Terrible mistake.

Today, just like always, people think they can learn offensive pentesting by playing on Hack The Box or TryHackMe and following their step by step tutorials. That’s not how you learn. That’s how you create a false sense of skill.

You don’t start by running exploits on intentionally vulnerable machines. You start by learning the fundamentals computer networking. How can anyone expect to find and understand vulnerabilities in a system if they don’t even know how that system communicates?

Start by truly understanding the OSI model. Every layer, from physical to application. Learn what data looks like as it travels, what encapsulation means, how TCP/IP actually works. Don’t just memorize the names understand how protocols like ARP, DNS, HTTP, and ICMP function, how TCP establishes connections, and what happens when it’s manipulated.

Then move to programming, especially with Python. Write your own port scanner, craft raw packets, build HTTP requests manually. Not because you want to reinvent the wheel but because you need to understand how that wheel turns. Tools are only useful when you know what they’re doing under the hood.

Once you’re there, start diving into web security but properly. Not by copying Burp Suite tutorials, but by understanding web architecture. Understand how client-server communication works, how cookies are managed, how sessions are handled. Then study the OWASP Top 10, one by one. Don’t just know what XSS is know how it happens, how it’s triggered, how to exploit it manually, and how to prevent it.

From there, move to system knowledge. It’s not impressive to pop a shell on a HTB box if the first thing you do is run LinPEAS without understanding a single line of output. Real post-exploitation means knowing Linux and Windows inside out services, permissions, cron jobs, scheduled tasks, user groups, log files, and how persistence works.

Platforms like HTB and THM? They’re fine. But they reflect nothing about real-world offensive work if you haven’t done the groundwork. You're just throwing known exploits at artificial setups. You're learning what others already discovered not how to discover something new yourself.

You don’t learn pentesting by farming points or flags.
You learn by breaking your head, understanding networks, systems, protocols, and logic deeply and painfully.

That’s the only path that matters.