How I'm Becoming an Ethical Hacker With No Degree — My Honest Roadmap

How I'm Becoming an Ethical Hacker With No Degree — My Honest Roadmap, Progress, and What Nobody Tells You

By Amardeep Maroli  ·  May 16, 2026  ·  Ethical Hacking, Career Journey, Personal Roadmap  ·  17 min read

Home About Contact

About eight months ago I made a decision that still feels slightly irrational when I explain it to relatives: I am pursuing a career in ethical hacking. Not cybersecurity broadly — specifically the offensive side, the part where companies pay you to try to break their systems before someone criminal does it first.

I'm an MCA student from Kerala. My academic background is computer science — I came to MCA from a computer application stream. I have no IT job experience. No prestigious college name. No family connections in the technology industry. What I have is a basic laptop, a reliable internet connection, and enough stubbornness to have spent the better part of a year on this.

This post is not a generic "here's how to become an ethical hacker" guide. There are hundreds of those. This is my actual journey — what I tried, what failed, what surprised me, and where I am right now. I'm writing it partly because I wish something like it existed when I started, and partly because documenting the process publicly keeps me accountable to continuing it.

What this is: A personal, honest, ongoing account of building an ethical hacking career from scratch in India with no CS degree. I have included the context that generic guides leave out — the doubts, the specific mistakes, the moments things clicked, and the realistic timeline. Skip to any section using the navigation below.

Jump to a section:

1. Why I chose ethical hacking — and the moment that made it concrete
2. What ethical hackers actually do (what I learned vs what I imagined)
3. The legal line — I almost made a serious mistake here
4. The 5 skills I'm building and how far I've gotten in each
5. My step-by-step roadmap — what I've done and what's next
6. Certifications honest comparison — what I actually think about CEH vs OSCP
7. Tools I use every week in my home lab
8. The 6-month plan (my actual plan with current progress)
9. What I'd tell someone starting today

Why I Chose Ethical Hacking — And the Moment That Made It Concrete

The Beginning

The honest version of why I got into this: I watched a YouTube video of someone rooting a HackTheBox machine at 1am during exam week when I should have been studying for something else entirely. The person found a misconfigured service, got a shell, escalated privileges, and captured the root flag — narrating the thought process the entire time. I watched it twice. Then I opened TryHackMe, created a free account, and did the first room instead of studying for my exam.

I passed the exam anyway. But something had shifted. I'd been vaguely interested in "cybersecurity" as a career idea — everyone in tech has heard that it pays well and there are too few professionals. But watching someone methodically think through a problem, try something, fail, adjust, and eventually break through — that felt like something I wanted to actually do, not just something I wanted to have done to me as a career milestone.

What made it feel possible rather than just appealing: everything I needed was free and available immediately. TryHackMe had guided rooms I could start on a basic laptop, right now, for nothing. PortSwigger Web Security Academy was a complete curriculum for learning web security, built by the people who made the most widely used web testing tool, completely free. The resources existed. The only variable was whether I would show up consistently enough to use them.

Eight months later I've passed CompTIA Security+, have six valid bug bounty findings on HackerOne, rooted 14 machines across TryHackMe and HackTheBox, and am writing this blog as documentation of the process. I'm still very much in the middle of this journey — not at the destination. But I'm further along than I believed was possible when I started, and I want to document exactly how I got here.

$119KAverage US ethical hacker salary — ZipRecruiter 2026

29%Job growth through 2031 (US Bureau of Labor Statistics)

3.5MGlobal cybersecurity unfilled positions — demand far exceeds supply

What Ethical Hackers Actually Do — What I Learned vs What I Imagined

Before I started, my mental model of ethical hacking came from YouTube videos and movies — rapid-fire terminal commands, dramatic moments, immediate results. The reality is more like careful detective work with significant documentation responsibilities at the end.

What I Got Wrong Initially

I thought ethical hacking was mostly about executing clever attacks. It's actually mostly about systematic methodology — thorough reconnaissance, patient enumeration, understanding how an application works before trying to break it, and documenting findings clearly enough that a non-technical person can understand the risk.

