Learn the Basics

🔍 1. Information Gathering (Reconnaissance)

• Passive & active recon
• WHOIS, nslookup, dig, theHarvester, Google Dorking

📡 2. Scanning & Enumeration

• Nmap scanning (ports, services, OS detection)
• Banner grabbing
• Enum4linux / SMB enumeration
• DNS and SNMP enumeration

🛠️ 3. Exploitation Basics

• Manual testing vs automated tools (e.g., Metasploit)
• Understanding CVEs
• Reverse shells & bind shells

🔓 4. Web Exploitation

• Basic understanding of HTTP, cookies, forms
• XSS (Cross-Site Scripting)
• SQL Injection (SQLi)
• Command Injection
• File Inclusion (LFI/RFI)

🔐 5. Password Attacks

• Brute force vs dictionary attacks
• Hash cracking (John the Ripper, Hashcat)
• Common wordlists (rockyou.txt, SecLists)

🧠 6. Linux & Windows Fundamentals

• Basic commands and navigation
• File permissions and ownership
• Understanding services and daemons
• Windows command line (PowerShell, CMD)

🧩 7. Binary Exploitation (Optional for Beginners)

• Understanding basic buffer overflows
• Using GDB or pwndbg

📦 8. Using Common CTF Tools

• Burp Suite (for web testing)
• Nmap
• Netcat
• Gobuster / Dirb
• Wireshark
• CyberChef (for encoding/decoding)

🎯 9. CTF-Specific Skills

• Reading challenge descriptions carefully
• Looking for hints and odd patterns
• Basic steganography (image/audio metadata)
• OSINT techniques (finding clues online)