An Introduction to Ethical Hacking and Penetration Testing in 2026
The question lands in my inbox almost every week: "I want to become an ethical hacker — where do I start?" No computer science degree, usually a laptop bought from Hall Road in Lahore, always a lot of patience. The good news is that security remains one of the last fields where demonstrated skill beats paper. The catch: you have to build the demonstration yourself.
Permission is the whole job
A penetration tester is a hacker with a signed scope of work — a document naming which systems you may test, on which dates, and what stays off-limits. That single page is the difference between a career and a criminal record. In Pakistan, unauthorised access falls under PECA, and even friendly scanning of a network you do not own can put you in front of the FIA Cyber Crime Wing (helpline 1991). Everything below therefore happens on systems built to be broken.
Learn in labs, not on live sites
TryHackMe teaches from "what is a port" upward, room by room. HackTheBox hands you deliberately vulnerable machines, guided or unguided. VulnHub images let you build a practice network inside VirtualBox on a modest laptop — or even a phone, as a companion guide on this blog explains. The tools you meet there are the profession's daily drivers: nmap for finding what is alive, Burp Suite for intercepting web traffic, Metasploit for exploitation practice. Your own home network is a legal first target:
nmap -sV -sC 192.168.1.0/24
After every box, write down what you did and why. A blog of honest write-ups impresses a hiring manager more than any transcript.
Bug bounties: the apprenticeship
HackerOne, Bugcrowd and Intigriti list companies that have explicitly invited testing. Begin with VDP programs — vulnerability disclosure policies that pay nothing but return feedback and teach you how findings get rejected. Read disclosed reports the way law students read judgments; the write-up is the product. Your first paid bounty will take months. That is normal, and it is the best training available anywhere.
The certificate question: CEH or self-taught?
The CEH is theory-heavy and expensive; it clears HR filters but proves little hands-on. Self-taught plus a portfolio of lab write-ups beats it whenever you can actually show the work. The OSCP remains the field's respected standard — a 24-hour practical exam in which you break real machines and write a real report — and TCM Security's PNPT is a cheaper, well-regarded alternative. My honest order: skill first, certificate when an employer is paying.
If you doubt persistence can be learned, look at the students of Gaza completing security courses on solar-charged laptops between power cuts. It humbles those of us who complain about slow Wi-Fi.
One more thing about this blog: we write it at a travel desk, not a security firm. Between Umrah seasons the HTG Travels office in Sialkot has quiet weeks and walk-ins are welcome — come argue CEH versus OSCP over chai while we type up your Skardu itinerary.