I also thought the exciting part was the exploitation. It is exciting — but exploitation is maybe 20% of the time spent on a real assessment. Reconnaissance and enumeration are 50-60%. Report writing is 20-30%. The skills that make someone genuinely good at this job are patience and systematic thinking as much as technical knowledge.

Knowing this going in would have changed how I practised. I would have spent more time on methodology documentation from the start, not just getting shells.

The actual day-to-day of an ethical hacker varies by role. A consultant at a security firm runs structured client engagements — defined scope, methodology, written report delivered to the client. A bug bounty hunter works independently on their own schedule. A red teamer runs long-form adversary simulations against a company's own defences. What's consistent across all of them: you are attacking systems with explicit permission, finding vulnerabilities before real attackers do, and communicating what you found clearly enough that it gets fixed.

The Legal Line — I Almost Made a Serious Mistake

Read this before you touch any hacking tools. Accessing computer systems without explicit written authorisation is a criminal offence under the Indian IT Act 2000 (Section 66 — up to 3 years imprisonment and ₹5 lakh fine) and equivalent laws everywhere. "I was just testing" and "I didn't cause any harm" are not defences. The legal line is clear: written permission from the system owner before any testing. Full stop.

The Mistake I Almost Made

Three months into studying, I was feeling confident. I had rooted several TryHackMe machines and completed most of PortSwigger's Apprentice labs. I was doing Nmap scans in my home lab and getting comfortable with the tool. One afternoon I ran an Nmap scan that included an IP range that was slightly broader than my home lab's subnet — I didn't fully verify the target range before running it.

The scan completed. Some of the IPs that responded were not my own machines. I had scanned addresses that were outside my own network — ISP infrastructure, based on what I could later figure out. Nothing bad happened. I didn't exploit anything. I stopped immediately when I realised what I'd done. But it was a genuine mistake made from carelessness, not malice — and in a different context with different targets, the same carelessness could have had real legal consequences.

That incident made me take the legal framework much more seriously than I had been. I spent the following week reading about the Computer Fraud and Abuse Act, India's IT Act, and how penetration testing engagement contracts work specifically to define legal authorisation. The legal knowledge is not optional. It is part of the job.

Where legal ethical hacking practice happens:

• TryHackMe and HackTheBox: Isolated virtual machines you are explicitly authorised to attack. All beginner practice should happen here
• Free cybersecurity learning From scratch to pro security analyst complete learning guide for how I built mine for ₹0
• Bug bounty programmes: HackerOne and Bugcrowd publish explicit scope — the domains you are authorised to test. Testing outside scope is not covered by the programme
• Signed penetration testing contracts: The legal instrument that makes professional assessments lawful

The 5 Skills I'm Building — Honest Progress on Each

Ethical hacking draws on five core skill areas. Here's where I actually am in each — not where a guide would tell you to be, but where I genuinely am right now after eight months:

Skill Area 1

Networking — Solid foundation, still gaps in Active Directory

My MCA curriculum covered TCP/IP, routing, DNS, and subnetting reasonably well. TryHackMe's Pre-Security path filled in the practical application knowledge. I'm comfortable with Nmap, Wireshark at a basic level, and understanding what different ports and services mean when I see them in a scan.

The gap: Active Directory. Corporate penetration testing relies heavily on AD attack techniques — Kerberoasting, Pass-the-Hash, BloodHound, lateral movement through Windows environments. My AD knowledge is conceptual rather than practical. I haven't set up a Windows Server lab yet, which I know is the next thing I need to do. It keeps getting delayed because Linux-based labs are more immediately accessible.

What I'd tell a beginner:

Start networking with TryHackMe Pre-Security path. It teaches you what you need in a practical context without the abstraction of a textbook. Don't delay the Active Directory work the way I did — corporate pentesting without AD knowledge is significantly limited.

