Skip to content

Ethical hacking, week by week

Spend eight weeks finding security bugs, explaining why they happen and writing reports a developer can follow. Start with no coding experience and practice in your browser. Adults, college students and high school students learn in separate groups. Ages 14 and up.

Apply for the winter term See the eight weeks

Free to apply, about five minutes. $399 only if you're accepted. Full refunds are available during the first four weeks.

Applications for the winter term close Dec 18

What you'll practice each week

Week 0 is self-paced. Weeks 1 to 6 each have readings, a 90-minute live session, a set of labs and a write-up. Week 7 is one capstone app, a report and a disclosure email. All three groups follow the same curriculum on separate nights. Plan on about 4 hours a week, with extra sandbox challenges when you want more practice.

Read how a bug happens, then test it yourself in a practice app. See how lessons work.

Open any week for its lessons and labs.

  1. Welcome: permission, the job and your first bugs You learn what makes hacking legal, how bug bounties work and how a website really talks, then find your first bugs at a fake support company.
    1. 0.1Permission is the whole jobReading
    2. 0.2How bug bounties workReading
    3. 0.3What this job actually isReading
    4. 0.4You don't need to code, you need to thinkReading
    5. 0.5How a website really talksReading
    6. 0.6Never trust the userReading
    7. 0.7How the platform worksTour

    Week 0 labs First Bug badge, title Cadet

    Harbor Desk: your first bugs

    Five guided labs at a fake support company, each one teaching one tool. Then you file your first bug report. Before week 1 opens, you sign the ethics agreement. If you're under 18, a parent or guardian signs it too.

  2. Trust: what does the server believe? Some servers believe whatever the page sends. You change what the page sends and watch what the server does with it.
    1. 1.1The day GitHub believed a strangerIncident
    2. 1.2Hidden fields aren't hiddenConcept
    3. 1.3All the places a page can lieConcept
    4. 1.4What a reply is telling youConcept
    5. 1.5A worked example: the free trialExample
    6. 1.6How I'd test a formMethod
    7. 1.7Proving it without taking anythingConcept
    8. 1.8The Homakov story, then changing a hidden price in the shop togetherLive

    Week 1 labs Trust Breaker badge, title Scout

    Driftwood Goods: the checkout

    Five labs in a fake home goods shop, plus a sixth with no hints if you want it. Then you file a finding on the hidden price: what did the shop assume, and what happened when the assumption was false?

  3. Ownership: whose is this? A server that looks up records by number and never checks who owns them gives you someone else's record when you change the number.
    1. 2.1885 million documents, one digit at a timeIncident
    2. 2.2Parler, one number at a timeIncident
    3. 2.3An id is an addressConcept
    4. 2.4All the ways this bug shows upConcept
    5. 2.5A worked example: the trip planExample
    6. 2.6How I'd test who owns whatMethod
    7. 2.7"I can see it" versus "I'm allowed to see it", then opening an order and changing the numberLive

    Week 2 labs Gatekeeper badge

    Driftwood Goods: customer accounts

    Five labs on customer accounts in the same shop, plus a sixth with no hints. Then you file a reproducible finding: the exact steps, the impact and the fix.

    Read the free guide to IDOR

  4. Identity: how does it know it's you? A website can't see your face. You test every way into an account and ask what each one really checks.
    1. 3.1The Friday Mat Honan got erasedIncident
    2. 3.2Proving it once, then rememberingConcept
    3. 3.3Every door into an accountConcept
    4. 3.4A worked example: the password that didn't end anythingExample
    5. 3.5How I'd test a loginMethod
    6. 3.6Enumeration as a mindset: try usernames that exist and ones that don't, and read the differenceLive

    Week 3 labs Ghost badge, title Investigator

    Kestrel Mail: logins and recovery

    Five labs at a fake webmail company, plus a sixth with no hints. Then you file a finding with a severity you can defend.

  5. Rules: what did nobody think of? Some of the worst bugs break nothing. The site does what it was built to do, in a way nobody pictured.
    1. 4.1$15 in, $16.70 outIncident
    2. 4.2The rule nobody wrote downConcept
    3. 4.3All the rules nobody wrote downConcept
    4. 4.4A worked example: the walk that already happenedExample
    5. 4.5How I'd test the rulesMethod
    6. 4.6Why "think like an attacker" usually means "think about the rules", then breaking the rewards app's math togetherLive

    Week 4 labs Loophole badge

    Copperline Coffee: the rewards app

    Five labs in a fake coffee chain's rewards app, plus a sixth with no hints. Then you file an abuse case and write the fix as a rule.

    Read the free guide to bugs in the rules

  6. Injection: words or instructions? When a site treats what you typed as instructions instead of text, your words run for everyone who sees them. You paste test strings, so there's nothing to program.
    1. 5.1The worm that made a million friendsIncident
    2. 5.2The pages nobody was looking atIncident
    3. 5.3Words or instructionsConcept
    4. 5.4The test string cardReference
    5. 5.5Everywhere your words end upConcept
    6. 5.6A worked example: the dog walker reviewExample
    7. 5.7How I'd test a boxMethod
    8. 5.8The Samy story, stored versus reflected, then posting something to the board that isn't textLive

    Week 5 labs Signal badge, title Operative

    Maple Street Board: words and instructions

    Five labs on a fake neighborhood noticeboard, plus a sixth with no hints. Then you file an XSS write-up: who it runs for, how you proved it harmlessly and the fix.

