[Applications for the winter cohort close Dec 18](https://bugclubhq.com/apply) How To Be Good, the BugClub HQ course # Ethical hacking, week by week For ages 14 to 17, online. Eight weeks of thinking like a security professional, then writing it up like one. No code, nothing to install, no prerequisites beyond curiosity. [Apply for the winter cohort](https://bugclubhq.com/apply)[See the eight weeks](#weeks) Free to apply, about five minutes. $349 only if accepted, refundable for the first four weeks. **Starts:** Jan 11 **Apply by:** Dec 18 **Live sessions:** Tuesdays, 7 to 8:30 PM Eastern **Price:** $349 only if accepted The eight weeks ## From your first bug to your first disclosure Week 0 is self-paced. Weeks 1 to 7 each have three readings, a 90-minute live session and a lab. Plan on [FACT: hours per week] a week. Open any week for its lessons and lab. 1. ### Week 0: Welcome, ethics and your first bug What ethical hacking actually means, how bug bounties work, and the idea that comes back every week: never trust the user. 1. 0.1Ethics 101Reading 2. 0.2How bug bounties workReading 3. 0.3You don't need to code, you need to thinkReading 4. 0.4How the platform worksTour 5. 0.5Never trust the userReading Week 0 labFirst Bug badge, title Cadet A guided first bug The lab tools walk you through it: inspect, tamper, send, and it works. Then you file your first bug report. Before week 1 opens, you and a guardian both sign the [ethics agreement](https://bugclubhq.com/ethics). 2. ### Week 1: Assumptions: trust the client Every system trusts something about its users. Find the assumption, find the bug. 1. 1.1The day GitHub let a stranger inIncident 2. 1.2Hidden fields aren't hiddenConcept 3. 1.3A time an assumption about a user bit meMy story 4. 1.4The Homakov story, then changing a hidden price in the shop togetherLive Week 1 labTrust Breaker badge, title Scout The hidden price The moonmart shop. You file a finding: what did the shop assume, and what happened when the assumption was false? Extra challenge: add a field the form never offered and see if the server saves it. 3. ### Week 2: Attack surface: enumeration You don't attack blind, you map first. Small leaks add up to a map of what exists and who's there. 1. 2.1How Parler gave itself awayIncident 2. 2.2Small leaks become a mapConcept 3. 2.3A time enumeration changed an engagementMy story 4. 2.4Enumeration as a mindset: try usernames that exist and ones that don't, and read the differenceLive Week 2 labCartographer badge Who's in the crew? The crewspace recovery form. You file a recon write-up: what did the different replies give away, and how would an attacker use that map? Extra challenge: a reset token you can guess. 4. ### Week 3: Features as weapons: business logic Sometimes the rules themselves are the hole. No exploit needed, just "the rules don't say I can't." 1. 3.1The free coffee trickIncident 2. 3.2The rules are the attack surfaceConcept 3. 3.3My best "that's not a bug, that's the rules" momentMy story 4. 3.4Why "think like an attacker" usually means "think about the rules", then breaking the shop's math togetherLive Week 3 labLoophole badge, title Investigator The negative order The moonmart rewards shop. You file an abuse case: what rule was missing, what did you do, and what's the fix? Extra challenge: redeem a "one time only" coupon twice. 5. ### Week 4: Injection: cross-site scripting Up to now it's been rules. This week it's input: when a site shows what you typed as code instead of text, your message runs for everyone who sees it. 1. 4.1The worm that made a million friendsIncident 2. 4.2Your bio shouldn't be able to run codeConcept 3. 4.3The most surprising place I've seen input get renderedMy story 4. 4.4The Samy story, stored versus reflected, then signing the guestbook with something that isn't textLive Week 4 labSignal badge The running message The campfire guestbook. You file an XSS write-up: what happened, why it worked, and the one-line fix. Extra challenge: a search page that repeats what you typed, the reflected version of the same bug. 6. ### Week 5: OSINT: your own footprint The recon you've been doing on fake apps works on real people, including you. This week the lens turns around. 1. 5.1The map that showed too muchIncident 2. 5.2Your footprint is an attack surfaceConcept 3. 5.3What public posts gave away about one person, and how they could have stopped itMy story 4. 5.4How public posts add up to a profile, using a made-up personLive Week 5 labGhost badge, title Operative Your own footprint With a guardian's opt-in, you look up what's public about yourself. Without it, you use a sample profile. You file a personal footprint report: what did you find, what's the risk, what will you change? 7. ### Week 6: IDOR: ownership A server that finds things by number but never checks who owns them will hand over someone else's stuff the moment you change the number. 1. 6.1885 million documents, one digit at a timeIncident 2. 6.2The number is not permissionConcept 3. 6.3An IDOR I foundMy story 4. 6.4"I can see it" versus "I'm allowed to see it", then opening a notebook and changing the numberLive Week 6 labGatekeeper badge The next notebook The little-notes notebook. You file a reproducible finding: exact steps, the impact, the one-line fix. Extra challenge: change who the server thinks you are. 8. ### Week 7: Capstone, report and disclosure Everything so far in one place, then the part the course builds toward: you found it, so find the right person and tell them the right way. 1. 7.1The kid who found the bugIncident 2. 