← kedrich
Jul 15, 20269 min readlearningroadmapfundamentalslinux

The foundations curriculum I'm following

I'm a second-year CS student, and I've made a deliberate bet: go deep on fundamentals now, and defer hacking, CTFs, and specialisation to year 3–4.

That's an unfashionable choice. The tempting path is to jump straight into boxes and rooms, because that part feels like security. But every time I looked closely at people who are actually good at this, the thing separating them wasn't exploitation tricks — it was that they genuinely understood Linux, networking, and how software runs. Tricks are cheap. The bedrock isn't.

So this is the plan I'm executing, written down publicly so I can be held to it.

The principles

  1. Depth over speed. Learning fast should buy me depth, not let me skip ahead.
  2. Hands-on, always. Roughly 70% doing, 30% theory. Lab- and puzzle-based resources only — passive video-watching platforms don't stick for me.
  3. By hand first, AI off — then accelerate. I write it myself until I understand it, and only then let AI speed me up. Reversing that order produces the illusion of competence.
  4. Master it, then move on. Every pillar has a checkpoint. No advancing with gaps.

The nine pillars

1. Linux              live in it, master the terminal
2. Networking         understand how everything connects
3. Programming + DSA  Python and C, real data structures
4. Git & GitHub       version control, from day one
5. Systems            how computers and OSes actually work
6. Databases          SQL and how data is stored
7. The Web            how web apps actually function
8. Docker + CI/CD     how modern software actually ships
9. Security 101       the core concepts, layered on top

Four of these are non-negotiable and have to be rock solid: Linux, Networking, Programming/DSA, and Security Fundamentals. The rest are calibrated toward where I want to end up — Systems and Web lean offensive, Docker and CI/CD lean cloud, and Databases supports both.

Kubernetes is deliberately not on this list. It's genuinely deep, intermediate-level infrastructure, not a foundations item. I'll learn it later, inside a cloud specialisation, once Docker and real cloud context make it click quickly. Trying to force it in now — isolated, without that context — would be inefficient, and I've already burned myself out once by rushing something I wasn't ready for. Once was enough.

Where I am right now

Being honest about status is the whole point of this log, so:

  • Pillar 1 — Linux: in progress. I've cleared OverTheWire Bandit end to end, which was the big item. The Bash toolkit build is still ahead of me.
  • Pillars 2–9: not started.

I'll update this post as checkpoints actually get passed — it's meant to be a living document, not a trophy.

Pillar 1 — Linux

Goal: the terminal becomes second nature.

Learn: navigation and files, permissions (chmod/chown), processes and services (ps, systemctl), text tools (grep/sed/awk/pipes), users and sudo, CLI networking (ip, ss, curl, ssh), and Bash scripting.

How: Linux as a daily driver, OverTheWire Bandit (all levels), and The Linux Command Line as a reference.

Build: a Bash toolkit — system-info reporter, log parser, backup script.

Checkpoint: fluent navigation, permissions without thinking, 40-line Bash scripts from scratch, Bandit cleared.

Pillar 2 — Networking

Goal: understand exactly how data moves.

Learn: OSI and TCP/IP, IP addressing and subnetting (by hand), TCP vs UDP and the three-way handshake, HTTP/S, DNS, DHCP, SSH, plus NAT, firewalls, and routing.

How: Professor Messer's Network+ videos, Wireshark on my own traffic, and Nmap against my own network.

Build: a packet-analysis writeup annotating an HTTP request and a DNS query, layer by layer.

Checkpoint: explain a full webpage load layer-by-layer, and subnet by hand without a calculator.

Pillar 3 — Programming and DSA

Goal: build real tools, and develop the code judgement that separates engineers from tool-users.

Learn: Python properly (core, OOP, error handling, testing, packaging), security-relevant libraries (socket, requests, subprocess, argparse, scapy), keeping C sharp, and data structures — arrays, linked lists, stacks, queues, hash tables, trees, graphs — plus Big-O.

How: implement the data structures by hand in C first, then Python. NeetCode at a steady pace, easy to medium, not as a marathon. AI stays off while learning; I review with it afterwards.

Build: a real CLI tool — likely a multithreaded port scanner — tested, documented, and packaged.

Checkpoint: write a 150-line Python tool from scratch and explain every line; core data structures implemented myself; reason about complexity naturally.

Pillar 4 — Git and GitHub

Goal: version control becomes automatic, and every project lives in public from day one.

Learn: add/commit/push/pull, branching and merging, resolving conflicts, pull requests, .gitignore, reading history (log, diff, blame), and the feature-branch → PR → review → merge workflow.

How: use Git for everything, starting with Pillar 1's Bash toolkit, and push it all to GitHub. Once comfortable, make one small open-source contribution — even a docs fix — to feel the real PR workflow.

Build: my GitHub is the deliverable — clean repos, real commit history, readable READMEs.

Checkpoint: committing and pushing without thinking about it, at least one real merge conflict resolved, and every project from Pillars 1–3 published.

Pillar 5 — Systems and OS internals

Goal: understand what's happening underneath the programs. This is where my C background should become a real advantage, especially for offensive work later.

