Learning offensive security: where to start

Offensive security consists in looking for the flaws of an information system before someone with bad intentions finds them. It is a professional activity, it rests on ordinary computing knowledge, and it is practiced within a strict legal framework.

This guide describes a complete learning path, from the first day to the first assignment. For each stage, it states three things: what is learned, how you check that you have learned it, and where to work on it on this site.

One point before everything else: testing a system without the written authorization of its owner is a criminal offense in France. This rule is not a footnote; it governs the whole path that follows.

What "offensive security" means, and what it does not mean

The expression covers four distinct activities. They call for different skills and do not come into play at the same moment of an assignment.

• Vulnerability research: taking an inventory of what is exposed — machines, services, applications, accounts — then comparing that inventory with known flaws and configuration errors.
• Exploitation: demonstrating that an identified flaw really does allow an unintended action, such as reading a piece of data, obtaining access or bypassing a control. As long as the flaw has not been demonstrated, its real impact remains a hypothesis.
• Social engineering: obtaining from a person a piece of information or an action that they would not have granted knowingly. This human aspect is governed by the mandate in the same way as the rest.
• Writing the report: describing the findings, ranking them by impact, proposing corrections that can be applied. It is the only deliverable that the client keeps after the assignment.

What offensive security is not: a collection of tools. A tool produces an output; interpreting that output is the responsibility of the person who ran it. A test carried out without understanding the system being targeted produces an unreadable report, often a wrong one, and sometimes an outage.

Nor is it a discipline separate from defense. A flaw cannot be qualified without knowing what a properly maintained system should do. The shared vocabulary — threat, risk, vulnerability, scope, clearance — is set out in the guide on the information system security concepts, to be read before going further.

The French legal framework, article by article

The criminal code deals with these acts in articles 323-1 to 323-3, under the notion of "système de traitement automatisé de données" (automated data processing system), abbreviated to STAD. A STAD means any combination of hardware and software that processes information: a company server, a website, an industrial controller, a personal telephone.

• Article 323-1: fraudulent access to an automated data processing system, and fraudulently remaining in such a system, are punishable. The penalty is increased when the intrusion leads to the deletion or modification of data, or to the impairment of the operation of the system.
• Article 323-2: hindering the operation of a system, or distorting it, is punishable. Deliberately saturating a service falls under this text.
• Article 323-3: the fraudulent introduction, extraction, holding, reproduction, transmission, deletion and modification of data in a system are punishable.

The penalties incurred are increased when the system targeted processes personal data and is operated by the State. No amount is reproduced here: these figures have already been changed in the past, and the text in force can be consulted on the official French legal publication website.

One point deserves to be stated plainly: "I only had a look" is not a defense. Fraudulent access is established by the mere fact of entering without the right to do so, regardless of what is done afterwards; remaining in the system is a separate offense, which means that staying connected after understanding that you should not have entered is an additional act. A default credential left in place, an administration page reachable without a password, a directory listed by mistake: the owner's negligence never amounts to authorization.

The same chapter of the criminal code also covers making available, without a legitimate reason, means designed to commit these offenses. The text expressly reserves the legitimate reason, in particular research and information security: holding an analysis tool as part of learning or of an assignment is not at issue. It is use without a mandate that is.

What a valid authorization contains

An authorization is not a message saying "go ahead". It names the client and the authorized person, delimits the scope by network addresses and domain names, sets the dates and the time slots, frames or forbids destructive actions, provides for an immediate stop procedure with a contact who can be reached, and carries the signature of someone who has the authority to commit the organization. Pay attention to the real scope: the owner of a service is not always the party hosting it, and hosting by a third party often requires an additional authorization.

Working rule: without a signed document describing the scope and the period, there is no test. A doubt about the scope is cleared up beforehand, never during.

Outside an assignment, reporting remains possible. A person who discovers a vulnerability in good faith may pass it on to the national authority responsible for information systems security, whose contact details appear on cyber.gouv.fr. Individuals and small organizations that are the victims of an incident will find an assistance procedure on cybermalveillance.gouv.fr. Reporting does not authorize you to continue testing in order to "confirm".

First foundation: systems

An operating system grants rights, runs processes, opens services and writes logs. These are exactly the four mechanisms that offensive security examines at all times. Without this base, the output of a scanning tool means nothing.

• The terminal: moving through the directory tree, reading and modifying a file, chaining commands, consulting a manual page rather than a search engine.
• Rights: user, group, owner, read, write and execute permissions, temporary privilege elevation and the traces it leaves.
• Processes and services: what is running, under which identity, started by which mechanism, listening on which port.
• Logging: where events are written, what they contain, and above all what they do not contain.
• Virtualization: virtual machine, snapshot, isolated network — enough to break an entire installation without consequence for your own computer.