    Read the free guide to cross-site scripting

  7. Recon: what can anyone already see? You read what a fake company left in public, then report what an attacker could learn and what the company should take down.
    1. 6.1The map that showed too muchIncident
    2. 6.2The reporter who read a web pageIncident
    3. 6.3Recon is mostly readingConcept
    4. 6.4Everywhere a company leaves things lying aroundConcept
    5. 6.5A worked example: the door listExample
    6. 6.6How I'd test what's publicMethod
    7. 6.7How a company's public trail adds up, using a made-up companyLive

    Week 6 labs Cartographer badge

    Juniper Dispatch: the public trail

    Five labs from the outside with no account, plus a sixth with no hints. You follow a public trail through a team page, an employee's profile and a code repository. Then you file a recon report: where did you look, what does it add up to, and what should the company take down?

  8. Capstone: who do I tell, and how? One app has seven bugs in it, one for each kind of problem you've met. You write one report on them, work out who to contact at a fake company, and send them a disclosure email.
    1. 7.1The kid who found the bugIncident
    2. 7.2Worst first: how to order a reportConcept
    3. 7.3Finding the right personConcept
    4. 7.4A worked example: the link that wouldn't dieExample
    5. 7.5How I'd test a whole appMethod
    6. 7.6When a company goes quiet or gets angryConcept
    7. 7.7What comes after the courseConcept
    8. 7.8What a great report reads like, how to find the right person, then the capstone briefLive

    Week 7 lab Disclosed badge, titles Reporter and Disclosed

    Rollcall: the capstone

    You get one app with seven bugs hidden in it, no hints, and a fake company's website. You file one report on the bugs, work out the right address from the site, and send a disclosure email. Demo day is the week of March 8, on each group's own night. You present your capstone to your group, and parents and guardians of students under 18 get an invite.

    Read an annotated example report

How To Be Good: $399 USD, one time, charged only if I accept the application.

The winter term starts January 11. Applications for the winter term close Dec 18.

One 90-minute live session a week, on each group's own night. Adults: Tuesdays, 8:15 to 9:45 PM Eastern. College students: Wednesdays, 6 to 7:30 PM Eastern. High school students: Thursdays, 5:30 to 7 PM Eastern.

Apply at https://bugclubhq.com/apply

Applications for the winter term close Dec 18

The winter term

$399 one time, only if accepted

Starts
January 11
Schedule
  • Adults: Tuesdays, 8:15 to 9:45 PM Eastern
  • College students: Wednesdays, 6 to 7:30 PM Eastern
  • High school students: Thursdays, 5:30 to 7 PM Eastern
Class size
Up to 12 per group
Apply for the winter term

Free to apply, about five minutes. Payment comes after acceptance.

Practice apps that were built to be broken

Each lab is a small app with a bug planted in it on purpose. It runs inside BugClub, so nothing you do there can reach a real site.

  1. 1

    Predict

    Before the lab tools unlock, you write down what you expect to happen and why. A wrong prediction counts the same as a right one.

  2. 2

    Tamper and observe

    X-ray shows what the page is hiding, right on the page. Change it, send it and watch what the server does.

  3. 3

    Write it up

    One lab each week takes you straight to the write-up, which is one page with seven fields. I give feedback on every one. It either passes or comes back as almost there, which means one more round.

  4. 4

    Check the fix, for a bonus

    Every lab has a patched version. Send the same request there and watch the server refuse it. Finding the bug is what counts. Proving the fix works is a bonus.

Week 6 is recon on a fake company's public trail, and it runs inside BugClub too.

I made this example up. No student wrote it.

Finish with reports you can explain

Your Case File keeps your reports and notes together for a year after the course ends. Each report gives you practice documenting a bug so someone else can understand and fix it. The course does not include an accredited certificate.

  • A write-up for every week

    You write one each week, from week 0 to week 7, and each gets my feedback.

  • A capstone report and a disclosure email

    You write one report on an app with seven bugs hidden in it. Then you send a disclosure email to a fake company. I reply to every one as the company, the way a real bug bounty program would.

  • Your Case File

    Every write-up, note and badge is in one place, and it stays open for a year after the course ends.

  • Badges, titles and a findings count

    You earn a badge each week and a title that climbs from Cadet to Disclosed. Your findings count only goes up, and nobody gets ranked against anybody.

One instructor, start to finish

Josh Brody

Instructor

I've written software for about 20 years and reported security bugs through bug bounty programs.

More about Josh

You get feedback from the same instructor who teaches your lessons and runs your live sessions. I read every write-up in all three groups. In week 7, I reply to your disclosure email as the fake company you've researched.

I went to federal prison for hacking and internet piracy after a conviction in 2023. That experience is why the course starts with permission and keeps all practice inside BugClub.

One price, paid once

$399 USD covers all eight weeks, seven live sessions and feedback on every write-up. You also keep your sandboxes for a year after the course ends. You pay only if you're accepted.

There's no subscription and nothing else to buy. You can get a full refund any time during the first four weeks. Help with the cost and sponsored seats are available.

See pricing, everything it includes and help with the cost

Applications for the winter term close Dec 18

Apply to learn in a group of up to 12, with feedback on your work for all eight weeks. Applying is free and takes about five minutes.

Apply for the winter term Questions about joining