, really. poking. i'd find some random site and wonder how it worked, so i'd open devtools and look. i'd see a request fly out in the network tab and wonder what'd happen if i changed it, so i'd change it. i'd find a project on github and wonder how the author pulled something off, so i'd just read the source.

one of the early ones that really stuck with me wasn't even adversarial. a friend built an ARG platform for his school's techfest, hosted it himself, was very proud of it, asked me to test it. i opened the network tab (the same move, always the same move) and found that the answers to all the puzzles were sitting in a javascript file in plaintext. not hashed. not obfuscated. just there, like taping the answer key to the back of the exam. i told him five minutes before the competition started, he panicked, tried to patch it mid-event with some ciphers, and somebody on discord promptly leaked the ciphers. it was chaos. it was beautiful. i wrote about it years ago and it still makes me laugh.

but notice what actually happened there. i didn't apply a methodology. i didn't run a scanner. i opened the same panel i always open because i am constitutionally incapable of not looking, and the bug was just lying there. the "skill" was a habit of curiosity i'd built over years of doing pointless puzzles for fun.

everything after that was the same pattern, scaled up. i got into open source because i wanted to fix things in software i used, and reading other people's code taught me more about how systems break than any course ever did. real code is full of the little assumptions and shortcuts that quietly turn into vulnerabilities. when i found bugs in FOSS United's platform i found most of them by reading, not attacking. the project was open source so i could just sit there and notice that an endpoint checked whether a project existed but never checked whether you were actually allowed to touch it.

i got obsessed with how browsers track you, so i built Quark to understand fingerprinting from the inside instead of just reading about it. i got curious about a government exam portal that millions of students depend on, opened the javascript bundle the way i'd opened a hundred bundles before, and found a hardcoded master password sitting in plaintext. that one, uh, got a little out of hand. there was a shell on production servers and Bad Apple playing on a national board's infrastructure and news crews and a government denial and an eventual government apology. but the first step was the same first step it's always been. open the thing. look at the thing. wonder about the thing.

i'm telling you all this not to flex (ok maybe a little) but because i need you to internalise one thing: not a single one of those came from a roadmap. there was no curriculum that said "week 12: get access to 20 million answersheets of a national-level exam and learn how to hijack evaluator accounts". it all came from one muscle, trained over years, which is the complete inability to leave an interesting system alone.

that muscle is the entire game. everything below is just how to train it without wasting three years.

what i'd learn first (and why)

ok but you came here for specifics and "be curious" isn't one. so here's what i'd actually learn, except i refuse to just list topics. lists are useless. the why is the only part that sticks.

linux

everyone says learn linux because "hackers use linux". that's a bad reason tbh. plenty of great hackers do most of their work on a mac. the terminal isn't a costume.

the real reason is that linux forces you to understand computers. windows and macos are designed to hide the machine from you, and they're really good at it. you can use them for a decade and never know what a process is, what a file permission means, how a program actually starts, what your network is doing. they're a comfy hotel room. linux is a house where you have to fix your own plumbing, and fixing your own plumbing is how you learn where the pipes are.

at some point i installed Arch because people on the internet wouldn't shut up about it. this was a terrible idea. it was also a great idea. not because arch is somehow "better", but because installing it the manual way forces you to assemble a working system with your own two hands. you partition the disk yourself. you install the bootloader yourself. you figure out why there's no internet, and then why there's no sound, and then why the screen is the wrong resolution. each one is a tiny little investigation, and investigation is the whole skill.

you will break it. you will break it so badly you have to reinstall. good. the first time i nuked my own bootloader and had to chroot in from a live usb to fix it at midnight, i learned more about how linux boots than any tutorial could've taught me, because i needed to know, right then, with a dead laptop. i learned that one the hard way and it stuck forever.

read the Arch Wiki while you do this. it's genuinely one of the best technical resources humans have ever written and most of it applies to any linux system. become someone who reads the docs instead of someone who searches for a magic command to paste. the person who reads the man page beats the person copying the stackoverflow answer every single time, over a long enough horizon.

then just... live in the terminal for a while. move files with mv, search with grep, pipe things into other things, write a silly little shell script to rename your screenshots. it feels slow and clumsy at first, like writing with your wrong hand, and then one day it doesn't and the GUI starts to feel like wearing oven mitts :3

networking

you can't hack what you don't understand and most of what you'll hack talks over a network. but please, i'm begging you, do not start with a 40-hour video course on the OSI model. you'll memorise seven layers, feel productive, and retain nothing, because you've attached the knowledge to nothing.

