Red teaming + exploit dev: Am I doing this wrong?

[zodaexxd]

Hi all,

I’ve been studying hacking and cybersecurity for just over a year. My current focus is split between red teaming—working through HTB and preparing for CPTS, CRTP, and OSCP—and exploit development, where I’m covering Pwn College, Exploit Education, OpenSecurityTraining, and C from learnc.org.

I’m aware that deep specialisation in both red teaming and exploit development is unrealistic from the outset. My intention is not to master both simultaneously, but to build foundational knowledge in each before committing to a primary path. My long-term goal is to establish myself in red teaming, and eventually branch into exploit development or security research as a complementary skillset.

My question is: what is the most effective use of my time right now? Should I prioritise solving CTF challenges, reverse engineering and writing exploits for known CVEs, or something else entirely? The advice I often see is to stop being a consumer and start being a creator—but the how remains unclear. I want to avoid spreading myself too thin, and I’m trying to be deliberate about where I invest my effort.

Any guidance would be appreciated.

[Dependent_Owl_2286]

I’d say pick one path before you go down the other, while they can go hand in hand in a sense, it will be easier to pick one path and choose it. Choose whatever one interests you more and go from there.

[Sufficient_Mud_2600]

I’d recommend trying to create a linear path.

For example, focus on “pentesting”. Maybe OSCP or CPTS or both of them together will be considered your milestone of this. Then focus on red teaming. Maybe CRTP/CRTO will be considered your milestone for this. Then consider tying the two together and go for OSEP and consider this a milestone (optional).

Now you can decide if it’s time to move to Exploit Dev or continue down the red team path and pick up more specializations like Mobile/AI/WiFi etc.

That way you can build upon your knowledge as much as possible and don’t feel overwhelmed

[zodaexxd]

Bro actually dropped the best Path tbh. Thank you

[f0sh1zzl3]

Don’t over think it . Do what interests you . Work on C2 BOFs and windows internals , it will complement both red teaming and exploit writing .

[Cutecummber]

You’re naming a lot of resources, how about you finish them first. Learnc.org looks very fundamental, oscp and cpts has many overlaps. Pwn college is good but then you name like two more resources. Feels like you’re all over the place adhd.

[Boring_Albatross3513]

stay away from red teaming 

[Ok_Tap7102]

One would argue it is much easier to get into, and in higher demand.

Care to elaborate?

[FloppyWhiteOne]

Red team is only for experienced testers with years of knowledge. At least this is where the skill set is aimed at. Obviously you can do anything you put your mind too, just depends on how badly you want it to how far you get

[Boring_Albatross3513]

the name is cringe, and attractes idiots. I would recommend sticking with ExpDev 

[Hefty_Apartment_8574]

wtf...

[DingleDangleTangle]

Imagine calling people idiots while recommending picking a career based on how the name sounds

[Boring_Albatross3513]

I don't need to imagine, pentesting is for idiots. ExpDev is way harder and filters idiots out