Skill Area 2

Web Application Security — My strongest area, where I spend most time

This is where I've invested the most effort and where my practical skills are strongest. I've completed PortSwigger's full Apprentice curriculum and significant portions of Practitioner level. I've found real IDOR and business logic vulnerabilities on HackerOne. I use Burp Suite comfortably for most web testing tasks.

Writing this blog has deepened this knowledge more than I expected. When you have to explain SQL injection clearly enough for a complete beginner to understand it, you discover the gaps in your own understanding very quickly. The guides on this blog for SQL injection, XSS, CSRF, SSRF, and IDOR are each the result of me learning the topic thoroughly enough to explain it, not just execute it in a lab.

What made the difference:

PortSwigger Academy is genuinely the best free resource for this. Not because someone told me it was — because I've used it extensively and nothing else I've found comes close to the combination of quality explanation and immediately applicable lab practice. Complete every Apprentice lab before moving to Practitioner. The difficulty jump is real.

Skill Area 3

Linux and OS Security — Comfortable for labs, needs improvement for real engagements

I daily-drive Ubuntu and run Kali Linux in VirtualBox for lab work. Terminal navigation, file permissions, process management, basic bash scripting — all comfortable. OverTheWire Bandit was the most time-efficient way I found to build Linux command-line fluency; each level teaches a real skill in context.

The gap here is privilege escalation — specifically the manual enumeration process on an unfamiliar system. I know the common privilege escalation vectors conceptually (SUID binaries, sudo misconfiguration, cron jobs, weak credentials) but I haven't practised them systematically enough to be reliable without hints.

What I'm doing to fix this:

TryHackMe's Linux PrivEsc room followed by dedicated VulnHub machines focused on priv esc. The gap between knowing the techniques and being able to find the vector on an unfamiliar machine requires repetition, not more reading.

Skill Area 4

Python and Scripting — Basic, improving

I can write Python scripts to automate HTTP requests, parse responses, and implement simple security tools. I've written a basic IDOR testing script and a subdomain enumeration helper. I cannot write complex exploitation code from scratch. I can read and modify existing Python tools, which covers most of what a junior ethical hacker needs.

The honest assessment: Python has been the skill area I've invested least time in relative to its importance. Every time I've chosen between more lab time and more Python study, I've chosen the lab. The result is a skill set that's stronger in application than in code quality.

Resources that worked:

Automate the Boring Stuff with Python (free online) for foundational Python. Then the Python API security testing guide on this blog for security-specific application. The combination took me from zero Python to useful-in-security-contexts in about six weeks of consistent evening practice.

Skill Area 5

Methodology and Reporting — Better than average for my stage

Writing this blog forced me to develop structured explanation skills earlier than most people at my stage. Every blog post requires me to understand a topic thoroughly, organise it logically, and communicate it clearly. These same skills are what professional penetration testing reports require.

I've also read approximately 80 disclosed HackerOne reports, which taught me how experienced researchers structure their findings — the description, reproduction steps, impact analysis, and remediation recommendation. My own bug bounty reports have improved significantly as a result of that reading.

Underrated advice:

Read disclosed security reports before you try to write them. HackerOne's hacktivity feed is a free library of professionally written vulnerability reports. Spending two weeks reading these before writing your first report will make your reports meaningfully better from the start.

My Step-by-Step Roadmap — What I've Done and What's Next

1

Building Foundations — Networking, Linux, Web Basics

Months 1–2

The foundation phase. Everything I did here was free. The goal: understand how networks communicate, how Linux works in a terminal, and how web applications function — before touching any exploitation tools.

• TryHackMe Pre-Security path (free): Networking basics, Linux fundamentals, web fundamentals. Browser-based — no setup required. This was my starting point and genuinely the right one.
• OverTheWire Bandit (free): Linux command-line skill building through a wargame. Completed levels 1–20. Each level teaches a real skill — grep, SSH, file permissions, environment variables. More educational per hour than reading documentation.
• Read the foundation guides on this blog: What is Cybersecurity, How Hackers Find Vulnerabilities. Reading these as I was studying helped connect the abstract concepts to practical context.