Learn: processes vs threads, memory (stack vs heap), file systems, scheduling, syscalls, and basic Windows internals.

How: write small C programs using syscalls, fork(), and reading /proc, alongside MIT's Missing Semester.

Build: a small systems tool in C — a process lister via /proc, or a simple shell.

Checkpoint: explain how code becomes a running process in memory, and what the OS is doing underneath.

Pillar 6 — Databases and SQL

Goal: understand how data is stored and queried — the prerequisite for both building real apps and understanding SQL injection later.

Learn: relational concepts (tables, keys, relationships, normalisation), SQL (SELECT, JOIN, WHERE, indexes), schema design, and relational vs NoSQL.

How: PostgreSQL or SQLite — model something real and query it.

Build: a small database-backed CLI app.

Checkpoint: design a simple schema and write JOINs comfortably.

Pillar 7 — How the web works

Goal: understand web apps from the inside. It's the biggest attack surface in security and central to the offensive track.

Learn: HTTP in depth (methods, status codes, headers, cookies, sessions, JWT), how login actually works (authentication vs authorisation), REST APIs, and enough HTML/CSS/JS plus a backend to build something real.

How: build a small web app — Python with Flask or FastAPI, on top of Pillar 6's database: auth, data, storage.

Build: a working full-stack app, deployed if possible. This ties Pillars 2, 3, 6, and 7 together.

Checkpoint: I've built a working web app and can trace a request from browser to server to database and back.

Pillar 8 — Docker and CI/CD

Goal: understand how modern software actually ships — the layer underneath almost everything in cloud security.

Learn: Docker (images vs containers, Dockerfile, building and running, volumes, container networking, docker-compose) and CI/CD basics — what a pipeline is, and running automated tests on every push with GitHub Actions.

How: containerise the Pillar 7 web app, then add its database as a second container via docker-compose. Add a GitHub Actions workflow that runs tests automatically.

Build: the web app fully containerised — docker-compose up and it works — with a CI pipeline running its tests.

Checkpoint: containerise an app from scratch, understand every line of a Dockerfile, and have at least one working CI pipeline.

Pillar 9 — Security fundamentals

Goal: layer the security mindset on top of everything already built. This is the bridge into hacking, CTFs, and specialisation.

Learn: the CIA triad, authentication vs authorisation, least privilege, defence-in-depth, cryptography basics (hashing vs encryption, symmetric vs asymmetric, TLS, salting), threat modelling, and an intro to the OWASP Top 10.

How: Professor Messer's Security+ videos, and PortSwigger's Web Security Academy — lab-based, where you exploit real things rather than fill in blanks.

Build: a crypto demo tool showing correct password hashing (argon2/bcrypt) and demonstrating why MD5 and SHA-1 fail.

Checkpoint: explain CIA with real examples, describe how TLS works, and complete a first set of PortSwigger labs.

How the sequence actually runs

Phase A   Linux + Networking                  the bedrock
Phase B   Programming/DSA + Git/GitHub        the builder skills
Phase C   Systems + Databases + Web           how real software works
Phase D   Docker + CI/CD                      how modern software ships
Phase E   Security fundamentals               the lens

The pillars overlap naturally — I'll learn Git while writing Pillar 1's scripts, and containerise the web app as soon as it exists. The rule isn't strict isolation, it's no gaps: pass the checkpoint before moving on.

What comes after

For reference, once Pillar 9 is done the plan branches into two tracks in parallel:

  • Offensive: PortSwigger deepens, then Hack The Box (starting point → easy → medium), privilege escalation on Linux and Windows, pwn.college for binary exploitation, then CTFs.
  • Cloud: AWS in depth (IAM, S3, VPC, CloudTrail, KMS), Terraform, then Kubernetes — which should click quickly by then — and DevSecOps.
  • The convergence: offensive and cloud overlap in cloud pentesting, which looks like an underserved niche and a strong candidate for a specialisation.

That's a preview, not the current focus. Foundations first.

The rules I'm holding myself to

  1. Depth over speed.
  2. Hands-on, always.
  3. By hand first, AI off — then accelerate.
  4. Pass the checkpoint before moving on. No gaps.
  5. Build something in every pillar.
  6. Write up what I build, and push it from day one.
  7. If a resource burns me out, swap it.
  8. Consistency beats intensity. Rest during exams; never fully stop.

Resources

Everything here is free:

  • Linux: OverTheWire Bandit, The Linux Command Line
  • Networking: Professor Messer Network+, Wireshark, Nmap
  • Programming/DSA: NeetCode, the Python docs, a C compiler
  • Git/GitHub: GitHub itself, learned by doing
  • Systems: MIT Missing Semester
  • Databases: PostgreSQL or SQLite
  • Web: MDN Web Docs, Flask/FastAPI
  • Docker/CI-CD: the Docker tutorial, GitHub Actions docs
  • Security: Professor Messer Security+, PortSwigger Web Security Academy

A research log, not a résumé. In progress, on purpose.

One pillar down the first checkpoint, eight to go. I'll keep this updated as they fall.