Start cybersecurity in Nepal with four weeks of the terminal, networks and Linux, each practised on a free target that allows it. Leave hacking tools and certificates for later, because every later lab assumes these basics.

Most cybersecurity roadmaps you find for Nepal give you six months and tell you to pass an entry exam first. That is a plan in months. Below is a plan in weeks, with one free practice target for each week and one rule to follow before you start.

Why not start with hacking tools?

A tool like Metasploit or Burp Suite only helps when you can read what it shows you. A port scan means little if you do not know what a port is. A Linux privilege trick means little if you cannot read ls -l.

So the first month is slow on purpose. It is also cheap. Nothing in these four weeks needs a strong laptop, a paid lab or a dollar card.

What is the one rule before Week 1?

Only test a system when its owner has given you permission. In Nepal, getting into a computer system without permission is a crime under Section 45 of the Electronic Transactions Act 2063. Legal guides put the penalty at up to three years in prison, a fine of up to Rs 200,000, or both. Section 46 covers damage to computer systems and data.

This includes your college Wi-Fi, a friend's website and a neighbour's Wi-Fi. Being curious is not permission. Every target in this plan comes from an owner who has said yes, in public, for practice.

Week 1: the terminal and how the internet works

Learn to move around a Linux shell before anything else. The free OverTheWire Bandit game is made for absolute beginners. You connect with ssh to bandit.labs.overthewire.org on port 2220, and the first username and password are both bandit0.

Each level hides the password for the next one. The early levels teach ls, cd, cat, file, du and find. Bandit runs on their server, so an old laptop is enough. On Windows 10 or 11, open Optional Features, look for OpenSSH Client, and add it if it is missing.

Next to the shell, learn three words: IP address, port and protocol. By the end of the week, you should be able to say what ports 80 and 443 are for, and what happens when you type a website name into a browser.

Week 2: read real traffic with Wireshark

Wireshark is a free, open source packet analyzer. It shows each message that goes in and out of a computer on the network. Install it, but do not start by recording other people's traffic.

Open a file from the Wireshark sample captures page instead. In http.cap, find the request and the response. In dns.cap, watch a name turn into an IP address.

The goal for this week is small and exact. Look at a capture and say who talked to whom, on which port, and what they asked for.

Week 3: scan a host you are allowed to scan

Now you are ready for Nmap, the standard port scanner. It shows which ports on a machine are open and what software answers on each one.

The Nmap project gives everyone permission to scan scanme.nmap.org for testing. That permission covers Nmap scans only, not exploits. The project also asks for no more than about a dozen scans a day. Run nmap scanme.nmap.org once, then run it again with -sV to ask each open port for its software version.

Keep Wireshark open while you scan. You will see your own scan leave your laptop, packet by packet. This is why Week 2 comes before Week 3. You can now see exactly what the scanner sends.

Week 4: Linux users, files and permissions

Go back to Bandit and play the next levels. One early level asks you to find a file that is human-readable, exactly 1033 bytes and not executable. You solve it with find, and that is the same search an attacker runs on a real server to find a weak file.

Learn to read ls -l until you do not have to think. Know what read, write and execute mean for the owner, the group and everyone else. Then learn what sudo does, and why one careless sudo rule can give a normal user full control of a machine.

How long does it take to learn cybersecurity in Nepal?

These four weeks give you the base, not a job. Web testing, API testing and the defending side each need weeks of their own after this. Plan for months of steady practice, about two hours a day, rather than a weekend.

At Saarathi Academy in Old Baneshwor, Kathmandu, our Cybersecurity and Ethical Hacking course is 12 weeks long and follows this same order at the start. Weeks 1 to 4 cover the terminal, networks, recon and Linux, before any web hacking. Week 1 also covers the written permission that sets exactly what you may test. Week 4 ends with a guided lab where you take a limited account to full control, then write the fix.

Burp Suite and web testing start in Week 6. Week 10 covers the defending side, with alerts in the Wazuh SIEM, a tool that collects security logs in one place. Every syllabus starts from the basics and is public on the website before anyone pays.

Should you get Security+ or CEH first?

No. Get the basics first. Nepal job ads name CEH most often, and a certificate can help later. But an exam costs dollars, and it will not teach you to read a packet or a permission line.

Do the four weeks above. If you still enjoy the work after Bandit and Nmap, that is a good sign you should go deeper, with a course or on your own.

Try this tonight

Open a terminal and run ssh bandit0@bandit.labs.overthewire.org -p 2220. Type bandit0 as the password and finish Level 0. If you are inside a virtual machine and get a "broken pipe" error, the Bandit start page has a one-line fix for it.

For the full 12 weeks, week by week, see the Cybersecurity and Ethical Hacking course page and the syllabus.