Hacker101

What it is

Hacker101 is a free web application security training platform run by HackerOne. It combines a library of video lessons covering common web vulnerability classes and testing methodology with a capture-the-flag exercise, hosted as a set of intentionally vulnerable web applications, where lessons learned from the videos can be applied hands-on in a legal, self-contained environment.

Who it is for

HackerOne pitches it at two audiences: programmers who want to understand security well enough to either build more secure software or start looking at bug bounty work, and people who already have some security background but want structured material specific to bug bounty style testing. The video content ranges from fairly introductory topics up to more advanced vulnerability classes.

How to use it

Work through the video lessons in order first, since later material builds on concepts introduced earlier, then attempt the CTF levels, which are hosted by HackerOne for exactly this purpose. HackerOne has linked CTF progress to invitations to private programmes on its platform; check the current terms on the site. Treat the CTF as the place to actually practise a technique just covered in a video, rather than skipping straight to it.

Free versus paid

Hacker101 is entirely free, with no account fee, subscription or paid tier; HackerOne funds it as a way of growing the pool of skilled researchers on its platform.

Before your first real bug bounty programme

Once you feel ready to look at a live programme, read HackerOne's own vulnerability disclosure guidelines first, covering what a reasonable proof of concept looks like, what should never be included in a report, and how coordinated disclosure timelines generally work. Every individual programme also publishes its own scope, listing exactly which assets and vulnerability classes are in or out of bounds, and testing anything outside that scope is not authorised even on a platform built for this purpose. Only test systems you own or are explicitly authorised to test: your own lab, a CTF, or an in-scope bug bounty programme. A programme's policy, including any safe harbour statement, is what makes your testing authorised.

An alternative worth knowing

Bugcrowd runs a comparable free training programme called Bugcrowd University, covering similar hands-on web hacking fundamentals through modules and webinars. It is not part of Hacker101, but is worth knowing about as a second free option with a slightly different style of material.

Prerequisites

Some comfort with how web applications work, such as what a request and response are, helps the early lessons make sense faster, though Hacker101 does not assume prior security experience.

Common questions

Do I need to finish the CTF to start bug hunting? No, but the CTF is a safe place to build confidence before you read your first real programme policy.

Will Hacker101 lead to bounty income? There is no guarantee. Most new hunters spend a long time learning before a first valid report, and many valuable reports earn thanks rather than money. Treat it as learning web security, not as a side income.

Does HackerOne charge researchers anything? No, researchers pay nothing to use the platform or to submit reports; bounty payments flow from the participating company to the researcher.