Resources: platforms, references & cert paths
A curated index of where to practise, what to keep open in a tab, which labs to run locally, and what the certifications are actually for — opinionated, and deliberately short.
Where to practise, what to keep open in a second tab, and which certifications are worth the money. This is a curated index, not a link dump — everything here earns its place, and things that are merely famous have been left out.
This page covers learning material and platforms. For the software itself — Nmap, BloodHound, ffuf, Impacket and the rest — see the tools arsenal, which is maintained separately so the two lists don't drift.
#Practice platforms
The three that matter, and they are not interchangeable:
- TryHackMe — guided, with the theory attached. The right starting point if you are still building vocabulary. Rooms hold your hand, which is a feature early and a limitation later.
- Hack The Box — unguided machines. The jump from THM to HTB is where most people learn to be stuck productively, which is the actual skill. HTB Academy is the structured track; Pro Labs are multi-host AD environments and the closest thing to a real internal engagement you can buy.
- OffSec Proving Grounds — Play is free community boxes; Practice is paid and curated. If you are preparing for the OSCP, Practice is the closest match to exam-style targets, and the gap between it and HTB's harder boxes is deliberate.
For web specifically, PortSwigger Web Security Academy is free, better than most paid courses, and the labs are built by the people who write Burp. There is no reason not to work through it.
#References you will reopen weekly
- HackTricks — sprawling and occasionally wrong, but the fastest route from "I have a service on port X" to "here is what to try." Treat it as a methodology index, not gospel.
- PayloadsAllTheThings — payloads and filter bypasses per vulnerability class. Where you go when the obvious injection is being sanitised.
- GTFOBins (Unix) and LOLBAS (Windows) — signed or expected binaries abused for privesc, file transfer and execution. Between them they cover most living-off-the-land questions.
- OWASP WSTG — the testing methodology. Less exciting than HackTricks, far better for making sure you did not skip anything before writing the report.
- MITRE ATT&CK — the shared vocabulary between offence and defence. Worth knowing well if you ever have to explain findings to a blue team, which is most of the job.
- CISA KEV — vulnerabilities with confirmed in-the-wild exploitation. The single best prioritisation input there is, and the source of the
in_kevflag on the CVE write-ups here — see Log4Shell for how it is applied.
#Labs you run locally
Worth having offline, on your own hardware, where you can break things without a subscription:
- GOAD — Game of Active Directory. A deliberately vulnerable multi-domain forest. The best free way to practise AD attack paths end to end, and it maps directly onto the Active Directory notes.
- OWASP Juice Shop — modern JavaScript stack, realistic bug classes, actively maintained.
- DVWA — dated and deliberately artificial, but the adjustable security levels make it genuinely good for understanding why a filter fails rather than just that it does.
- VulnHub — downloadable boxes. Quality is inconsistent; the curated OSCP-style lists are the way in.
#Certifications, and what each is actually for
Separate two questions that get conflated: does this teach me something and does this get me past a CV filter. Few certs do both well.
| Cert | What it is for |
|---|---|
| OSCP (OffSec) | The recruiter filter. Hands-on and genuinely hard, but its real value is that HR has heard of it. Still the default ask for a junior pentest role. |
| PNPT (TCM Security) | Cheaper, AD-focused, ends in a full report and a live debrief. Better preparation for the job than OSCP; far weaker as a filter-passer. |
| BSCP (PortSwigger) | Web-focused, practical, cheap. Underrated, and pairs naturally with the free Academy above. |
| CRTO (Zero-Point) | Red team operations and C2 tradecraft — evasion, not just exploitation. The natural next step after OSCP if you are heading toward red teaming. |
| CRTP (Altered Security) | Focused AD attack paths, very good value. A strong pick if AD is the gap. |
| OSEP / OSWE (OffSec) | Specialisation — evasion and whitebox web respectively. Only worth it once you know which direction you are going. |
| GIAC (GPEN, GCIH, GXPN) | Excellent material, priced for employer funding. Take them if someone else is paying; hard to justify personally. |
| BTL1 (Security Blue Team) | Defensive. Worth it even if you are committed to offence — understanding what the SOC sees changes how you operate. |
The honest summary: certifications open doors, they do not make you good. The practice platforms above do that, and they cost less.
#Staying current
A short list beats a long one you never read:
- Project Zero — deep, slow, exceptional. Read for technique, not news.
- PortSwigger Research — where a lot of novel web attack classes debut.
- watchTowr Labs — edge-appliance and enterprise-software bugs, written with a sense of humour.
- tl;dr sec — weekly newsletter, good signal-to-noise, saves a lot of scrolling.
#Books
Most security books age badly. These have not:
- The Web Application Hacker's Handbook (Stuttard & Pinto) — dated on specifics, still the best explanation of how to think about attacking an application.
- Penetration Testing (Georgia Weidman) — the clearest introduction to the workflow as a whole.
- Practical Malware Analysis (Sikorski & Honig) — the standard text, and useful from the offensive side for understanding what your payload looks like to an analyst.
- Bug Bounty Bootcamp (Vickie Li) — the best on-ramp to bug bounty specifically, which is a different discipline from pentesting.
Suggestions welcome at hello@noob2root.com. This list is pruned as often as it is extended — a resource index that only grows stops being curation.