# Ethical hacking for beginners

Everything in ethical hacking depends on permission, so start there. Then practice, then bugs, then how to report what you find.

[Start with the first guide](https://bugclubhq.com/learn/what-is-ethical-hacking)

## Six guides, in order

1. [1 What is ethical hacking? Finding security bugs where you have permission to look, then reporting them to the people who can fix them.](https://bugclubhq.com/learn/what-is-ethical-hacking)
2. [2 Where can you practice with permission? Being able to open a website doesn't mean you're allowed to test it. These are the questions to ask before you touch anything.](https://bugclubhq.com/learn/safe-hacking-practice)
3. [3 What is a business logic bug? The code runs fine and does exactly what it was told. Nobody told it the rule.](https://bugclubhq.com/learn/business-logic-bugs)
4. [4 What is an IDOR? An ID tells the server which record you want. It doesn't say you're allowed to have it.](https://bugclubhq.com/learn/idor-explained)
5. [5 What is cross-site scripting? A browser can't tell a stranger's words from the site's own code unless the site marks them as text.](https://bugclubhq.com/learn/xss-explained)
6. [6 A vulnerability report example, with notes One bug in a practice shop, written up the way I ask my students to, with notes on each part.](https://bugclubhq.com/learn/vulnerability-report-example)

## Reading, practice and a class

### Reading

Reading is free, and it shows you how a bug happens without touching anything.

### Practice

Practice means testing an app built to be broken, with permission and inside its rules.

### A class

Joining a class is paid, and it adds a live group and someone who reads your work. In my course, that's me.

- [The ethics agreement](https://bugclubhq.com/ethics)
- [Other ways to learn](https://bugclubhq.com/alternatives)