How to become an ethical hacker from scratch (2026)

Almost everything written about this starts the same way: a list of twenty tools and a promise that you'll be in within three months. This article takes another route. It's the path I walk people through when they ask me where to start, with real timelines and the part nobody mentions — the part that separates people who collect tutorials from people who end up getting paid for this.

What an ethical hacker actually is

An ethical hacker attacks systems with the written permission of their owner, to find the holes before someone else does. The technique is the same one a real attacker would use; what changes is the contract behind it and the report delivered at the end.

That phrase — "written permission" — is not legal decoration. In Spain, article 197 bis of the Criminal Code punishes unauthorised access to a computer system, and it does not require that you broke anything or that you meant harm. Scanning a company that hasn't hired you, even "to let them know", already puts you on the wrong side of the line. Prior authorisation is what turns the identical action into either a crime or an invoice.

Which is why the real work is a lot less glamorous than people imagine: there's scope to read, emails with the client to define what can be touched and what can't, and a great deal of writing. A professional pentester spends roughly a third of their time drafting. If writing bores you, this profession will bore you too.

The path, in order

The order matters more than the speed. Almost everyone who gets stuck got stuck because they skipped the first two rungs.

1. Networks and systems (2-4 months)

Before attacking anything you have to understand what you're attacking. That means:

• TCP/IP properly: what happens in a handshake, why an unanswered SYN is not the same as an RST, what an MTU is and why it will break a tunnel of yours one day.
• DNS, HTTP and TLS: the three protocols where most of the work lives.
• Linux as an advanced user: permissions, processes, systemd, the filesystem, redirection and pipes.
• Windows and Active Directory: this is where 80% of corporate pentesting happens. Domains, GPOs, Kerberos, trust relationships.

It's the dullest phase and the one most people skip. It's also the one that, in a technical interview, separates people who know from people who recite.

2. The terminal and the lab (1-2 months)

Now you touch things. You spin up a virtual machine, install Kali, and learn to move without a mouse. The goal here is not "learning Kali": it's for the terminal to stop being an obstacle and become the place where you think.

If you want this part guided end to end, the Kali Linux course covers exactly it and it's free: lab from scratch with VMware, recon with Nmap, attacking network services, exploitation with Metasploit, and writing the final report.

3. Recon and OSINT (1 month)

Before firing a single packet at a target, you need to know what's there. Subdomains, technologies, employees, credentials leaked in old dumps, public repositories with forgotten keys inside.

This phase returns more per hour invested than any other, and is the most underrated. Plenty of real intrusions don't start with an exploit: they start with a password that showed up in a 2019 breach and that somebody still reuses. To go deeper there's the OSINT course and the article on what OSINT is and which tools are actually used.

4. Exploitation (3-6 months)

Now for real. Web (SQL injection, XSS, SSRF, deserialisation, logic flaws), network services, privilege escalation on Linux and Windows, and lateral movement.

The way to learn this is not by watching videos: it's by breaking machines. Hack The Box, TryHackMe, VulnHub. One machine solved and documented is worth more than ten courses watched on fast-forward. And when you get stuck — you will — the rule is simple: two hours fighting before you look at the write-up, and if you look, you do it again the next day unaided.

5. Reports and communication (permanent)

What gets paid for is not the vulnerability: it's the report that lets someone fix it and justify the spend to their management. A critical finding explained badly goes unfixed, and then your work achieved nothing.

Practise from day one: every machine you solve, write it up. Impact, step-by-step reproduction, evidence, concrete remediation. That pile of write-ups becomes your portfolio.

How long it really takes

At a genuine 8 to 12 hours a week, starting from zero: 12 to 24 months to reach a hireable junior level. Coming from systems, networking or development, 6 to 12.

Anyone promising less is selling you something. Anyone telling you it takes five years hasn't looked at the market lately.

Which tools to learn (and which can wait)

Phase	Essential	Can wait
Recon	Nmap, Amass, theHarvester	Shodan Monitor, Maltego CE
Web	Burp Suite Community, ffuf, sqlmap	Nuclei, commercial scanners
Exploitation	Metasploit, netcat, Impacket	Cobalt Strike and friends
Post-exploitation	BloodHound, mimikatz, LinPEAS	Custom C2 frameworks
Passwords	Hashcat, John, Hydra	Multi-GPU rigs

The classic mistake is collecting tools. Nmap and Burp known well take you further than thirty binaries you can only run with the flag from the tutorial.

Certifications: when and which

No certification will teach you what you haven't practised, but they open doors past HR filters. The practical rule: take your first one once you can already do the work, not before, and always favour hands-on exams over multiple choice.

I've covered it in full in which cybersecurity certification to choose, with approximate prices and the order that makes sense.

The first job

Junior roles in Spain usually come through one of three doors:

1. Security consultancy: high volume, short projects, you learn very fast and get paid little at first. It's the most common entry point.
2. SOC / Blue Team: tier 1 analyst. Not offensive, but you see real traffic and real attacks every day, and from there you move to Red Team with a much better foundation than average.
3. Bug bounty: not a job, a supplement. It's useful for having public findings to show in an interview.

What they'll ask you for: to explain a pentest end to end, to solve something in front of them and — this surprises people — to show that you can write. On what each rung pays, see what an ethical hacker earns in Spain.

The five mistakes I see most

1. Starting with tools. Knowing how to run sqlmap without understanding a SQL injection is knowing how to use a hammer without knowing what a nail is.
2. Watching instead of doing. Forty hours of video leave nothing behind. One machine solved at three in the morning is never forgotten.
3. Not documenting. If you don't write it down, in six months you won't know how to repeat it.
4. Skipping the fundamentals. It always shows, and it shows precisely in the interview.
5. Practising where you shouldn't. Your own lab, or platforms that expressly authorise it. Never someone else's system, however tempting the friendly heads-up seems.

Where to start today

If you've read this far and want one concrete action for this week: build the virtual machine and run your first scan. The Kali Linux course is free and starts exactly there, with an empty lab. By the end you'll have done a complete audit, report included, and you'll know whether this is for you.

And if it is, the rest of the catalogue picks up where that one leaves off.