Important things to know
In our previous article, we explained what Ethical hacking really is and how ethical hackers are different from the hackers you dread. You can catch up on it here. The big question remains, “Can you switch careers to Ethical Hacking in just 6 months?”. This article seeks to provide a useful step-by-step guide.
Month 1–2: Build Your Technical Foundation
Before hacking, you must understand what you’re hacking, hence, you must master these fundamentals:
Networking
- TCP/IP
- DNS
- HTTP/HTTPS
- Firewalls
- VPNs
- Ports and protocols
Operating Systems
- Linux (critical)
- Windows internals
- File systems and processes
Basic Scripting
- Bash
- Python
Tools to Start Learning:
- Wireshark
- Nmap
- VirtualBox or VMware
- Kali Linux
Recommended Entry Certification:
- CompTIA Security+ (baseline cybersecurity knowledge)
- eJPT (baseline ethicalhacking hands on exam)
- Goal by Month 2: You should understand how networks communicate and how systems are structured.
Many Africans struggle with getting hired remotely with international organizations. In this podcast episodes, we interviewed an African tech professional who has cracked this code for almost a decade and he shared insights into how you too can. Watch the video here
Month 3–4: Core Ethical Hacking Skills
Now you move into offensive security. Learn These Core Areas:
Reconnaissance
- Information gathering
- OSINT basics
- Subdomain enumeration
Scanning & Enumeration
- Nmap advanced usage
- Service detection
- Vulnerability scanning
Web Application Security
- OWASP Top 10
- SQL injection
- Cross-site scripting (XSS)
- Authentication flaws
Password Attacks
- Hash cracking basics
- Brute force concepts
Platforms for Practice:
- Hack The Box
- TryHackMe
- PortSwigger (Web Security Academy)
You should be able to compromise intentionally vulnerable machines and explain how you did it.
Month 5:
Advanced Exploitation & Real-World Simulation
This is where you separate yourself from beginners. Focus On:
- Privilege escalation (Linux & Windows)
- Active Directory basics
- Post-exploitation techniques
- Report writing (extremely important)
Employers care deeply about documentation. If you can’t explain the vulnerability, you won’t get hired.
Certification Option:
EC-Council Certified Ethical Hacker (CEH)
However, for practical credibility, many employers respect:
Offensive Security OSCP (advanced and challenging)
Be capable of completing medium-level penetration testing labs independently on Tryhackme and especially HackTheBox.
Month 6:
Build Your Portfolio & Get Job-Ready. This month is about positioning. What employers really look for is not just certificates. They want proof. So, build
- A GitHub repository with scripts
- Documented lab reports
- Write-ups of machines you solved
- A personal blog explaining vulnerabilities
- LinkedIn posts showing learning progression
You should confidently apply for: - Junior Penetration Tester
- Ethical Hacker
- Red Team Trainee
- Security Analyst (Offensive Focus)
And by this month, you should be comfortable with:
- Nmap
- Burp Suite
- Metasploit
- Hydra
- Gobuster
- Wireshark
- SQLmap
You need mastery and should be able to understand when and how to use them. That is why many people stay in the job market for too long because their skills are insufficient. We have put together a low-risk work environment structure to help you gain experience in ethical hacking. See how here.
You can also book a free consultation call with our team to get started. Schedule call here