instead, learn networking by being mildly annoyed at things you already use.

start with DNS, because DNS is everywhere and DNS is always the problem. (there's a famous sysadmin haiku: "it's not DNS / there's no way it's DNS / it was DNS.") when you type ni5arga.com your computer has no idea where that is. it has to ask. DNS is that asking: a giant distributed phone book that turns names into IP addresses. once this really clicks, a dozen other things click with it: why a site can be down for you but not your friend, how phishing domains work, why changing your DNS server unblocks stuff. go run dig ni5arga.com and just read what comes back. poke at it.

then HTTP, because the web is basically HTTP wearing a nice outfit. every page you load is a little conversation: your browser sends a request ("GET me this page, here are my cookies"), the server sends a response ("here's your html, here's a cookie to remember you by"). open the network tab right now on any site and watch the conversation happen. nearly every web vuln i've ever found lives in this conversation, in the gap between what the server assumes about the request and what an attacker is actually allowed to send. the CBSE bug was literally this: the server trusted a user id the browser sent instead of deciding it itself.

then TLS, the s in https, the reason that conversation can't be read by the guy on the café wifi. you don't need to implement the math. you need the shape of it: how two strangers agree on a secret over a public channel, what a certificate actually proves and what it doesn't, why an expired cert nukes everything. understanding TLS at this level is also how you stop being scared of it and start noticing when something's off.

and underneath all of it, TCP/IP, the postal system that actually shuffles the packets around, breaks your data into pieces, reassembles them, decides where things go. you can pick this up slowly. Wireshark helps a lot here, because it lets you literally watch the packets, and watching is always better than reading about watching.

the relatable version: the internet is a bunch of strangers passing notes through other strangers, and security is mostly the question of which strangers you're forced to trust and whether they deserve it.

browsers

ok here's my favourite unfashionable opinion: the browser is the single best hacking classroom ever built and it's already installed on your machine.

people go looking for a "lab environment" to practise hacking when they're sitting in front of the most instrumented, most hackable, most fascinating piece of software most of them will ever touch. open devtools. that keyboard shortcut is the single most important one you'll ever learn.

the network tab shows you every request a site makes: every api call, every secret it fetches, every bit of data it sends back. half of "web hacking" is just reading this tab carefully and going "wait. why did it send that." the CBSE OTP bug was visible right here: the server mailed the OTP back to the browser inside the response and the browser was grading its own test. you could literally read the secret answer in the network tab. that's not advanced exploitation. that's reading.

cookies and local storage are where sites keep their memory of you, and it turns out you can just... edit them. the CBSE app decided who you were based on values sitting in sessionStorage that you could change with one line in the console. open Application → Storage and look at what sites trust you not to touch. you'll be horrified and delighted in equal measure.

the console is a full programming environment wired live into the page you're on. you can call the site's own functions. read its variables. replay its requests with your own values. modern web apps ship their entire brain to your browser as a js bundle and you can read the whole thing. every app i've broken, i've broken partly by pretty-printing its javascript and just... reading what it does. the logic is right there. they handed it to you, which is kind of funny, hehe.

spend a week treating every website you visit as a thing to inspect rather than a thing to use. you'll learn more about real-world security than a month of any course, because this is the actual terrain. synthetic challenges are a model of this. this is the thing itself.

programming

you have to be able to write code. not because you'll write exploits from scratch every day, but because programming is how you learn to think about systems precisely, and because automation is leverage. a hacker who can't program is a person reading other people's tools and hoping.

three languages, and again, the why matters more than the list:

python, because it's the duct tape of the security world. it gets out of your way. when you need to script a quick attack, parse a weird file, brute-force something, talk to an api, python is the shortest path between an idea and a working thing. half the security tools you'll ever use are written in it.

javascript, because the web runs on it and you cannot meaningfully attack web apps while being scared of the language they're written in. you don't have to love it (nobody loves it). you just have to read a minified bundle without panicking, understand what a fetch call is doing, and write your own to poke at an endpoint. the browser is the battlefield and js is the local language.

