How to Become an Ethical Hacker (For Free)
Every week someone messages me a version of the same question: “I want to get into ethical hacking, but I can’t afford the expensive courses and certifications. Where do I even start?” And every week I give the same answer, which surprises people: the money is not the barrier. The best learning resources in this field are free, and always have been. The barrier is knowing what to learn, in what order, and then actually sticking with it.
I am not going to pretend paid training has no value. It does, and it is literally part of what I do. But you do not need it to start, and you certainly do not need it to find out whether this field is for you. This is the roadmap I would hand my younger self: no paid courses required, just time and consistency.
One warning up front, because it matters more than anything else here: everything below assumes you practise only on systems you are allowed to touch. That is not a formality. It is the entire difference between ethical hacking and a criminal record.
First, understand what the job actually is
Before the roadmap, a reality check, because a lot of people are chasing an image rather than the job.
Ethical hacking is not typing furiously while green text scrolls past. Most of it is patient, methodical, and quiet. It is reading documentation, taking careful notes, trying something twenty times, and understanding why something works rather than just that it does. The exciting “I’m in” moment is real, but it sits on top of hours of unglamorous groundwork.
If that sounds tedious, that is useful to know now. If it sounds satisfying (the puzzle, the patience, the understanding), then you will do well, because that mindset matters far more than raw talent.
Stage 1: The foundations (do not skip these)
This is the stage everyone wants to rush, and rushing it is the number one reason people stall six months in. You cannot hack systems you do not understand. So before any “hacking” at all, build these three foundations.
Learn Linux. Nearly every security tool runs on Linux, and you will live in a terminal. Install a Linux distribution: Kali is the popular choice because it comes with the tools pre-installed, but honestly any distribution teaches you the fundamentals. Get comfortable moving around the filesystem, managing files, understanding permissions, and using the command line for everyday tasks. The free resource here is simply using it: make Linux your daily driver for a month and you will learn more than any course could teach you. My command-line tools guide covers the specific commands worth knowing.
Learn networking. Hacking is, at its heart, about how machines talk to each other and how that conversation can be manipulated. You need to genuinely understand IP addresses, ports, the TCP/IP model, DNS, and especially how HTTP works, because the web is where most of the action is. Professor Messer’s free Network+ videos on YouTube are a superb, completely free grounding in this. Do not memorise. Understand. When you can explain what happens between typing a URL and seeing a page, you are ready.
Learn a bit of programming. You do not need to be a software engineer, but you need to read code and automate small tasks. Python is the standard choice: readable, everywhere in security, and endlessly documented for free. Learn enough to write a simple script, parse some text, and understand what a program is doing. Being able to read code is what lets you understand vulnerabilities instead of just running other people’s tools.
These three take a few months if you are consistent. They are not exciting. They are also completely non-negotiable, and the people who honour them race ahead of the people who skip them.
Stage 2: Learn the actual security concepts
With the foundations in place, you can start learning security proper. And here is where the best free resource in the entire field lives.
TryHackMe. This platform is built for exactly this moment. It offers guided “rooms” that teach a concept and then let you practise it immediately on a machine you are authorised to attack. The free tier is generous, and the beginner paths hold your hand through the awkward early stage where nothing makes sense yet. Start here. Work through the introductory pathways in order. This is the single best thing a beginner can do.
PortSwigger Web Security Academy. If web application hacking interests you (and it should, because it is where much of the industry and most bug bounties live), this free resource is world-class. It is made by the people who build Burp Suite, it explains each vulnerability clearly, and every lab is legal to break. Work through it alongside the OWASP Top 10, which is the free, canonical list of the most important web weaknesses to understand.
OWASP, generally. The Open Worldwide Application Security Project publishes an enormous amount of free, high-quality material. Their guides, cheat sheets, and testing methodologies are used by professionals daily. It is all free, and it is genuinely excellent.
At this stage you are learning what the vulnerabilities are and why they exist. That understanding is the thing employers and bug bounty programmes actually pay for.
Stage 3: Practise until it is second nature
Knowledge you cannot apply is trivia. Stage 3 is where you turn understanding into skill, and it is all about hands-on repetition.
Hack The Box. Once TryHackMe’s guided style starts to feel too gentle, Hack The Box is the natural next step. It offers realistic machines with far less hand-holding: you get an IP address and have to figure out the rest, which is exactly what a real engagement feels like. It is frustrating at first. That frustration is the learning. Push through it. There is a free tier with plenty to work on.