My experience: The most important thing I did in month one was resist the urge to jump straight to Metasploit and exploitation tutorials. The people I saw on forums who skipped foundations and went straight to "hacking tools" were still stuck six months later because they didn't understand why commands worked or failed. Foundations first is not optional.

2

Web Application Security — PortSwigger and Burp Suite

Months 2–4

The phase where I found my specialisation. Web application security is the most accessible, highest-demand area for beginners — all the practice runs in a browser, the resources are excellent and free, and the skills directly translate to bug bounty work.

• PortSwigger Web Security Academy (100% free): The single most valuable resource I've used. Completed all Apprentice labs across Server-Side and Client-Side topics. Currently working through Practitioner level SQL injection and XSS. Every lab teaches something that generic tutorials don't cover.
• Burp Suite Community Edition (free): Installed and use it for every PortSwigger lab. The proxy intercept, Repeater, and Intruder tools are now second nature. Learning a tool by actually using it on structured labs is vastly more effective than watching tool tutorial videos.
• Blog guides alongside labs: I write a blog guide for every major vulnerability type I study — SQL Injection, XSS, CSRF. Writing the guide exposes every gap in my understanding of that topic.

The moment web security clicked for me: I was stuck on a PortSwigger SQL injection lab for two hours. I kept trying payload variations I had memorised without understanding why they worked. Eventually I stopped, went back to the theory section, understood what the query structure was doing, and then derived the right payload from first principles. That approach — understand before execute — changed everything about how fast I learned after that point.

3

Network Penetration Testing — Nmap, Metasploit, and HackTheBox

Months 3–5

Expanding from web applications to full network penetration testing methodology. This is where the home lab became essential — running Metasploitable 2 and VulnHub machines against Kali Linux taught me things that guided labs can't replicate.

• TryHackMe Jr Penetration Tester path: Structured guide through reconnaissance, scanning, exploitation, post-exploitation, and reporting. Completed this path and it gave me the methodology framework I was missing.
• Nmap deep dive: Host discovery, port scanning, service enumeration, NSE scripts. The TryHackMe Nmap room is well-structured. I also read the Nmap documentation specifically for NSE script usage — more powerful than most beginners realise.
• Metasploit Framework: Completed TryHackMe Metasploit room. Then practiced on Metasploitable 2 in my home lab. The experience of running an exploit against a real (intentionally vulnerable) service rather than a guided lab is qualitatively different.
• HackTheBox Starting Point: First three Starting Point machines. These are significantly harder than TryHackMe rooms and required looking up approaches I hadn't encountered. Read writeups only after genuinely attempting each machine for at least 2 hours.

Something that surprised me: The first time I got a root shell on Metasploitable 2, I sat there for a few seconds not quite believing it had worked. Then I felt a responsibility — a visceral understanding of what it means that someone could do this to a real system. That feeling is what turns security interest into security motivation.

4

Certification and Portfolio Building

Months 5–6

Translating skills into verifiable credentials and a public portfolio that employers can evaluate. This is where the abstract work becomes something concrete I can show.

• CompTIA Security+ — passed (782/900): Studied with Professor Messer's free videos, Jason Dion's practice exams, and Splunk Fundamentals for the SIEM section. Full study experience documented in my Security+ personal guide.
• GitHub portfolio: Public repositories documenting lab methodology, CTF writeups, and security tool scripts. Every significant piece of work goes here with a proper README.
• This blog: 40+ published articles covering every major web security topic, career guides, and personal experience posts. Two interviewers have specifically mentioned the blog as the reason they agreed to a call.

What I underestimated: The blog has been more valuable for my career than I expected when I started it. I started writing because it forces me to understand topics deeply. The side effect — a public record of sustained, genuine engagement with security topics — turns out to be exactly what some employers are looking for when they can't verify claimed experience any other way.

5

First Role and the Path to OSCP — What I'm Working Toward

Month 6 and beyond

I am currently in the active job application phase — 40 applications submitted with 11 responses and 3 technical interview progressions. That experience is documented fully in my job applications guide. The OSCP is the target after landing a first role.