go, a bit later, when you start caring about building real tools. compiles to a single binary, fast, does concurrency without making you cry, and a huge chunk of modern security tooling (scanners, recon tools, the stuff that has to be fast and parallel) is written in it. when your python script is too slow to scan ten thousand hosts, go is the answer.

but here's the actual point, the one i'll repeat until you're sick of me: learn these by building, not by coursing. do not watch a 12-hour "python full course." you'll feel like you learned python and you'll have learned nothing, because watching someone code is to coding what watching someone swim is to swimming. pick something you want to exist and claw it into existence using whatever language fits. the language is a side effect of the project. which brings me to the most important section in this whole post.

build weird things

if you take one thing from these several thousand words, take this: you learn security by building, not by consuming.

there's an entire ecosystem online designed to make you feel like watching is learning. tutorials, courses, "full roadmaps", 47-minute videos titled "EVERYTHING you need to know about web hacking". people binge this stuff, feel productive, and stay exactly as capable as before, because consumption is comfy and building is scary. building means you might fail in a way you can see. a video never makes you feel stupid. a bug that won't die at 2am makes you feel very stupid, and that feeling is the actual sensation of learning. i'm sorry. i don't make the rules.

i cannot stress this enough: the future hackers who are gonna be good are the ones building things right now, and the ones who won't be are the ones with 200 saved tutorials they'll never open.

why does building work when watching doesn't? because building forces you to confront how things actually work, not how they work in the clean example. when you build a thing you have to make a hundred tiny decisions the tutorial glossed over, and every one of those decisions is a place where, on someone else's app, a vulnerability lives. you can't develop intuition for how systems break until you've felt how annoying they are to make correctly.

you wanna understand auth bugs? build a login system. you'll immediately feel the pull toward the easy, wrong thing: trust the client, skip a check, stash the secret somewhere convenient. now multiply that temptation by every tired developer on every deadline and congrats, you understand where like 80% of real vulns come from. they come from someone taking the shortcut you were just tempted to take.

here's a non-exhaustive pile of things to build, roughly sorted by how much they'll teach you:

a discord bot. silly, fun, immediate. you'll learn apis, tokens, async, deployment, and "oh no i committed my token to a public repo and a crypto miner grabbed it within four minutes" (a rite of passage... leak a secret once, learn forever).

a browser extension. you'll learn how pages actually work, how to inject and read scripts, what the browser lets you touch and what it doesn't and why. it's offensive web security wearing a friendly little hat.

a scraper. pick a site, pull data off it. you'll learn HTTP for real, hit rate limits and bot detection, and have to think about how sites try to stop you, which is exactly the attack-and-defence mindset, just legal and boring enough that nobody minds.

your own website, from scratch, hosted yourself. (this blog is one. it's just markdown and a static site generator and a lot of opinions.) you'll touch DNS, TLS, servers, deployment, all the networking stuff above, except now it's real and breaking and yours.

apis, automation scripts, tiny recon tools. a thing that takes a domain and finds its subdomains, a script that watches a site and pings you when it changes, some little tool that does one annoying thing you currently do by hand. build the security tools you wish existed, even badly, even if better ones already exist. the point was never the tool. the point is that building it rewired your brain.

i built Quark because reading about browser fingerprinting felt like reading about how to ride a bike. i wanted to feel it. so i built the thing that does the tracking, and now i understand it in my body, not just my notes. that's the difference building makes. it moves knowledge from "i read that once" to "i made that happen."

build embarrassing things. build things that already exist. build things that don't work. the repo full of half-finished weird projects is worth more than the certificate, every single time.

ctfs are kinda dead (and that's fine)

right, the spicy one. let me be careful here because i'm about to annoy a chunk of the security community and i wanna be precise about what i'm actually claiming.

for a long time CTFs (capture the flag competitions) were the gold standard for learning offensive security. and for good reason! a good CTF taught you fundamentals by force: you couldn't get the flag without genuinely understanding the bug. they taught problem-solving, the specific kind where you stare at something for three hours and try forty things and the forty-first works. and maybe most importantly they built communities. some of the best hackers i know met their closest friends grinding CTFs at 4am on a team discord. the culture, the in-jokes, the shared suffering of a brutal pwn challenge, that stuff was real and it mattered.

i'm not here to spit on any of that. i learned a lot from CTFs. if you love them, keep playing them, genuinely.

but something changed, and pretending it didn't is just dishonest.