Mastery criterion. You hold this foundation when, on a Linux machine you are discovering, you are able to answer without looking anything up: which accounts exist, which services are listening on the network, under which identity they run, and where their logs are. A second criterion, just as verifiable: you know how to go back to an earlier snapshot of your virtual machine without hesitating over the procedure.

Where to learn it on this site. The first steps are taken with the guide to the Linux command line, which starts from opening a console. The practice laboratory is set up by following the creation of a virtual machine. To cover the whole — users, services, logs, backups — the Linux Administration course goes through this foundation in order.

Second foundation: networks

The findings of a penetration test relate first of all to what travels and to what is exposed. A network flaw is qualified by naming the layer concerned, not by citing a tool.

• Layered models: the OSI model (Open Systems Interconnection) and the TCP/IP stack (Transmission Control Protocol / Internet Protocol), in order to know at which level a problem is situated.
• Addressing and routing: IP address, mask, subnet, gateway, routing table, address translation.
• Resolution: ARP (Address Resolution Protocol) on the local network, DNS (Domain Name System) for machine and domain names.
• Application protocols: HTTP (HyperText Transfer Protocol), its headers and its return codes; TLS (Transport Layer Security), the certificate presented and what it proves exactly — the link between a domain name and a public key, attested by a certification authority, and nothing more: neither the identity of the organization behind the service, nor its honesty.
• Traffic capture: reading a frame, following a complete conversation, telling an anomaly apart from noisy but normal operation.

Mastery criterion. You hold this foundation when you are able to describe, without notes, the complete journey of a request to a website — name resolution, establishment of the connection, TLS negotiation, request, response — and to name at each stage what a third party placed on the path can observe, and what it cannot.

Where to learn it on this site. The guide on the basics of the OSI model deals with the seven layers one by one and follows the journey of an HTTP request. The TCP/IP Networks course establishes addressing and routing. On the practical side, the hands-on activities in network security put name resolution, established connections and traffic capture into practice. The reading on network attacks then classifies these flaws by nature: protocol, implementation, configuration.

Third foundation: programming

The point is not to become a developer. The point is to read code before writing any, and to automate repetitive tasks without depending on a ready-made tool.

• Algorithmics: conditions, loops, functions, and the idea of the cost of a piece of processing when the volume grows.
• Data structures: list, dictionary, set, tree; knowing which one suits which need.
• A scripting language, a single one to begin with: processing a results file, querying a web interface, chaining checks.
• Reading code: following the journey of a piece of data supplied by the user, from its entry to its use in a query, a command or a displayed page.
• Common flaws: unchecked input, SQL injection (Structured Query Language), output displayed without escaping.

Mastery criterion. You hold this foundation when you read a script written by someone else and can say what it does, which inputs it expects and how it would behave on an unexpected input — all this before running it. Running a script found online without having read it is, in itself, an incident waiting to happen.

Where to learn it on this site. The hands-on activities in secure development put two classic flaws into practice in a web environment: a form whose input is not sanitized, then a database query built by concatenation. Correcting them yourself is the best way to learn to spot them in the work of others.

Fourth foundation: the human factor

An organization that is technically well maintained can still be attacked through its procedures and its habits. This foundation is not a decorative addition: in a penetration test, it often produces the most serious findings.

• Phishing: a message imitating a legitimate sender, in order to obtain a credential or to have an attachment opened.
• The pretext: a credible scenario that justifies an unusual request — troubleshooting, internal audit, an emergency coming from management.
• Public traces: organization charts, job offers detailing the technologies used, documents left accessible, a predictable format for email addresses.
• Organizational weaknesses: an exception procedure that is never recorded, a contractor account that is never closed, a password passed on verbally, the absence of a clear channel for reporting a doubt without being blamed for slowness.

Mastery criterion. You hold this foundation when you are able to explain to a non-technical person why a particular message is fraudulent, by pointing to observable elements — the sender's real domain, the gap between the displayed text of a link and its destination, pressure on the deadline — and not by a general impression.

Where to learn it on this site. The guide devoted to protection against cyber threats sets out these markers on concrete cases. The Cybersecurity Awareness course covers the same ground from the point of view of the person who has to train others, which is the real position of an offensive security professional once the report has been delivered.

Where to practice without leaving the legal framework

There are only three lawful practice situations: equipment that you own, a target for which you hold a written authorization, or an environment made available for this purpose by the party operating it. Everything else, whatever the intention, falls under the articles cited above.

On this site

The hands-on labs provide machines made available for the exercise, including a session that opens a complete workstation in the browser without installing anything. The Introduction to Pentesting course then goes through the phases of an assignment in this environment: scoping, reconnaissance, manual verification of the results, writing. Authorization is acquired there by construction: the targets are provided for that purpose.