• Target roles right now: Junior Penetration Tester, SOC Analyst with testing responsibilities, Security Analyst at small consultancies. Applying to smaller companies first — they hire freshers more readily than large MNCs.
• eJPT: Planning to take the eJPT practical exam within the next 60 days. A practical certification that proves I can conduct a basic assessment, not just pass a multiple-choice test.
• OSCP — the long-term target: The gold standard for penetration testers. Not taking it yet — it requires more experience than I currently have, and the $1,499 cost means employer reimbursement after a first role makes financial sense. Building toward it while working is the realistic path.
• Active Directory lab setup: My most significant current skill gap. Need to build a Windows Server + Active Directory lab to practice the attack techniques that dominate corporate pentesting engagements.

Honest current position: I am not there yet. Eight months of consistent work and I am still in the transition phase between student and professional. I'm writing this from the middle of the journey, not the end — which I think is more useful to most readers than a retrospective from someone who made it years ago and has forgotten what the beginning felt like.

Certifications — My Honest Opinion on CEH vs OSCP vs the Rest

I've researched certifications extensively while planning my own path. Here is what I actually think, not what cert vendors want me to think:

CompTIA Security+

Get This First

The box that must be checked. Required by many job descriptions, satisfies DoD 8570 requirements for US government roles. Theory-heavy but comprehensive.

Cost: ~$370 exam  |  Format: Multiple choice + PBQs

My take: I passed it. It opened application doors that were previously closed. Worth it as a floor credential, not a differentiator.

CEH — Certified Ethical Hacker

Skip It (My Opinion)

EC-Council's certification. Recognised in corporate HR but not respected by technical hiring managers at actual security companies. Expensive for what it provides.

Cost: ~$950–$1,699  |  Format: Multiple choice

My take: If you have the CEH budget and are choosing between CEH and eJPT + OSCP study materials, take eJPT and invest the rest in OSCP prep. Technical employers care about demonstrated skill, not this specific cert.

eJPT

Take This Next

Practical exam — you hack a real network. Proves actual skill at a price that makes sense for a student. The certification I'm taking next.

Cost: ~$200  |  Format: Practical network assessment

My take: The right second certification after Security+. Shows you can execute, not just answer questions. At $200 it's the best value practical pentesting credential available.

OSCP

The Long-Term Target

The gold standard. 24-hour practical exam. Opens senior pentesting roles. Not for beginners — get here after 1-2 years of experience and real-world practice.

Cost: ~$1,499 (90-day lab access)  |  Format: 24-hour practical + report

My take: Everything in this career is building toward this. Not rushing it — attempting OSCP before you're genuinely ready wastes the investment. Building toward it properly.

Tools I Use Every Week in My Home Lab

Kali Linux (VirtualBox VM)

Primary attack machine. 300+ pre-installed tools. Run in VirtualBox — free.

Daily driver for all lab work. Took two weeks to feel comfortable in it; now feels more natural than Windows for security tasks.

Burp Suite Community

Web app testing proxy — intercepts, modifies, repeats HTTP requests.

My most-used tool by far. The free tier limitation (no automated scanning) matters less than you'd think at the beginner stage.

Nmap

Network scanner — ports, services, OS fingerprinting, NSE scripts.

Every lab session starts with an Nmap scan. The NSE scripting engine is more powerful than I realised for months — worth learning in depth.

Metasploit Framework

Exploitation framework with hundreds of modules for known CVEs.

Powerful but easy to use as a crutch. I make myself understand every module I use — what CVE it exploits, why it works, what the payload does.

Wireshark

Packet capture and analysis — see exactly what moves over a network.

Used it for the public WiFi observations in Kerala. Also invaluable for understanding exactly what HTTP requests look like at the packet level.

Gobuster / ffuf

Directory and endpoint brute-forcing — find hidden paths on web apps.