ngl, a lot of beginner CTFs feel a little weird in 2026 when Claude can casually solve half of them. we've got GPT-5-class systems, Claude, Gemini, open-weight reasoning models you can run on your own machine, and a growing fleet of autonomous security agents, and these things can now chew through large chunks of beginner and intermediate challenges. not all of them. but a lot more than people are comfortable admitting out loud.

think about what a CTF challenge actually is. it's a small, self-contained, solvable puzzle. someone designed it to have an answer. it's bounded. the flag exists, guaranteed. and that bounded, puzzle-shaped quality (the exact thing that made CTFs good teaching tools) is also exactly what makes them tractable for a model that's seen ten thousand near-identical puzzles.

web challenges of the cookie-tampering, basic-injection, hidden-endpoint variety? increasingly automatable. baby crypto, the "spot the reused nonce, recognise the textbook RSA mistake" tier? a model trained on every crypto writeup ever published eats these for breakfast. simple reversing, the "decompile this and read the logic" kind? agents are getting genuinely good at it. forensics, grep the pcap, carve the file, decode the layers? a lot of it is mechanical, and machines love mechanical.

i'm not saying a model wins DEF CON CTF finals tomorrow. the hard, novel, genuinely creative challenges still demand human insight and the top-tier comps are an arms race that's nowhere near settled. but the beginner-to-intermediate band, the part most learners treat as the proving ground, the part where you "git gud"... a meaningful slice of that can now be brute-forced by pointing a decent model at it.

which forces an uncomfortable little question. if a challenge can be solved by an agent, what exactly did you prove by solving it?

and here's where i land, and this is the actual point of the section. the value was never "can you solve this challenge". that was always a proxy. the value is, and now has to be, "do you understand WHY the solution works."

a model can hand you the flag. it cannot hand you understanding. you can let an agent solve a web challenge and learn nothing, same way you can copy a stackoverflow answer and learn nothing. or you can let it solve the thing and then refuse to move on until you understand every step: why that payload, what assumption it violated, what the developer believed that wasn't true. one of those people becomes a hacker. the other is unemployed in five years holding a stack of solved challenges that prove nothing.

so use CTFs differently now. not as a score to maximise. as a source of worked examples to understand deeply. the flag isn't the trophy anymore. the explanation is.

and there's a deeper reason the old model is cracking, which is this: real-world systems are dramatically harder than synthetic challenges, and they always were. a CTF challenge is a clean room. someone built it to be solvable, stripped the noise, guaranteed a path. real systems are the opposite: enormous, undocumented, half-broken, full of dead code and cursed legacy decisions and three login systems from three different eras stacked on top of each other. there's no guarantee a vuln even exists. there's no flag confirming you got it right. there's just a giant, hostile, indifferent mess that nobody fully understands, including the people who built it.

the CBSE portal wasn't a CTF. nobody designed it to be solved. the bugs were real, the data was real, the stakes were real, and there was no scoreboard telling me i'd found the right thing. that's a completely different skill from grinding challenges, it's the skill that actually matters, and it's the one no model can fully do for you yet because it needs judgement about a system that exceeds anyone's full understanding.

CTFs taught a generation their fundamentals. huge respect. but the thing you were training for (the bounded, solvable puzzle) is exactly the thing machines are now eating. the world doesn't have flags in it. go learn the messy thing.

the rise of agentic hacking (sorry)

let me tell you what offensive security actually looks like in my workflow now, because the change over the last couple years has been faster than anything i've seen, and most "how to become a hacker" content hasn't caught up at all. it's still teaching 2019.

i'm not gonna do the hype thing or the doom thing. both are lazy. the "AI will replace all hackers" people and the "AI is useless slop, real hackers don't touch it" people are both wrong, and both are mostly performing for an audience. the truth is more interesting and more demanding than either.

here's the reality: half the hackers i know have Claude Code open somewhere. usually next to 37 browser tabs and a terminal they forgot about. tools like Claude Code, Codex, and the whole agent ecosystem around MCP have turned the LLM from a thing you ask questions into a thing you can point at a system and turn loose. that's a categorical shift. a chatbot answers. an agent acts: reads files, runs commands, navigates, iterates, comes back with findings.

