Getting started with penetration testing is an exciting journey! You've already identified two excellent platforms: Hack The Box and TryHackMe. Both offer a range of challenges, from beginner to advanced, which can teach you practical skills in a safe environment.
In addition to these, you might want to look into:
- OverTheWire – This platform is fantastic for learning Linux command line skills, which are crucial for penetration testing.
- VulnHub – Offers a variety of downloadable virtual machines with deliberately configured vulnerabilities. It's great for offline practice.
- PortSwigger Web Security Academy – Provides free labs that focus on web application security, covering many real-world vulnerabilities.
Building a foundational toolkit is essential. Common tools include:
- Nmap for network scanning
- Wireshark for packet analysis
- Burp Suite for web application testing
- Metasploit for exploitation
It's important to understand the underlying principles of how these tools work rather than just their usage.
In terms of skills, consider focusing on:
- Understanding Networks: Learn about protocols, services, and how data is transmitted over networks.
- Operating Systems: Get comfortable with both Windows and Linux environments.
- Scripting and Programming: Python and Bash scripting can significantly enhance your penetration testing efficiency.
Always remember the ethical and legal aspects of penetration testing, ensuring you have the necessary permissions to test systems.
Lastly, complement your hands-on practice with reading. Books like "The Web Application Hacker's Handbook" and "Python for Offensive PenTest" can deepen your understanding.
Which area are you planning to explore first, or are there specific skills you'd like more advice on developing?