Skip to content
Sign in Apply
Applications for the winter cohort close Dec 18

How To Be Good, the BugClub HQ course

Ethical hacking, week by week

For ages 14 to 17, online. Eight weeks of thinking like a security professional, then writing it up like one. No code, nothing to install, no prerequisites beyond curiosity.

Apply for the winter cohort See the eight weeks

Free to apply, about five minutes. $349 only if accepted, refundable for the first four weeks.

Starts
Jan 11
Apply by
Dec 18
Live sessions
Tuesdays, 7 to 8:30 PM Eastern
Price
$349 only if accepted

The eight weeks

From your first bug to your first disclosure

Week 0 is self-paced. Weeks 1 to 7 each have three readings, a 90-minute live session and a lab. Plan on [FACT: hours per week] a week.

Open any week for its lessons and lab.

  1. Welcome, ethics and your first bug What ethical hacking actually means, how bug bounties work, and the idea that comes back every week: never trust the user.
    1. 0.1Ethics 101Reading
    2. 0.2How bug bounties workReading
    3. 0.3You don't need to code, you need to thinkReading
    4. 0.4How the platform worksTour
    5. 0.5Never trust the userReading

    Week 0 labFirst Bug badge, title Cadet

    A guided first bug

    The lab tools walk you through it: inspect, tamper, send, and it works. Then you file your first bug report. Before week 1 opens, you and a guardian both sign the ethics agreement.

  2. Assumptions: trust the client Every system trusts something about its users. Find the assumption, find the bug.
    1. 1.1The day GitHub let a stranger inIncident
    2. 1.2Hidden fields aren't hiddenConcept
    3. 1.3A time an assumption about a user bit meMy story
    4. 1.4The Homakov story, then changing a hidden price in the shop togetherLive

    Week 1 labTrust Breaker badge, title Scout

    The hidden price

    The moonmart shop. You file a finding: what did the shop assume, and what happened when the assumption was false? Extra challenge: add a field the form never offered and see if the server saves it.

  3. Attack surface: enumeration You don't attack blind, you map first. Small leaks add up to a map of what exists and who's there.
    1. 2.1How Parler gave itself awayIncident
    2. 2.2Small leaks become a mapConcept
    3. 2.3A time enumeration changed an engagementMy story
    4. 2.4Enumeration as a mindset: try usernames that exist and ones that don't, and read the differenceLive

    Week 2 labCartographer badge

    Who's in the crew?

    The crewspace recovery form. You file a recon write-up: what did the different replies give away, and how would an attacker use that map? Extra challenge: a reset token you can guess.

  4. Features as weapons: business logic Sometimes the rules themselves are the hole. No exploit needed, just "the rules don't say I can't."
    1. 3.1The free coffee trickIncident
    2. 3.2The rules are the attack surfaceConcept
    3. 3.3My best "that's not a bug, that's the rules" momentMy story
    4. 3.4Why "think like an attacker" usually means "think about the rules", then breaking the shop's math togetherLive

    Week 3 labLoophole badge, title Investigator

    The negative order

    The moonmart rewards shop. You file an abuse case: what rule was missing, what did you do, and what's the fix? Extra challenge: redeem a "one time only" coupon twice.

  5. Injection: cross-site scripting Up to now it's been rules. This week it's input: when a site shows what you typed as code instead of text, your message runs for everyone who sees it.
    1. 4.1The worm that made a million friendsIncident
    2. 4.2Your bio shouldn't be able to run codeConcept
    3. 4.3The most surprising place I've seen input get renderedMy story
    4. 4.4The Samy story, stored versus reflected, then signing the guestbook with something that isn't textLive

    Week 4 labSignal badge

    The running message

    The campfire guestbook. You file an XSS write-up: what happened, why it worked, and the one-line fix. Extra challenge: a search page that repeats what you typed, the reflected version of the same bug.

  6. OSINT: your own footprint The recon you've been doing on fake apps works on real people, including you. This week the lens turns around.
    1. 5.1The map that showed too muchIncident
    2. 5.2Your footprint is an attack surfaceConcept
    3. 5.3What public posts gave away about one person, and how they could have stopped itMy story
    4. 5.4How public posts add up to a profile, using a made-up personLive

    Week 5 labGhost badge, title Operative

    Your own footprint

    With a guardian's opt-in, you look up what's public about yourself. Without it, you use a sample profile. You file a personal footprint report: what did you find, what's the risk, what will you change?