what does that mean concretely? a modern recon-and-assessment pass on a web target might go like this. an agent crawls the site and maps what's there. it enumerates endpoints: the api routes, the hidden paths, the things not linked from anywhere. it pulls down the javascript bundles and reads them, all of them, in the time it'd take me to pretty-print one, surfacing the interesting function names and the suspicious calls and the commented-out admin route someone forgot about. it sketches the attack surface: here's where input goes in, here's what looks like it trusts the client, here are three endpoints that smell like they skip authorisation.

and then the human steps in. i look at the promising leads. i decide which of the smells is real. i do the part that needs judgement and creativity and a theory of what the developer was probably thinking when they cut the corner.

notice the division of labour. the agent does breadth: the tireless, mechanical, read-everything, miss-nothing grind that humans are bad at and bored by. the human does depth: the "wait, that's interesting, what if i combine it with the other thing" leap the agent can't reliably make. recon, endpoint mapping, reading mountains of js, first-pass code review across a huge codebase: this is exactly the work i used to do by hand for hours, and it's exactly the work that's now mostly delegable.

i wanna be honest about the limits though, because the hype merchants won't be. agents hallucinate vulns that aren't there. they confidently report bugs that don't reproduce. they miss the obvious thing while chasing a phantom. they have no real model of impact. they'll flag a self-XSS like it's the end of the world and stroll right past the architectural IDOR that actually matters. point one at a real target with zero supervision and you'll get a report that's 30% gold and 70% confident nonsense, and the dangerous part is that the nonsense is confident. you still need the human who can tell which is which. if anything that filtering skill is now more valuable, not less.

so here's the take, the one i actually believe: the future hacker isn't the person who refuses to use AI. it's the person who understands systems deeply enough to direct it.

the refusers are basically insisting on hand-computing what a calculator does and calling it discipline. cute, but they're gonna get out-shipped by someone who understands the same systems and commands a fleet of agents to do the grunt work. and the people who only have the AI, who can prompt but can't tell gold from nonsense, who don't understand the systems well enough to know when the agent is lying to them, they're gonna ship garbage at scale and never figure out why none of their findings hold up.

the spot to aim for is the intersection. deep understanding plus leverage. you become the person who knows exactly what to look for and has tireless little robots to go look for it. the robots find the haystack. you're the one who recognises the needle, because you've spent years learning what needles look like by building haystacks yourself.

this is genuinely the most exciting time to be getting into this, and i mean that with zero linkedin-influencer in my voice. the grunt work that used to gatekeep the field (the tedium that made people quit before they got good) is increasingly handled. what's left is the interesting part. but the interesting part still requires you to actually understand things, which is why the rest of this post is about understanding things and not about prompts.

roughly how i'd actually do it

i'm not gonna give you a month-by-month plan. i spent this whole post dunking on those and honestly i'd be lying if i pretended i ever followed one. nobody does. you'll get nerd-sniped by something in week two and vanish into it for a month, and that's the good outcome, not a detour.

so here's the honest version. two loose phases. no deadlines, no gantt chart, no "by week six you should". move when it feels right, not when a calendar tells you to.

phase one is just getting comfy with computers. put linux on your machine and actually live in it. spend time in the terminal until it stops feeling like a foreign language. learn networking by poking at it: dig some stuff, open wireshark and watch packets fly, stand up a tiny server and connect to it. and learn to program by building three real things, not by watching a course: a dumb discord bot, a scraper for a site you use, a script that murders some annoying chore you do by hand. the whole point of this phase is that the machine stops being a black box. you should come out the other side able to explain, without hand-waving, what actually happens between typing a url and seeing the page load.

phase two is when you start breaking things. build a real web app first (frontend, backend, a database, a login system, deployed somewhere public) because you cannot break what you've never built. feeling the pull toward the lazy insecure shortcut while writing your own auth teaches you where basically every web vuln on earth comes from. then go through PortSwigger's Web Security Academy properly; it'll hit completely different now that you've felt the temptations from the inside. then go touch real code: read open source projects you use, fix bugs, notice the security ones while you're in there (that's how i found most of the FOSS United bugs, just reading). and then go find a real bug in a real thing you're allowed to test, and write it up. the first time you find something live it feels illegal even when it isn't. that feeling means you've crossed over.

that's the whole roadmap. two phases and a refusal to rush. everything else is just doing it long enough that it stops being something you're learning and starts being who you are.

