- URL: https://www.hacker101.com/
- By: HackerOne
- Type: Videos + CTFs with badges redeemable for private program invitations
- Recommendation: Mandatory starting point; the CTFs teach report thinking, not just exploitation
- URL: https://hackerone.com/hacktivity
- Type: Public disclosed reports, filterable by program/type/severity
- Use: Review before reporting (avoid duplicates) and to study how to write a report that gets paid quickly
- URL: https://hackerone.com/directory/programs
- Type: Public program listings with scope, policies, and response statistics
- Recommendation: Filter by "response efficiency" and average bounty before choosing where to invest time
- URL: https://github.com/reddelexc/hackerone-reports
- Type: Index of disclosed HackerOne reports, searchable by technology/vulnerability
- Use: Search for previous reports on the same technology/CMS/framework used by the target
- Bug Bounty Bootcamp - Vickie Li (book, complete methodology recon → report)
- The Bug Hunter's Methodology (TBHM) - Jason Haddix (talks and repo, large-scale recon reference)
- URL: https://www.hackthebox.com/
- Level: Intermediate-Advanced
- Type: Machines, Challenges, Labs
- Recommendation: Start with Easy and Medium machines
- URL: https://tryhackme.com/
- Level: Beginner-Intermediate
- Type: Learning Paths, Rooms
- Recommendation: Follow the "Complete Beginner" or "Jr Penetration Tester" path
- URL: https://www.vulnhub.com/
- Level: Variable
- Type: Downloadable VMs
- Recommendation: Download and practice in your local lab
- URL: https://overthewire.org/wargames/
- Level: Beginner
- Type: Wargames (Bandit, Natas, Leviathan)
- Recommendation: Start with Bandit to learn Linux
- URL: https://pentesterlab.com/
- Level: Intermediate
- Type: Exercises and badges
- Recommendation: Excellent for web hacking practice
- URL: https://picoctf.org/
- Level: Beginner-Intermediate
- Type: CTF challenges
- Recommendation: Ideal for learning fundamental concepts
- URL: https://www.offensive-security.com/pwk-oscp/
- Level: Intermediate-Advanced
- Focus: Practical pentesting
- Preparation: PEN-200 course + 90 days of lab
- URL: https://www.eccouncil.org/programs/certified-ethical-hacker-ceh/
- Level: Intermediate
- Focus: Ethical hacking theory and practice
- URL: https://www.comptia.org/certifications/pentest
- Level: Intermediate
- Focus: Pentesting methodology
- John Hammond - CTF walkthroughs
- IppSec - HackTheBox walkthroughs
- NetworkChuck - Networking and hacking
- The Cyber Mentor - Pentesting from scratch
- "The Web Application Hacker's Handbook" - Dafydd Stuttard
- "Metasploit: The Penetration Tester's Guide" - David Kennedy
- "Hacking: The Art of Exploitation" - Jon Erickson
- "Penetration Testing" - Georgia Weidman
- PortSwigger Web Security Academy - https://portswigger.net/web-security
- OWASP Testing Guide - https://owasp.org/www-project-web-security-testing-guide/
- HackTricks - https://book.hacktricks.xyz/
# View all tools
ls /usr/share/wordlists/
# Wordlists
/usr/share/wordlists/rockyou.txt
/usr/share/wordlists/dirb/common.txt
/usr/share/seclists/Discovery/Web-Content/- PayloadsAllTheThings: https://github.com/swisskyrepo/PayloadsAllTheThings
- GTFOBins: https://gtfobins.github.io/ (Linux privilege escalation)
- LOLBAS: https://lolbas-project.github.io/ (Windows privilege escalation)
- RevShells: https://www.revshells.com/ (Reverse shell generator)
- Reddit: r/netsec, r/hacking, r/AskNetsec
- Discord: HackTheBox, TryHackMe servers
- Forums: Exploit-DB, OffSec Forums
- Monday: 1 hour of TryHackMe/HackTheBox
- Tuesday: Practice tools (nmap, metasploit)
- Wednesday: Read a security article
- Thursday: Solve 1-2 CTF challenges
- Friday: Document findings and learn
- Weekend: Personal project or full CTF