7.2The report and the email are the skillConcept 3. 7.3The best and worst disclosures I've seenMy story 4. 7.4What a great report reads like, how to find the right person, then the capstone briefLive Week 7 labDisclosed badge, titles Reporter and Disclosed The capstone and a fake company One app with several of the last six weeks' bugs hidden in it, and a fake company's website. You file a consolidated report, work out the right address from the site, and send a disclosure email. Then demo day, [FACT: demo day date]: you present your capstone to the cohort and their parents. How To Be Good: $349 USD, one time, charged only if the application is accepted. The winter cohort starts January 11. Live sessions: Tuesdays, 7 to 8:30 PM Eastern. Applications for the winter cohort close Dec 18. Apply at https://bugclubhq.com/apply Applications for the winter cohort close Dec 18 ## The winter cohort $349 one time, only if accepted **Starts:** January 11 **Schedule:** Tuesdays, 7 to 8:30 PM Eastern **Class size:** 6 students [Apply for the winter cohort](https://bugclubhq.com/apply) Free to apply, about five minutes. You only pay if you're accepted. A week up close ## Practice apps that were built to be broken Each lab is a small app with a bug planted in it on purpose. It runs inside BugClub HQ, so nothing you do there can reach a real site. 1. ### Predict Before the lab tools unlock, you write down what you expect to happen and why. Being wrong is fine. It's honestly the best part. 2. ### Tamper and observe X-ray shows what the page is hiding. The request panel lets you change what gets sent and watch what the server does with it. 3. ### Write it up The lab hands you straight to the write-up: seven fields, one page. I write back on every one. It passes, or it comes back as almost there, which just means one more pass. 4. ### Check the fix, for a bonus Every practice app has a patched version. Send the same request there and watch the server refuse it. Finding the bug is the win. Proving the fix works is a bonus. The one exception is week 5, when you look up what's public about yourself, and only with a guardian's opt-in. Without it, you use a sample profile. What you leave with ## Work you can show, in a case file that stays yours No accredited certificate. You keep the work, and the habit behind it: get permission, prove it harmlessly, stop, tell the right person. - ### A write-up for every week Week 0 to week 7, seven fields on one page each time, with feedback from me on every one. - ### A capstone report and a disclosure email One report on an app with several bugs hidden in it, then a disclosure email to a practice company that writes back. - ### A case file that stays yours Every write-up, note and badge in one place. It's still there after the cohort ends. - ### Badges, titles and a findings count A badge each week, a title that climbs from Cadet to Disclosed, and a findings count that only goes up. Nobody gets ranked against anybody. Who teaches ## One instructor, start to finish [FACT: headshot] Josh [FACT: surname] Instructor [FACT: one-line background] [More about Josh](https://bugclubhq.com/about) I teach the readings, run every live session, read every application and write the feedback on every write-up. In week 7 I also play the fake company that answers each student's disclosure email. In [FACT: conviction year] I went to federal prison for internet piracy. I'd rather you hear it from me than find it on your own. It's the reason week 0 is about permission: I know exactly where that line is, and I want every student to stay on the right side of it. - [Why week 0 is about permission](https://bugclubhq.com/blog/week-zero-permission) - [How I work with students](https://bugclubhq.com/about) Pricing ## One price, paid once $349 covers the whole course, and nothing is charged unless your kid is accepted. ### How To Be Good $349 USD One payment. No subscription, nothing else to buy. [Apply for the winter cohort](https://bugclubhq.com/apply) Free to apply, about five minutes. Includes - Seven live sessions and the recordings - A lab every week, plus extra challenges - Feedback from me on every write-up - A case file that stays theirs, and a parent account ### How paying works 1. #### Apply for free About five minutes. No account, no card. 2. #### Hear back within 5 business days If it looks like a fit, I'll set up a short call. A parent or guardian joins it. 3. #### Pay once your kid is accepted I'll send you an invoice. [FACT: payment method] Receipts and any refund show up in your parent account. ### Refunds Full refund any time during the first four weeks (through [FACT: refund deadline]). I'll ask why, but the answer doesn't change whether you get it. The details are in the [refund policy](https://bugclubhq.com/refunds). ### Help with the cost If $349 is a problem, tell me on the call or email [hello@bugclubhq.com](mailto:hello@bugclubhq.com?subject=Help%20with%20the%20cost%20of%20BugClub%20HQ). [FACT: what help looks like, e.g. lower price or sponsored seat] It has no effect on whether your kid is accepted. ### Sponsored seats Schools, employers and scholarship programs can pay for seats, so families pay nothing. Email [hello@bugclubhq.com](mailto:hello@bugclubhq.com?subject=Sponsoring%20seats%20at%20BugClub%20HQ) to set one up. ## Applications for the winter cohort close Dec 18 A class of 6, one instructor, eight weeks. Applying is free and takes about five minutes. [Apply for the winter cohort](https://bugclubhq.com/apply)[For parents](https://bugclubhq.com/parents)