Chapter 57 — Honest gaps, and a six-month plan

What this guide did not cover (by design)

This is an applied foundation. It deliberately skipped or skimmed:

   * BINARY EXPLOITATION       stack/heap overflows, ROP, use-after-free,
                               ASLR/DEP/CFI, exploit dev. A huge field.
                               -> pwn.college, "Nightmare", ropemporium.com,
                                  Azeria's ARM series.
   * REVERSE ENGINEERING       Ghidra/IDA/Binary Ninja, malware analysis,
                               obfuscation. -> "Practical Malware Analysis",
                               malwareunicorn.org, crackmes.one.
   * MOBILE (deep)             iOS/Android internals, Frida, obf, keystore.
                               -> OWASP MASTG/MASVS.
   * CLOUD & KUBERNETES (deep) IAM privilege-escalation graphs, EKS/GKE/AKS
                               attack paths, IMDS, serverless. -> "Hacking
                               Kubernetes", flaws.cloud, pwnedlabs.io,
                               Kubernetes CTF (kubectl), CNCF security.
   * DETECTION ENGINEERING     beyond Ch 50: EDR internals, threat hunting,
                               DFIR at scale. -> "Applied Network Security
                               Monitoring", SANS FOR508/FOR572.
   * HARDWARE / EMBEDDED / RF   side channels, glitching, JTAG, car/IoT,
                               SDR. -> "The Hardware Hacking Handbook".
   * CRYPTOGRAPHIC ENGINEERING implementing primitives, constant-time
                               code, formal verification. -> cryptopals.com,
                               "Real-World Cryptography" (Wong).
   * FORMAL METHODS, PROTOCOL   Tamarin/ProVerif, fuzzing at scale
     VERIFICATION, FUZZING      (AFL++, libFuzzer, OSS-Fuzz).
   * GOVERNANCE / RISK / COMPLIANCE  SOC 2, ISO 27001, PCI-DSS depth,
                               risk quantification (FAIR), security
                               programme management.
   * SOCIAL ENGINEERING / PHYSICAL, OSINT, red-team tradecraft, purple
     teaming, adversary emulation at depth.
   * AI/ML SECURITY            prompt injection, model/data poisoning,
                               extraction, agent security. -> OWASP LLM Top
                               10; and the companion AI guide if you have it.

Knowing these exist — and roughly what they involve — is itself useful.

A six-month plan (part-time, ~6–8 h/week)

   MONTH 1 -- Cement the foundation
     - Redo any Part's milestone checklist you can't pass cold.
     - PortSwigger Academy: finish Access Control, SQLi, XSS, CSRF, SSRF,
       Auth, JWT tracks. Aim to solve labs without hints.
     - Read: "Serious Cryptography" (2nd ed.), Parts I-II.

   MONTH 2 -- Breadth: attacker skills
     - TryHackMe "Jr Penetration Tester" or "Web Fundamentals" path, or
       HackTheBox "Starting Point" + 6 easy boxes.
     - Learn one intercepting proxy deeply (Burp): Repeater, Intruder,
       extensions, macros.
     - Read: "The Web Application Hacker's Handbook" (method chapters).

   MONTH 3 -- Depth: pick ONE track
     - Web/appsec:  ASVS L2 review of a real app; OWASP WSTG end to end.
     - Cloud:       "Hacking Kubernetes" + flaws.cloud + pwnedlabs.io;
                    build & attack a small EKS/GKE cluster.
     - Detection:   build a home SOC (Security Onion / Elastic), run
                    Atomic Red Team, write Sigma rules, measure MTTD.
     - Crypto eng:  cryptopals sets 1-6.

   MONTH 4 -- Build something defensive and real
     - Contribute a security fix or a detection rule to an open-source
       project. Add SBOM + signing + a supply-chain gate (Ch 47) to a
       repo you own. Write it up publicly.

   MONTH 5 -- Practice under pressure
     - Play 3-4 CTFs (pick beginner-friendly: picoCTF archives, CSAW,
       HTB CTF). Focus on your Month-3 track's categories.
     - Do a full mock engagement on a vulnerable target: scope -> test ->
       report -> retest, timeboxed to a week.

   MONTH 6 -- Consolidate and aim
     - Take (or seriously prep for) one certification that matches your
       track (Ch 58).
     - Write 3-5 blog posts on what you learned -- teaching exposes the
       gaps. Start a lab notebook / GitHub of your tools.
     - Set the next six months' goal based on what you actually enjoyed.

Habits that compound

   [ ] Read one primary source a week (an RFC, a spec section, a real
       post-mortem, a CVE writeup) -- not just blog summaries.
   [ ] Keep a lab. Break things you're about to build.
   [ ] When you use a library for crypto/auth/authz, read HOW it works
       once.
   [ ] Follow a few signal sources (Ch 58), skip the noise.
   [ ] Threat-model your own features (Ch 52) as a reflex.
   [ ] Teach: answer questions, write notes, give a brown-bag talk.
   [ ] Report responsibly. If you find a real bug in the wild: stop,
       don't dig, disclose via security.txt / a bug-bounty channel
       (Chapter 0.6).