Found a hidden admin panel on a bug bounty target that led to my first Medium-severity IDOR finding. These tools are not glamorous but they work.

SQLMap

Automated SQL injection testing and exploitation.

I learned manual SQL injection before touching this. Now use it to verify manual findings and test variations quickly. Tool before skill = bad habit.

Python (custom scripts)

Automation — HTTP requests, response parsing, simple fuzzing tools.

My Python is improving. The API testing guide on this blog came from me building a working script and documenting the process.

My 6-Month Plan — With Current Real Status

Where I Am in the 6-Month Roadmap

Month 1

Foundations: Networking + Linux

TryHackMe Pre-Security path, OverTheWire Bandit levels 1–20, foundation guides. Comfortable in terminal, understand TCP/IP, HTTP, DNS.

✓ Complete

Month 2

Web Security: PortSwigger Apprentice

Completed all Apprentice labs, SQL injection and authentication sections in depth. Installed and learned Burp Suite. Wrote first blog guides.

✓ Complete

Month 3–4

Network Pentesting + Home Lab + First HTB Machines

TryHackMe Jr Pen Tester path complete. Home lab built (Kali + Metasploitable + DVWA). 14 machines rooted across TryHackMe, HTB Starting Point, and VulnHub. First 3 HackerOne reports submitted (all duplicates — documented in bug bounty guide).

✓ Complete

Month 5

CompTIA Security+ + First Valid Bug Bounty Findings

Passed Security+ SY0-701 with 782/900. Six valid HackerOne findings including two Medium IDOR vulnerabilities. LinkedIn profile updated. GitHub portfolio active with 12 documented writeups.

✓ Complete

Month 6

Job Applications + eJPT Prep + AD Lab Setup

40 applications submitted, 11 responses, 3 technical interviews. eJPT exam scheduled. Active Directory lab build started. Continuing PortSwigger Practitioner labs and bug bounty work.

⟳ Currently in progress

Month 7+

First Security Role + OSCP Foundation Building

Land first security role (SOC Analyst or Junior Pen Tester at a small consultancy). Begin formal OSCP preparation. Continue blog and bug bounty work.

Upcoming

What I'd Tell Someone Starting Today

If I could go back to eight months ago and give myself advice, it would be these five things:

• Start with TryHackMe Pre-Security, not YouTube hacking tutorials. The tutorials are exciting but they teach you to follow steps without understanding them. Pre-Security builds the models that make everything else learnable.
• Build something public from day one. A GitHub, a blog, a TryHackMe public profile. The work you do privately compounds in your head. The work you document publicly compounds in your career. Both matter, but only one is visible to employers.
• The boring parts are the important parts. Methodology, documentation, report writing, legal frameworks — these feel less exciting than exploitation techniques. They are more important for a career. I learned this later than I should have.
• Use AI tools as a tutor, not an answer machine. I wrote about this in detail in my AI tools guide. The short version: use AI to understand what you're stuck on, then go back and solve it yourself. The struggle is the learning.
• The timeline is longer than the YouTube videos suggest. Six months from zero to job-ready is achievable. One month is not. Anyone telling you otherwise is selling something. Consistent effort over a realistic timeline is the path — not a shortcut that doesn't exist.

The salary numbers are real — but they're US numbers. In India, entry-level SOC Analyst roles start at ₹3–5 LPA, Junior Penetration Testers at ₹5–10 LPA. The ceiling rises significantly with OSCP certification and 3+ years of experience. The Indian cybersecurity market is growing 30–35% annually and the supply shortage is real — the career path is viable in India, but set salary expectations based on the Indian market, not US figures.

Everything Else in My Journey — Read in Order

• OWASP Top 10 — The Vulnerabilities at the Core of Web Pentesting
• 3 Months on Bug Bounty — What I Earned and What I Learned
• I Passed Security+ SY0-701 First Try — How I Studied
• I Applied to 40 Jobs With No Experience — What Got Responses
• How to Learn Cybersecurity for Free — Complete 2026 Roadmap

Ethical Hacking Career FAQs — Questions I Actually Had

Can you really become an ethical hacker without a computer science degree?

