How to Learn Hacking From Zero: A Beginner’s 90-Day Plan

Start With the Right Mindset

Movies show hackers typing furiously and breaking in within seconds. Real security work is patient: reading documentation, understanding protocols, testing hypotheses and writing reports. The best beginners are curious about how things work and comfortable being stuck. They also respect the law. If a website is not yours, you do not test it without written permission. This course of action keeps you safe and builds a reputation that employers trust.

Weeks 1-2: Computer and Network Basics

Learn what an IP address is, how DNS translates names to addresses, what ports and protocols do and how a web request travels. Use Wireshark to watch your own traffic while opening a website. Draw diagrams of home networks: router, modem, devices. By the end of week two you should be able to explain what happens when you type a website address into a browser.

Weeks 3-4: Linux and the Command Line

Install VirtualBox and a Kali or Ubuntu virtual machine. Practise navigating the file system, reading permissions, searching with grep and find, using pipes, managing processes and installing packages. Write a few Bash scripts to automate small tasks, such as listing active network connections. This step is vital: almost every security tool runs on Linux.

Weeks 5-6: Security Fundamentals

Learn the CIA triad, common attack types, password security, hashing and encryption basics. Understand what vulnerabilities, exploits and payloads are. Read about phishing and social engineering to protect yourself and your family. Complete a short security fundamentals course or the beginner course so that vocabulary becomes familiar.

Weeks 7-9: Hands-On Beginner Labs

Now practise. Use platforms that provide guided, legal rooms. Learn host discovery and port scanning with Nmap, enumerate web directories, identify outdated software, use default credentials in lab machines and gain your first shell on a vulnerable virtual machine. After each lab write a short note: what you tried, what worked, what you learned. If you get stuck for more than an hour, read hints rather than quitting.

Weeks 10-12: Web Application Basics

Install Burp Suite Community and an intentionally vulnerable web app like DVWA or OWASP Juice Shop in a local VM. Learn how requests and responses work, cookies and sessions, and then explore injection, cross-site scripting and broken access control at beginner level. Fix one vulnerability in the code to see the defender’s view. By the end of 90 days you should have a notebook with 15-20 documented labs, which is a powerful starting portfolio.

Free Resources and Where They Fall Short

Free vendor courses, YouTube playlists, documentation and beginner platforms are valuable. They fall short on sequencing, feedback and accountability. Many learners drift after the first month or learn tools without context. A structured live course provides a curated order, a trainer who answers questions the moment they arise, and interview preparation. See our free learning path and consider the ethical hacking course once you have tested your interest.

Mistakes Beginners Make

• Downloading “hacking tools” from unknown sites, which often contain malware.
• Attempting to hack social media accounts or websites — illegal and harmful.
• Skipping networking and Linux and jumping to advanced exploits.
• Watching without practising.
• Not documenting, which makes progress invisible.
• Comparing yourself with experts instead of last month’s you.

Common Misconceptions About Learning Hacking

• “You need a special laptop.” A modest laptop with 8 GB RAM is enough for beginners.
• “Hacking is mostly typing commands fast.” It is mostly reading, thinking and testing hypotheses.
• “Dark web tools are required.” Legitimate learning uses open, legal tools.
• “Hacking tutorials on random channels are enough.” Without foundations you will copy commands without understanding.
• “You should test your school or college website.” Never do so without written permission.

Hands-On Exercise: Week 1 Starter Lab

Install VirtualBox, import a Kali Linux VM and a deliberately vulnerable VM, and place both on a host-only network. From Kali, ping the target, run a basic Nmap scan, and record which ports are open. Open Wireshark and watch the packets while you scan. Write down what each packet type means. Finish by taking a VM snapshot so you can restore if something breaks. You have now built the lab you will use throughout the first 90 days.

Self-Test

1. Which two skills should you learn first? (Networking and Linux.)
2. Where should you practise? (In your own lab or legal learning platforms.)
3. Why take VM snapshots? (To recover quickly after mistakes.)
4. What should you do after each lab? (Write notes about what you did and learned.)
5. Is Kali Linux required? (No, but it is convenient.)

