THE COMPLETE GUIDE / START HERE

Getting started
in bug bounty.

Before you run the tools, understand the system. This is the path I'd give someone who wants enough foundation to know why a test works - not just what command to paste.

LEARNING_PATH.TRACE

WEB BASICSSTART

LANGUAGEHTML / JS

SECURITYOWASP / LABS

RECONMAP / CRAWL

HUNTTHINK / TEST

FOUNDATION / UNDERSTAND THE WEB

Learn what you're
trying to break.

Hacking is not running tools. You need a mental model of how browsers, servers, networks, and application code communicate before anomalies mean anything.

HTTP fundamentals

Methods, headers, cookies, status codes, and the request/response model.

↗02

Networking basics

TCP/IP, UDP, ports, the OSI model, firewalls, proxies, and VPNs.

↗03

DNS

Lookups, records, resolution, subdomains, and the role DNS plays in attack surface discovery.

↗

HTML

Understand forms, iframes, document structure, and how application data moves through the page.

JavaScript

Learn DOM manipulation, events, Fetch/AJAX, client-side validation, and how to read minified code for hidden functionality.

Linux

Get comfortable navigating files, permissions, processes, pipes, grep, find, chmod, and the command-line workflows security tools expect.

Python / Go

Add a scripting language. Python is versatile for automation and APIs; Go is excellent for concurrent recon tooling and modifying the modern security toolchain.

LEARNING PATH / PRACTICE

Stop reading.
Touch the app.

Once the fundamentals make sense, hands-on labs turn vocabulary into instinct. Start with PortSwigger's Web Security Academy, then use the OWASP Top 10 as a map - not a finish line.

PortSwigger AcademyFree hands-on labs for web application vulnerabilities.

↗02

OWASP Top 10A useful map of common web application security risks.

↗03

OverTheWire BanditInteractive practice for Linux and command-line fundamentals.

↗

RECON / FIND THE SURFACE