Build a home lab. You do not need expensive hardware: free virtualisation software lets you run vulnerable machines on your own computer, completely offline and completely legal. Download deliberately vulnerable virtual machines from VulnHub, or set up targets like OWASP Juice Shop and DVWA (Damn Vulnerable Web Application). A home lab is your private playground where you can break anything without consequences. Every professional has one.
Write things up. When you solve a machine or learn a technique, write a short explanation of how it worked, even if only for yourself. Explaining something forces you to actually understand it, and a public write-up doubles as evidence of your skill when you start job hunting. This is a free habit that pays off enormously.
The pattern here is simple and it is the whole secret: learn a concept, then immediately practise it on a legal target, then explain it. Repeat forever. That loop, done consistently, is how everyone in this field got good.
Stage 4: Go real (and legal)
Once you can reliably work through practice machines, you are ready to apply your skills to real targets, the right way.
Bug bounties. Companies run programmes that pay you to find and report vulnerabilities in their systems, with their permission and inside a defined scope. This is real hacking, on real targets, that is completely legal because you are authorised. It is also humbling at first. Real targets are harder than lab machines. Do not expect quick money; expect a steep, real education. Start with the bug bounty roadmap, which walks through how to begin without getting discouraged.
Keep learning constantly. Security moves fast. New techniques, new vulnerabilities, new tools appear all the time, and the people who stay good are the ones who keep a finger on the pulse. Following researchers, reading disclosures, and watching what is being found keeps you current. It is a big part of why I built KeepLooped, to make that stream easy to follow in one place.
Picking a direction (eventually)
Early on, breadth is good: try a bit of everything so you learn how the pieces fit together. But at some point “ethical hacking” splits into specialisms, and choosing one is how you go from competent to genuinely good. You do not have to decide now, but it helps to know the map.
Web application security is where most bug bounties and a large share of jobs live. If the Burp Suite and web-vulnerability material clicks for you, this is a strong, accessible path with endless free practice.
Network and infrastructure testing is the world of service enumeration, internal networks and corporate directory systems. It suits people who enjoy the systems-and-plumbing side of computing.
Other branches (mobile, cloud, wireless, hardware, and the human side in social engineering) each go deep in their own direction. You will brush against all of them; one will usually pull at you more than the rest. Follow that pull.
There is no wrong first specialism. You can always move sideways later, and the foundations you built in Stage 1 carry across all of them.
Build proof, not just skill
Here is something the free path makes easy to neglect: skill nobody can see is hard to get hired on. As you learn, leave a trail of evidence behind you.
Keep your lab write-ups public. Put small scripts and tools on a public code profile. Note the platforms you have made progress on. None of this is bragging: it is the portfolio that lets an employer or a client believe you can do the work before they have ever met you. In a field that leans on demonstrated ability more than paper qualifications, that visible track record is often what opens the first door.
And do not underrate the unglamorous skill of writing clearly. Finding a vulnerability is only half the job; explaining it so someone can understand and fix it is the other half, and it is what separates a report a client acts on from one they ignore. The people who can do both (find the flaw and communicate it) are the ones who get paid well.
About certifications and paid training
Let me be honest about where money does help, since I have told you it is not required to start.
Certifications and structured courses do two things well: they give you a defined path so you are not guessing what to learn next, and they give you a credential that gets you past HR filters when applying for jobs. Some practical certifications also genuinely sharpen your skills through their exam format. That value is real.
But, and this is the point of the whole article, none of it is a prerequisite for learning. Build the foundations, grind the free labs, do the write-ups, and you will have real skills long before you spend anything. Then, if and when you decide to invest, you will do so from a position of knowledge, not confusion.
Where paid learning is worth it for most people is not the content but the mentorship: someone to answer your questions, correct your mistakes, and keep you accountable when motivation dips. That is the honest case for structured training: not that the information is secret, but that a guide and a group get you there faster than doing it alone. Whether that is worth it to you is a personal call, and either way, the free path above is a completely legitimate way to get started today.
The one thing that actually matters
I will end with the least surprising and most important advice in this entire article: consistency beats everything.
The person who studies for one focused hour most days will, within a year, comprehensively outpace the person who does a ten-hour marathon once a month and then loses momentum. This field rewards steady, patient, repeated effort more than intelligence or money. Everything above is just structure around that one truth.
So pick Stage 1, start today, and keep going. The resources are all free and waiting. The only thing you have to supply is showing up. When you are ready for a guide and a structured path through it, that is what we are here for, but you can begin, right now, with nothing but a laptop and a bit of stubbornness.