the mega resource dump

ok. i held off on links the whole post because people hoard resources as a substitute for doing the work and i didn't wanna feed that. but i also know if i end here with nothing concrete, half of you close the tab and nothing changes. so. here's the dump. the real one. everything i'd shove into a younger version of myself's bookmarks bar.

warning before you scroll: this is a lot, and you are not supposed to do all of it. nobody has. it's a menu, not a syllabus. pick the one thing that makes you curious right now, go deep, ignore the rest until it taps you on the shoulder. the person who finishes one of these properly beats the person who bookmarks all forty.

almost everything here is free. a ★ means i personally love it and would defend it in a discord argument at 3am. ok let's go :3

linux + living in the terminal

you can't break computers you don't understand, and understanding kinda starts here.

networking: how the internet actually moves

please don't start with a 40-hour OSI lecture. start with the bits that break.

programming: by building, not coursing

web: the big one (and where i live)

most of you came for this. it's also where the free stuff is genuinely world-class, so no excuses.

reverse engineering: what does this binary even do

you don't have the source. you have a blob. you make the blob confess. weirdly addictive.

binary exploitation (pwn): the deepest, meanest rabbit hole

memory corruption, shellcode, smashing stacks. the hardest category. also the most "i am a literal wizard now" feeling when it finally clicks.

crypto: math puzzles wearing a hoodie

forensics & stego: digging stuff out of files, memory & traffic

half of this skill is just knowing the tools exist. so. now you know.

osint: finding things from public breadcrumbs

my soft spot, ngl. you'd be terrified how much of someone's life is just... sitting there, if you know where to look.

hacking with AI (and hacking AI itself)

the new sector. the one nobody's old roadmap has. half the people i know already hack with an agent in the loop, and pretty soon you'll also be hacking the agents. both halves below.

the reading list: this is the one that actually matters

if i could force-feed you one category it's this. reading how real bugs get found rewires your brain in a way no lab can.

staying current: news, feeds & people worth following

security moves fast, and twitter rots your brain (more on that later), so curate hard. a few channels and feeds that are worth the noise:

practice: where to actually break things

reading isn't enough. you need targets you're allowed to hit.

little reminder: in 2026 a model can solve a chunk of the easy stuff. so don't farm these for points. use them as worked examples and refuse to move on until you get why it works.

going deep: primary sources

for when you're past tutorials and want to actually be dangerous (legally).

communities: find your people

ctf resources (because you'll want these anyway)

i spent a whole section saying CTFs aren't the gold standard anymore. i stand by it! but they're still genuinely fun and they still teach you things, so if you're gonna play (and you should, for a while) here's the CTF-specific stuff. the per-flavour training (web, crypto, pwn, rev, forensics, osint) is all up in the dump above; CTFs just remix those into puzzles. hehe.

where to actually find them

wargames: always-on, learn-at-your-pace

CTFs are time-boxed events. wargames just sit there forever, level by level, perfect for actually learning.

the little ctf-goblin toolkit

stuff you'll reach for in basically every comp, whatever the flavour.

people who explain their work

fastest way to get better at CTFs: watch good players think out loud.

that's the dump. it's genuinely too much and that's fine, it's a thing to come back to, not a to-do list to grind. bookmark it, pick one thing, go. the bottleneck was never the resources. the bottleneck is doing the work, and no link fixes that. <3

things nobody tells you

here's the part the roadmaps leave out entirely, because it's not technical and it doesn't sell courses. but it'll decide whether you last, and lasting is the whole game, so pay attention.

you will burn out. probably more than once. this field has a culture of glorifying the grind, the no-sleep, the 16-hour CTF weekends, the "real hackers don't touch grass". it's nonsense, and worse, it's a trap. i've hit walls where i couldn't look at a terminal for weeks. that's not failure. that's a human running out of fuel. the people who last aren't the ones who grind hardest, they're the ones who learned to step away and come back, who treat their curiosity as something to protect rather than something to set on fire for clout. rest is part of the work. your brain solves the hard bugs in the shower, not at hour fourteen. i learned this one the hard way too.

comparison will eat you alive if you let it. you'll see someone your age with a CVE, a conference talk, a bug bounty hall of fame, a job at a company you've heard of, and you'll feel like garbage. i've felt it. everyone's felt it. the thing to remember is you're comparing your behind-the-scenes to their highlight reel. you don't see their dead months, their failed projects, their imposter terror. you see the trophy, never the years of nothing that came before it. run your own race. the only useful comparison is to who you were six months ago.

