|
| 1 | +--- |
| 2 | +title: "Hacker Success Guide" |
| 3 | +path: "/hackers/hacker-success-guide.html" |
| 4 | +id: "hackers/hacker-success-guide" |
| 5 | +--- |
| 6 | + |
| 7 | +New to hacking or want to sharpen your skills? We’ve created this leveling up guide to help you grow as a hacker and be on your way to earning your first bounties. |
| 8 | + |
| 9 | +### Steps |
| 10 | +1. [Create a HackerOne account](create-an-account.html). |
| 11 | +2. Go to [Hacker101](https://www.hacker101.com/). |
| 12 | +3. Get started on the [Newcomers Playlist](https://www.hacker101.com/playlists/newcomers) if you’re new to hacking or want a refresher on web hacking basics. |
| 13 | +4. Learn about and set up Burp suite through the [Burp Suite playlist](https://www.hacker101.com/playlists/burp_suite). |
| 14 | +5. Watch the [Hacker101 videos](https://www.hacker101.com/videos) to be educated on various topics related to hacking so that you can have a broad range of knowledge and understanding of the different areas of hacking. |
| 15 | + |
| 16 | +> **Note:** Depending on how you learn, there are 2 approaches you can take in watching the Hacker101 videos:<br> *1) Watch first, implement right away.* Get started on the Hacker101 CTF (see step 6) as you concurrently learn from the videos. After watching each video lesson, you can implement the skill you learned from that lesson directly to the CTF. <br> *2) Watch everything, then implement.* Watch all of the videos first and then implement the skills you’ve learned to the CTF. |
| 17 | +
|
| 18 | +6. Start the [Hacker101 CTF](https://ctf.hacker101.com/) (Capture the Flag) game where you can hack and hunt for bugs in a safe environment. [Learn how to get started with the Hacker101 CTF](hacker101.html#hacker101-ctf). |
| 19 | + * Every time you earn 26 points in the CTF, you’ll be put in the [invitation priority queue](invitations-priority-queue.html) to receive invitations to private programs. Once you receive and accept an invitation to a private program, you’ll be taken out of the priority queue until you earn another 26 points to be put back in the queue. |
| 20 | + |
| 21 | +7. Join the Hacker101 HackerOne [Discord group](https://www.hacker101.com/discord) to ask questions, connect, and learn from other hackers. |
| 22 | +8. Finish the Hacker101 CTF. Even if you’ve already received an invitation to a private bug bounty program, we recommend going through all of the CTF curriculum to ensure you learn all of the concepts, so that you can better succeed at hacking. |
| 23 | +9. Look for public programs in the [Directory](https://hackerone.com/directory/programs) that you’re interested to hack on. For starters, we suggest IBM, GM, DoD and Verizon Media. |
| 24 | + * For starters, we suggest: IBM, GM, DoD, and Verizon Media as good programs to start with. |
| 25 | +10. Start hacking and apply all that you’ve learned from Hacker101. |
| 26 | + |
| 27 | +> **Helpful tips:** Keep in mind that there are a lot of differences between hacking in the CTF and hacking in an actual bug bounty program. We understand that the scope is much larger when hacking in a live program, and that it’s hard figuring out where to start or look, but we encourage you to just keep practicing. Here are some recommended reads and resources that may help in your journey to hacking: |
| 28 | +* *Web Hacking 101* by Peter Yaworski |
| 29 | +* *The Web Application Hacker's Handbook* by Dafydd Stuttard and Marcus Pinto |
| 30 | +* *The Hacker Playbook 2: Practical Guide To Penetration Testing* by Peter Kim |
| 31 | +* *Hacking: The Art of Exploitation* by Jon Erickson |
| 32 | +* *The Basics of Hacking and Penetration Testing* by Patrick Engebretson |
| 33 | +* *RTFM: Red Team Field Manual* by Ben Clark |
| 34 | +* Frans Rosen provides some insight as to how to win over security teams and gain influence as a hacker on https://hackerone.com/fransvisitsvegas. |
| 35 | + |
| 36 | +11. [Submit a report](submitting-reports.html) once you’ve found a vulnerability. Submitting valid reports is important for building up your [Reputation](reputation.html), [Signal and Impact](signal-and-impact.html). |
| 37 | + * Here’s a guide on what constitutes a [quality report](quality-reports.html). |
| 38 | + * You can look at [hacktivity](https://hackerone.com/hacktivity?order_field=popular) and past reports to understand what security teams look for in a quality report. |
| 39 | + |
| 40 | +Once you’ve submitted your first report, the security analyst will review, assess, and validate it. They will typically respond with questions and comments. As security teams handle many reports, it may take a little while to respond back to your report. We recommend giving teams at least a week before asking for updates. While you’re waiting to hear back, we encourage you to keep on hacking and to check out other programs. |
| 41 | + |
| 42 | +Happy hacking! |
0 commit comments