HACKR.GG
Career Track

Learn to find the bugs
that bounties pay for.

A path into bug bounty hunting: 35 modules in order, from how the web works to recon, the common bug classes, and writing a report. Short lessons, quick checks, and practice exercises in your browser.

Start the track — free →See the curriculum ↓
35 modulesIn-browser labsBeginner friendlyCertificate included
Bug bounty hunter
01
You exploit, you don’t memorize
Every module ends in a real exploit you run yourself — in a hands-on inline lab. No slides, no “trust me”.
02
Zero setup
No Kali VM, no VPN, no broken installs. The lab runs right inside the lesson — start hacking in seconds.
03
A real methodology
Not a list of bugs — a repeatable process: recon → attack surface → exploit → report. The way actual hunters work.
04
Proof you can show
Earn a verifiable certificate as you finish, and a public profile that tracks every module and lab you clear.
// The path

Five phases. 35 modules. One hunter.

Work top to bottom and you go from “what’s an HTTP request” to working a live program. Or jump to any module — it’s all unlocked.

01
Foundations
The groundwork every hunter needs — how the web, auth, and APIs actually work.
5 modules
01Linux & CLI Fundamentals→02How the Web Works→03How Authentication Works→04APIs & Modern Web Apps→05Browser DevTools for Hackers→
02
Core Web Vulnerabilities
The bugs that pay the bills. Learn each one by exploiting it for real.
11 modules
01Cross-Site Scripting (XSS)→02SQL Injection→03IDOR — Broken Access Control→04idor-interceptor→05SSRF — Server-Side Request Forgery→06ssrf-interceptor→07Command Injection→08File Upload Vulnerabilities→09CSRF — Cross-Site Request Forgery→10Open Redirect→11CORS Misconfiguration→
03
Logic & Advanced Attacks
The high-value, harder-to-find bugs scanners never catch.
9 modules
01Business Logic Flaws→02Parameter Tampering→03Race Conditions→04Host Header Attacks→05Web Cache Poisoning→06API Rate Limiting & Bypass→07WebSocket Security→08DOM Clobbering→09HTTP Request Smuggling→
04
Recon & Tooling
Find the attack surface nobody else looked at — and the tools to work it fast.
9 modules
01Recon — Content Discovery→02Recon — Asset Discovery→03Recon — Google Dorking→04Recon — Shodan→05Subdomain Takeover→06Burp Suite — The Hacker's Proxy→07Network Scanning with Nmap→08Password Attacks→09Web Server Misconfiguration→
05
The Hunt
Put it together: pick a target, work a program, and write the report that gets paid.
1 modules
01Bug Bounty Methodology→
// By the end, you can
✓Read and exploit the OWASP Top 10 by hand
✓Run full recon on a target and map its attack surface
✓Drive Burp Suite (and our in-browser interceptor) like a pro
✓Find logic flaws and chained bugs that scanners miss
✓Write a clear, reproducible report that earns the payout

Your first bounty starts with module 01.

Free to start. No credit card. No setup.

Start the Bug Bounty Track →