Skip to content

Ethical hacking for beginners

Everything in ethical hacking depends on permission, so start there. Then practice, then bugs, then how to report what you find.

Start with the first guide
candle-shop.lab/checkout
Candle
$10.00
Quantity sent
-2

Order placed. Total: -$20.00.

Why the shop paid you
pet-clinic.lab/records/2042
Signed in as
Mia
Asking for
2042

Here are Pickles' visit notes. They belong to Theo.

Why Mia can read them
guestbook.lab
Alex typed
<b>hello</b>

Alex wrote: hello

Why the word came out bold

Made up. These apps don't exist, and real sites are not practice targets.

Six guides, in order

  1. 1 What is ethical hacking? Finding security bugs where you have permission to look, then reporting them to the people who can fix them.
  2. 2 Where can you practice with permission? Being able to open a website doesn't mean you're allowed to test it. These are the questions to ask before you touch anything.
  3. 3 What is a business logic bug? The code runs fine and does exactly what it was told. Nobody told it the rule.
  4. 4 What is an IDOR? An ID tells the server which record you want. It doesn't say you're allowed to have it.
  5. 5 What is cross-site scripting? A browser can't tell a stranger's words from the site's own code unless the site marks them as text.
  6. 6 A vulnerability report example, with notes One bug in a practice shop, written up the way I ask my students to, with notes on each part.

Reading, practice and a class

Reading

Reading is free, and it shows you how a bug happens without touching anything.

Practice

Practice means testing an app built to be broken, with permission and inside its rules.

A class

Joining a class is paid, and it adds a live group and someone who reads your work. In my course, that's me.

The course behind these guides

BugClub HQ is an eight-week online course in ethical hacking for anyone 14 and up. It runs in three groups, for high school students, college students and adults, and each one meets on its own night. You practice on apps with bugs put there on purpose, write up what you find, and get my feedback on every write-up. You don't need to know how to code.

Applications for the winter term close Dec 18

The winter term

$399 one time, only if accepted

Starts
January 11
Schedule
  • High school students: Thursdays, 5:30 to 7 PM Eastern
  • College students: Wednesdays, 6 to 7:30 PM Eastern
  • Adults: Tuesdays, 8:15 to 9:45 PM Eastern
Class size
Up to 12 per group
Apply for the winter term

Free to apply, about five minutes. You pay only if I accept the student.