all career tracks
// career track
Bug Bounty Hunter
Web + API + mobile attack surface — earn cash by reporting real-world bugs to HackerOne / Bugcrowd programs.
5
stages
0/5
complete
3
aligned certs
// curriculum path
- 1Web App PentestBeginneravailable · start
Master OWASP top-10 fundamentals before touching real targets.
- 2Web App PentestIntermediatelocked
Chain bugs — SSRF → cloud metadata, IDOR auth bypasses, auth flaws.
- 3Web App PentestAdvancedlocked
Race conditions, blind SSRF, GraphQL & WebSocket attacks.
- 4Mobile PentestBeginnerlocked
iOS & Android attack surface — most bounty programs include mobile.
- 5Web App PentestExpertlocked
Custom exploitation, deserialisation, prototype pollution at scale.