On your own equipment

A personal laboratory is built with a hypervisor, two or three virtual machines and an isolated virtual network. Two rules are not to be circumvented: the deliberately vulnerable machine is never exposed on the Internet, and it is never placed on the same network as the devices of the household. Taking a snapshot before each operation turns an irreversible mistake into a ten-minute loss.

No outside practice platform is named here, and the choice is yours. The selection criterion is simple: the platform's rules must explicitly designate the authorized targets and the permitted actions. A machine found on the Internet because it "looks like" an exercise is not an exercise.

The job roles, without folklore

The job titles vary from one organization to another, but the real activities fall into a few families.

• Penetration tester: carries out assignments delimited by a mandate. Daily work is made up of preparation, time-stamped note taking, manual verification of automatic results that are often wrong, and above all writing — a report that can be read by a non-technical manager and acted on directly by a technical team.
• Analyst in a security operations center, or SOC (Security Operations Center): handles the alerts raised by monitoring, sets aside the false ones, qualifies the real ones, triggers the response and passes it on. A role of method and rhythm, frequently on shift work.
• Detection engineer: writes and corrects the rules that produce these alerts, from the logs collected. Their offensive skill serves to know what an attack looks like once reduced to a few lines of log.
• Vulnerability researcher: works on a product — software, firmware, protocol — rather than for a client. A long rhythm, code reading and reverse engineering, publication framed by a disclosure procedure agreed with the vendor.
• Trainer or awareness manager: builds exercises and materials, then measures what has been retained. Offensive skill is required there in order to remain credible in front of technical teams.

The detection part of these roles is prepared with the Modern Monitoring course: collecting measurements and logs, building dashboards, defining alert thresholds. An attack that leaves no usable trace is not discreet; it is the collection that is incomplete.

On "hats"

The vocabulary of hats — white, gray, black — comes from popularization. It appears on no job description and covers no professional qualification. What it says that is useful fits in one sentence: there are only two situations, with a mandate and without a mandate. The "gray hat", that is to say testing without authorization with the intention of warning afterwards, does not describe a moral nuance but an offense accompanied by a good intention.

In which order, and for how long

An order of progression for a person starting from zero, with the corresponding durations.

1. Two to three months — systems. Terminal, rights, processes, services, logs, and the setting up of the virtual laboratory that will serve for everything else.
2. Two months — networks. Layers, addressing, name resolution, HTTP and TLS, traffic capture on your own laboratory.
3. Two to three months — programming. One scripting language, reading code, the most common input flaws.
4. Continuously — the human factor and writing. These two skills are not worked on in a block: writing a report after each exercise, however short, is the best training available.
5. Only then — offensive tooling and guided exercises. A tool handled after the first three foundations is learned in a few hours; handled before, it teaches nothing.

These durations assume regular work, in the region of five to ten hours a week, and they describe the time needed to reach the mastery criteria stated above, not to "finish" a subject. They do not constitute a promise: two people working at different rhythms will reach the same point on different dates. The only reliable indicator remains the verifiable criterion specific to each foundation.

Counting in hours of hands-on work rather than in months avoids the most frequent mistake among beginners: accumulating courses followed with no machine switched on alongside. A notion is only acquired after having been carried out, failed, then put right.

Points of vigilance and a first concrete step

Five rules of conduct that distinguish a professional practice from an approximate one, and that are acquired from the very first exercises.

• The note taken afterwards does not exist. Record during the action the time, the target, the operation carried out and the result obtained. A finding without a time stamp is not defensible before a client, still less before a judge.
• A test can break something. The mandate provides for a stop procedure and a contact who can be reached; in a practice environment, the equivalent is the snapshot taken before starting.
• Never test from a network that is not yours. The network of an employer, of a training establishment or of a public place is not a starting point, even for an operation judged harmless.
• What is discovered remains confidential. Real data encountered during a test does not leave the report, is not used as an illustration and is not kept "as an example".
• Practice equipment stays locked away. A deliberately vulnerable machine is neither exposed on the Internet, nor connected to the home network, nor left running without reason.

The first concrete step takes one evening: install a hypervisor, create a Linux virtual machine, place it on an isolated network, take a snapshot, then spend a full hour in its terminal without a graphical interface. Start again the following day. After two weeks of this regularity, the question "where to start" will have stopped being asked.

For what comes next, the security guides section brings together the security guides cited here and around thirty others, from encryption to server hardening. The structured path, with corrected exercises and a provided environment, goes through the Introduction to Pentesting course, to be tackled once the first three foundations are held.

This article appeared in March 2023 as a summary of a third-party video, whose name it carried. It was entirely rewritten on September 9, 2026: the outline, the text and the examples are Awoui's own and owe nothing to that work, which is therefore no longer credited. The address changed in the process — the old one leads here.