Your environment

You don’t need much to get started — a Linux box with the standard offensive tooling and somewhere safe to practice.

A working box

The easiest path is a dedicated VM. Kali and Parrot ship most tools preinstalled, but any Linux distro works if you install what you need.

sudo apt update
sudo apt install -y nmap ffuf gobuster netcat-traditional jq python3-pip git
pipx install sqlmap   # or apt install sqlmap

A safe place to practice

Never test against systems you don’t own. Spin up intentionally-vulnerable targets locally instead:

docker run --rm -p 127.0.0.1:3000:3000 bkimminich/juice-shop

For boxes and CTFs, platforms like Hack The Box, TryHackMe, and picoCTF give you legal targets on demand.

Next

Pick a track: CTFs, bug bounties, or finding vulnerabilities.