I'm doing it — so yes, empirically. I came to MCA from a commerce stream, not computer science. The skills that matter in ethical hacking are learnable without a CS degree: networking, Linux, web application security, penetration testing methodology. What matters to technical hiring managers at security companies is demonstrated practical ability — your TryHackMe profile, GitHub portfolio, bug bounty findings, and certification results. What a CS degree provides that self-study doesn't: structured progression through computer science fundamentals, credential signal for initial HR filtering at large corporations. The gap is closeable. A non-CS MCA or BCA with Security+, a demonstrated skills portfolio, and hands-on lab experience will get interviews at small security companies that a CS degree without those things won't. The combination of some formal education plus demonstrated practical skills is what I'm building.

How long does it realistically take to become an ethical hacker starting from zero?

I'll give you my honest numbers rather than a range: eight months of consistent work (1–2 hours daily) got me to Security+ certified, 6 valid bug bounty findings, 14 machines rooted, and active job application interviews. That is "entry-level ready" territory, not "experienced professional" territory. Getting to the point where I can run client penetration test engagements independently — what I think of as "actually an ethical hacker" — is probably 2–3 years total from where I started. The YouTube videos suggesting 3-month timelines are describing someone reaching the ability to follow guided tutorials, not the ability to work on real targets without guidance. Set your expectations for a 6–12 month runway to entry-level employment, and 2–3 years to solid independent capability.

Is CEH or OSCP worth it — and which should I get first?

My honest opinion: get Security+ first (required for many jobs), then eJPT (practical, affordable, proves real skill), then work toward OSCP over time (the real target for serious pentesting careers). CEH I would skip entirely if budget is limited — it costs significantly more than eJPT and is less respected by technical hiring managers at actual penetration testing firms. The reason CEH still appears in job descriptions is that large corporate HR departments write requirements based on name recognition rather than technical understanding of what the cert proves. If you're targeting boutique security consultancies and actual pentesting firms, eJPT → OSCP is the better investment. If you're targeting a large corporation's internal security team where HR filters applications, Security+ + CEH might appear in the requirements. Know your target before deciding.

Do I need to know programming before starting ethical hacking?

No — I didn't have Python when I started, and it didn't block my progress in the first four months. What you need coding for: reading and modifying existing scripts (not writing from scratch), automating repetitive testing tasks, and understanding why a vulnerability is exploitable at a code level. The practical minimum: basic Python — variables, loops, functions, HTTP requests with the requests library. This is approximately 30–40 hours of learning. I used Automate the Boring Stuff with Python (free online) for the foundation and then applied it immediately to security-specific tasks on this blog. You don't need to be a software engineer. You need enough to be a capable tool user and basic tool modifier. Build this skill in parallel with your other study — don't delay starting security learning until you're "good enough" at Python. Start both simultaneously.

What's the difference between ethical hacking and penetration testing?

These terms are used interchangeably in most contexts, but there is a technical distinction. Ethical hacking is the broad category — all forms of authorised security research, including bug bounty, security research, red teaming, and formal engagements. Penetration testing is a specific delivery format within that: a structured, scoped engagement with a defined timeline, specific target systems, a formal methodology, and a written report delivered to a client. A bug bounty hunter does ethical hacking. A consultant running a client engagement does penetration testing. Red team operators do a sophisticated form of ethical hacking that simulates real adversaries over weeks or months. I use both terms on this blog — when I say "pentesting" I usually mean formal engagement-style methodology; when I say "ethical hacking" I mean the broader practice. For job title purposes: Junior Penetration Tester = formal engagement work; Bug Bounty Researcher = independent programme work; Red Team Operator = advanced adversary simulation.

Amardeep Maroli

MCA student from Kerala, India, actively building a career in ethical hacking — eight months in, Security+ certified, 6 bug bounty findings, and still in the middle of the journey. TechWithAmardeep is the honest documentation of that process.

All Posts GitHub Telegram Contact