imposter syndrome doesn't go away, you just get used to carrying it. i had this blog on the front of national news, government bodies replying to my findings, and i still sometimes feel like i'm faking it and someone's about to find out. here's what i've made peace with: the feeling of not knowing enough is just what learning feels like from the inside. if you feel like an imposter it means you're standing at the edge of your knowledge, which is exactly where you're supposed to be. the people who feel totally confident usually just stopped growing.

certs are not the thing. they can help you past an HR filter and that's a real, legitimate use, so i won't tell you to never get one. but chasing certs as your learning strategy is a way to feel like you're progressing while collecting expensive PDFs. i don't have a wall of certs. i have a wall of things i broke and built and wrote up. both are valid paths to a job. only one of them actually makes you good. don't confuse the credential with the capability.

clout is poison in slow motion. there's a whole economy now of hacker influencers optimising for followers, for the viral thread, for the dunk, for the engagement. it's seductive. i had a taste of going semi-viral and it's a genuine dopamine drip, i won't lie. but the second you start choosing what to learn based on what'll get you retweets, you've stopped being a hacker and started being a content creator who uses hacking as a backdrop. the work and the performance of the work are two different jobs. pick the work.

twitter (sorry, "X") will rot your brain if you let it become your main input. security twitter has real value, i've learned a lot and met great people there. but it's also an endless stream of hot takes, drama, doomposting, and people being confidently wrong at high volume. it optimises for outrage, not understanding. use it as a feed of interesting links and people, then close the tab and go read the actual thing. don't let the timeline replace the terminal. the brainrot is real and it comes for everyone.

vanity metrics lie. followers, points on a platform, rooms completed, streak counters, badges. these are designed to be addictive, not meaningful. i've seen people with massive HTB stats who couldn't find a real bug in a real app, and quiet people with no online presence who are terrifyingly good. the numbers measure your engagement with the gamified version of the thing, not your skill at the thing. watch yourself for the moment you start farming a metric instead of learning, and when you catch it, stop.

the meta-lesson under all of these: protect your curiosity like it's the only non-renewable resource you've got, because for this work it basically is. everything else (burnout, comparison, clout, metrics) is just a way of accidentally killing the one thing that made you good in the first place. guard it.

there is no roadmap

so after all of this (the linux, the networking, the building, the dead CTFs and the rise of the agents, the two neat phases i told you to abandon) here's where i actually land.

there is no roadmap. there never was. i made one up for you a few sections ago and the most honest line in it was the part where i told you to throw it away.

there is only curiosity. that's the whole secret, and it's annoying because it can't be packaged or sold or turned into a notion template. every single thing i know, i learned because i couldn't leave something alone. not because a curriculum told me to. because a ?id=1 in a url was right there and i had to know what ?id=2 did. because a javascript bundle was sitting in the network tab and reading it felt like reading someone's diary. because a system existed and i needed to know how it worked badly enough to lose a night finding out.

that's all it is, in the end. clicking the thing you're not sure you should click. reading code you don't understand yet until you do. opening devtools on a site you use every day just to see what it's hiding. following the rabbit hole at midnight when you should be asleep, and then following the rabbit hole inside that rabbit hole. asking weird little questions that start with "wait, what happens if..." and refusing to let them go.

the best hackers i know aren't checklist-followers. they never were. they're explorers. they're the kind of people who, handed a locked door, feel a genuine physical itch to know what's behind it. not to steal anything, just to know. the certs and the tools and the roadmaps are scaffolding around that itch. take away the itch and the scaffolding holds up nothing.

the world is the most open it's ever been. the best learning resources are free. the tools have never been more powerful. there are tireless little agents now willing to do the grunt work that used to make people quit before they got good. everything that used to gatekeep this field is falling away, one piece at a time. the only thing left standing in your way is whether you actually want to know how things work. and that part was always up to you.

so stop reading roadmaps, including this one. stop saving tutorials you'll never watch. stop waiting for permission or a plan or the perfect course. open something. look at it. wonder about it. break it, gently, on something you're allowed to break.

the internet has a basement. almost nobody bothers to go down there anymore. grab a flashlight and go look. the door was never actually locked, and the people who go down anyway are the only ones who ever find anything worth keeping.

note: the original draft for this post was handwritten by me, the draft has been refined through claude opus 4.8 before being published.