  7. IDOR: ownership A server that finds things by number but never checks who owns them will hand over someone else's stuff the moment you change the number.
    1. 6.1885 million documents, one digit at a timeIncident
    2. 6.2The number is not permissionConcept
    3. 6.3An IDOR I foundMy story
    4. 6.4"I can see it" versus "I'm allowed to see it", then opening a notebook and changing the numberLive

    Week 6 labGatekeeper badge

    The next notebook

    The little-notes notebook. You file a reproducible finding: exact steps, the impact, the one-line fix. Extra challenge: change who the server thinks you are.

  8. Capstone, report and disclosure Everything so far in one place, then the part the course builds toward: you found it, so find the right person and tell them the right way.
    1. 7.1The kid who found the bugIncident
    2. 7.2The report and the email are the skillConcept
    3. 7.3The best and worst disclosures I've seenMy story
    4. 7.4What a great report reads like, how to find the right person, then the capstone briefLive

    Week 7 labDisclosed badge, titles Reporter and Disclosed

    The capstone and a fake company

    One app with several of the last six weeks' bugs hidden in it, and a fake company's website. You file a consolidated report, work out the right address from the site, and send a disclosure email. Then demo day, [FACT: demo day date]: you present your capstone to the cohort and their parents.

How To Be Good: $349 USD, one time, charged only if the application is accepted.

The winter cohort starts January 11. Live sessions: Tuesdays, 7 to 8:30 PM Eastern. Applications for the winter cohort close Dec 18.

Apply at https://bugclubhq.com/apply

A week up close

Practice apps that were built to be broken

Each lab is a small app with a bug planted in it on purpose. It runs inside BugClub HQ, so nothing you do there can reach a real site.

  1. Predict

    Before the lab tools unlock, you write down what you expect to happen and why. Being wrong is fine. It's honestly the best part.

  2. Tamper and observe

    X-ray shows what the page is hiding. The request panel lets you change what gets sent and watch what the server does with it.

  3. Write it up

    The lab hands you straight to the write-up: seven fields, one page. I write back on every one. It passes, or it comes back as almost there, which just means one more pass.

  4. Check the fix, for a bonus

    Every practice app has a patched version. Send the same request there and watch the server refuse it. Finding the bug is the win. Proving the fix works is a bonus.

The one exception is week 5, when you look up what's public about yourself, and only with a guardian's opt-in. Without it, you use a sample profile.

What you leave with

Work you can show, in a case file that stays yours

No accredited certificate. You keep the work, and the habit behind it: get permission, prove it harmlessly, stop, tell the right person.

  • A write-up for every week

    Week 0 to week 7, seven fields on one page each time, with feedback from me on every one.

  • A capstone report and a disclosure email

    One report on an app with several bugs hidden in it, then a disclosure email to a practice company that writes back.

  • A case file that stays yours

    Every write-up, note and badge in one place. It's still there after the cohort ends.

  • Badges, titles and a findings count

    A badge each week, a title that climbs from Cadet to Disclosed, and a findings count that only goes up. Nobody gets ranked against anybody.

Who teaches

One instructor, start to finish

[FACT: headshot]

Josh [FACT: surname]

Instructor

[FACT: one-line background]

More about Josh

I teach the readings, run every live session, read every application and write the feedback on every write-up. In week 7 I also play the fake company that answers each student's disclosure email.

In [FACT: conviction year] I went to federal prison for internet piracy. I'd rather you hear it from me than find it on your own. It's the reason week 0 is about permission: I know exactly where that line is, and I want every student to stay on the right side of it.

Pricing

One price, paid once

$349 covers the whole course, and nothing is charged unless your kid is accepted.

How To Be Good

$349 USD

One payment. No subscription, nothing else to buy.

Apply for the winter cohort

Free to apply, about five minutes.

Includes

  • Seven live sessions and the recordings
  • A lab every week, plus extra challenges
  • Feedback from me on every write-up
  • A case file that stays theirs, and a parent account

How paying works

  1. Apply for free

    About five minutes. No account, no card.

  2. Hear back within 5 business days

    If it looks like a fit, I'll set up a short call. A parent or guardian joins it.

  3. Pay once your kid is accepted

    I'll send you an invoice. [FACT: payment method] Receipts and any refund show up in your parent account.

Refunds

Full refund any time during the first four weeks (through [FACT: refund deadline]). I'll ask why, but the answer doesn't change whether you get it. The details are in the refund policy.

Help with the cost

If $349 is a problem, tell me on the call or email hello@bugclubhq.com. [FACT: what help looks like, e.g. lower price or sponsored seat] It has no effect on whether your kid is accepted.

Sponsored seats

Schools, employers and scholarship programs can pay for seats, so families pay nothing. Email hello@bugclubhq.com to set one up.

Applications for the winter cohort close Dec 18

A class of 6, one instructor, eight weeks. Applying is free and takes about five minutes.

Apply for the winter cohort For parents