Week 1 — HTTP, not tools
If you cannot explain cookies, status codes, and form encoding, Burp will just confuse you. Finish a fundamentals path and write three sentences per lab: what broke, why, how you would fix it.
Week 2 — One bug class deep
- Pick SQLi or XSS, not both.
- Do three labs in that class.
- Post a writeup without dumping a full exploit chain for a live product.
Week 3 — Proof for recruiters
Indian campus CVs are noisy. A public lab profile plus two writeups beats a list of 15 certifications you have not started. Link the labs. Keep flags out of screenshots.
Week 4 — Repeatable practice
Re-do one lab from memory. If you still need the writeup, you memorized clicks, not the bug. That is the week you actually get faster.
Legal
College Wi-Fi, intern apps, and random .in sites are not labs. If there is no written permission, do not test.