Illustrative Scenario: The Student Who Almost Quit

A first-year student begins with enthusiasm, downloads dozens of tools and watches videos for weeks but cannot solve any lab. He feels stuck and considers quitting. A mentor suggests dropping the tools and spending two weeks on networking and Linux only. After that, the same labs suddenly make sense because he understands what ports, services and permissions mean. Within a month he completes his first vulnerable machine. The turning point was not talent but sequencing.

Practical Tips for Beginners

• Spend at least half of your study time doing, not watching.
• Write the explanation of every lab in your own words.
• When stuck, define the exact question and search or ask for help after 30-45 minutes.
• Take regular breaks; memory consolidates during rest.
• Celebrate small wins to maintain motivation.

Where to Go Next: Practice and Resources

Ethical hacking is learned by doing, but doing safely and legally. Build your own lab, keep strict boundaries and document every exercise. Over time you will notice that the same handful of weaknesses appear repeatedly in different forms, and that your reporting skills matter as much as your technical ones.

• Intentionally vulnerable applications such as DVWA, Juice Shop and WebGoat.
• PortSwigger Web Security Academy for web vulnerabilities.
• Guided machines on legal hacking platforms for network and privilege escalation practice.
• Public vulnerability write-ups and disclosed bug bounty reports.
• CTF events and college security clubs.

More Questions Learners Ask

Can I turn practice into a job?

Yes, a portfolio of reports plus an entry-level practical certification supports applications for VAPT roles.

Is it safe to practise hacking on my home network?

Practise inside isolated virtual machines and never against devices or networks you do not own. Keep lab networks separate from your normal network.

How many hours a week should I practise?

Five to ten focused hours is a sensible target for steady progress.

Do I need to learn every tool?

No. Master a core set and understand the underlying protocols.

How do I avoid legal trouble while learning?

Use only labs and platforms built for learning, or systems for which you hold written permission.

What is the best way to document practice?

Keep a notebook with objective, steps, commands, output and lessons for every lab.

Interview Questions Related to This Topic

Employers often use fundamentals like these to check whether a candidate really understands a topic. Try answering in your own words before reading the model answer.

What is the difference between a virus, worm and trojan?

A virus attaches to files and needs user action to spread, a worm spreads by itself across networks and a trojan pretends to be legitimate software while performing malicious actions.

What happens when you type a URL in a browser?

The browser resolves the domain with DNS, opens a TCP connection, performs a TLS handshake for HTTPS, sends an HTTP request and renders the response. Security professionals add where attacks can occur at each step, such as DNS spoofing or certificate issues.

How do you respond to a ransomware infection?

Isolate affected systems, preserve evidence, identify the strain and entry point, restore from clean backups, reset credentials and report to relevant authorities such as CERT-In. Paying should not be the default plan.

Terms to Remember

A shared vocabulary makes learning faster. These terms appear repeatedly in classes, labs and interviews:

• Firewall: A control that allows or blocks network traffic according to rules about source, destination, port or application.
• Encryption: Scrambling data with a key so that only authorised parties can read it, in storage or in transit.
• Vulnerability assessment: A systematic scan and review that lists weaknesses and ranks them by severity.
• Sandbox: An isolated environment in which suspicious files can be run safely to observe their behaviour.
• Data breach: An incident in which personal or confidential data is accessed, copied or exposed without authorisation.
• Honeypot: A decoy system that attracts attackers so that defenders can observe their methods safely.

Learn This Hands-On: Recommended Courses

Reading builds understanding, but practice builds skill. If this topic interests you, the best next steps are Cyber Security Course for Beginners, Kali Linux & Linux for Hackers Course and Ethical Hacking Course. Every course includes live labs, and a new batch starts every week. You can try a free demo class first, compare fees or read about the cyber security course in your city.

Related reading: How to Become an Ethical Hacker in India: Step-by-Step Roadmap • What Is Ethical Hacking? Meaning, Phases, Types and Legality in India • Top Ethical Hacking Tools Every Beginner Should Know (With Use Cases).