A comprehensive roadmap for learning Vulnerability Assessment and Penetration Testing (VAPT) from the ground up, covering core concepts, practical labs, essential tools, and projects designed for beginners with foundational cybersecurity and programming skills.
Beginner
120h
vapt
cybersecurity
penetration-testing
vulnerability-assessment
Card legend
Topic
Milestone
Task
Note
Decision
Project
Grouped
- AI Assist
- Progress
Sign in to use AI Assist
Sign In
Proof of Competence
0%
0 / 35 checkpoints declared
0/18 evidence needed for 100% — max 50% without proof
Fundamental Concepts
You can explain the purpose and scope of VAPT and ethical hacking, and identify basic threats
Milestone
Summarize the main ethical hacking laws and standards (written summary completed)
Checkpoint
Create a presentation explaining VAPT phases to non-technical audience
Project
You can explain network protocols and system components relevant to VAPT
Milestone
Use Wireshark to capture and analyze simple network traffic (capture saved)
Checkpoint
Tools and Hands-On Skills
You can install, configure, and run basic scans using popular VAPT tools
Milestone
Perform a network scan with Nmap on a lab environment (scan report saved)
Checkpoint
Set up a personal lab environment with VMs for testing and tools
Project
You can gather and analyze target information to identify attack surfaces
Milestone
Conduct a passive reconnaissance on an assigned target (data report delivered)
Checkpoint
Vulnerability Identification and Analysis
You can perform vulnerability scans and manually enumerate system weaknesses
Milestone
Scan a target system for vulnerabilities and document findings (detailed report)
Checkpoint
Create a checklist/process for validating scan results manually
Project
You can carry out simple exploits and analyze attack impacts safely
Milestone
Successfully exploit a lab VM using Metasploit (access gained and documented)
Checkpoint
Advanced Techniques and Specialization
You can identify and exploit basic web application vulnerabilities
Milestone
Perform a web application pentest on a deliberately vulnerable site (report submitted)
Checkpoint
Build and exploit a basic vulnerable web application for learning
Project
You can produce professional vulnerability reports and remediation plans
Milestone
Write a comprehensive VAPT report for a lab assessment (peer-reviewed)
Checkpoint
Practical Labs and Real-World Application
You can apply VAPT techniques to solve realistic security challenges
Milestone
Complete at least two beginner-level VAPT CTF challenges (solutions documented)
Checkpoint
Design and run a mini-CTF event focused on common vulnerabilities
Project
You can showcase your VAPT skills through a well-organized portfolio
Milestone
Assemble a digital portfolio with at least three documented VAPT projects (published)
Checkpoint
Specialized Tools and Frameworks
You can create and use scripts to automate complex VAPT tasks
Milestone
Develop a custom script that automates a scanning task (tested and documented)
Checkpoint
Build an end-to-end automated VAPT workflow using existing tools
Project
You can explain Red and Blue Team strategies and contribute to simulated exercises
Milestone
Participate in a Red Team vs Blue Team exercise (after-action report completed)
Checkpoint
Capstone and Review
You can conduct a complete VAPT engagement from planning to reporting
Milestone
Complete a full VAPT simulation on a sandbox environment (final report and presentation)
Checkpoint
Lead a team-based VAPT project simulating real-world client engagement
Project
You can create a sustainable personal learning plan and engage with the community
Milestone
Subscribe and actively follow at least three reputable VAPT/security news sources (logs maintained)
Checkpoint