KaraboSec_
Back to Blog
What to learn before starting bug bounty hunting - prerequisites for ethical hacking and penetration testing

Blog

What to Learn Before Starting Bug Bounty / Ethical Hacking / Penetration Testing

12 min read
#bugbounty#pentesting#ethicalhacking#beginner#websecurity

One of the most common questions I get from aspiring hackers is: what do I need to know before I start bug bounty hunting? The answer is not as complicated as some people make it. You do not need a computer science degree or years of professional experience. But you do need a solid foundation in a few key areas.

Networking Fundamentals

You cannot hack what you do not understand. Networking is the language computers use to communicate, and every vulnerability exists within the context of network communication. If you do not understand how data moves from your browser to a server and back, you will struggle to understand why certain attacks work.

  • TCP/IP — how connections are established (three-way handshake), ports, and the difference between TCP and UDP.
  • DNS — how domain names resolve to IP addresses. DNS rebinding, subdomain takeover, and DNS poisoning all require DNS knowledge.
  • HTTP/HTTPS — request methods, headers, status codes, cookies, sessions. You need to read HTTP like a native language.
  • TLS/SSL — how encryption works, certificate validation, and common misconfigurations.
  • Subnetting and network addressing — understanding CIDR, private vs public IPs, and network segmentation.

You do not need to be a network engineer. Focus on the practical aspects that come up in web hacking: how Burp Suite intercepts traffic, how to read HTTP request and response headers, what DNS record types mean, and how SSL/TLS certificates work.

Linux Command Line Basics

Linux is the operating system of choice for security professionals. Almost every hacking tool is built for Linux first. You need to be comfortable with the command line, not just clicking buttons.

  • File navigation and manipulation: ls, cd, cat, grep, find, sed, awk
  • File permissions: chmod, chown, understanding read/write/execute
  • Process management: ps, top, kill, backgrounding with & and nohup
  • Package management: apt, pip, git clone
  • Networking tools: curl, wget, netstat, ss, tcpdump, nmap
  • Shell scripting: variables, loops, conditionals, pipes and redirection

Install Kali Linux or another security-focused distribution in a virtual machine and force yourself to use the terminal for everything. When you reach for the mouse, find the command-line way to do it instead.

Basic Scripting (Python/Bash)

You do not need to be a software engineer, but you should be able to write simple scripts. The ability to automate repetitive tasks — parsing tool output, sending crafted HTTP requests, brute-forcing parameters — is what separates efficient hunters from manual testers who burn out after three hours.

Python is the most useful language for security work. Learn the requests library for HTTP interactions, argparse for building CLI tools, and basic string manipulation. Bash scripting is equally important for piping commands together and processing text output.

# Python example: simple HTTP probe
import requests

urls = open("targets.txt").read().splitlines()
for url in urls:
    try:
        r = requests.get(f"https://{url}", timeout=5)
        print(f"{url} -> {r.status_code} ({len(r.text)} bytes)")
    except:
        print(f"{url} -> FAILED")

How Websites Work

Web application security is the most accessible entry point into bug bounty hunting. But to exploit web apps, you need to understand how they are built. You have to think like both the developer and the attacker.

  • Client-server architecture — the browser sends requests, the server processes them and returns responses.
  • Frontend vs backend — HTML/CSS/JavaScript in the browser vs server-side code in PHP, Python, Java, Node.js.
  • APIs — RESTful endpoints, JSON/XML payloads, authentication via API keys or JWT tokens.
  • Databases — how the server stores and retrieves data. SQL is the most common query language.
  • Authentication and authorization — sessions, cookies, tokens, and the difference between who you are and what you can do.

The best way to learn this is to build a simple web application yourself. Create a basic login page with a database backend. Once you understand how it works from the developer perspective, you will immediately see where the vulnerabilities are.

OWASP Top 10 Vulnerabilities

The OWASP Top 10 is the standard awareness document for web application security. Learn each vulnerability category, understand how it works at a technical level, and practice exploiting it in a lab environment.

  1. Broken Access Control — can you access data you should not have access to?
  2. Cryptographic Failures — weak encryption, exposed sensitive data in transit or at rest.
  3. Injection — SQL, NoSQL, OS command, LDAP injection. Always sanitize user input.
  4. Insecure Design — architectural flaws that lead to vulnerabilities.
  5. Security Misconfiguration — default credentials, unnecessary services, verbose error messages.
  6. Vulnerable and Outdated Components — outdated libraries with known CVEs.
  7. Identification and Authentication Failures — weak password policies, session management issues.
  8. Software and Data Integrity Failures — compromised dependencies, unsigned updates.
  9. Security Logging and Monitoring Failures — missing audit trails, insufficient incident detection.
  10. Server-Side Request Forgery (SSRF) — tricking the server into making requests to internal resources.

PortSwigger Web Security Academy has free, interactive labs for every OWASP Top 10 category. Go through them one by one. Do not move on until you understand why each vulnerability works and how to fix it.

Setting Up Your Home Lab

Before you touch a live bug bounty program, set up a lab where you can break things without consequences. Here is what a minimal home lab looks like.

  • VirtualBox or VMware — run multiple virtual machines on your host machine.
  • Kali Linux — your attack machine with pre-installed security tools.
  • Metasploitable 2 — deliberately vulnerable Linux VM for practicing exploitation.
  • DVWA or bWAPP — deliberately vulnerable web applications for practicing web attacks.
  • TryHackMe or Hack The Box — structured, legal environments with guided challenges.
# Install Docker-based vulnerable labs
docker pull vulnerables/web-dvwa
docker run -d -p 80:80 vulnerables/web-dvwa

docker pull webgoat/goatandwolf
docker run -d -p 8080:8080 webgoat/goatandwolf

Final Checklist Before Starting

Before you submit your first bug bounty report, make sure you can check off each of these:

  • Can I use Burp Suite to intercept and modify HTTP requests?
  • Can I find and exploit at least 5 of the OWASP Top 10 in a lab environment?
  • Can I write a Python script that sends a custom HTTP request and parses the response?
  • Do I understand the scope of a bug bounty program and what is out of bounds?
  • Can I write a clear, reproducible bug report that a developer could understand and fix?
  • Have I read the bug bounty program disclosure guidelines and responsible disclosure policies?

If you can answer yes to all of these, you are ready. Start with the Bugcrowd University content and the programs listed on HackerOne and Bugcrowd that welcome beginner hunters. Your first bounty might take weeks to find, but once you find it, you will understand why the preparation was worth every hour.

Remember: every professional hacker started exactly where you are right now. The difference between those who succeed and those who quit is not talent — it is consistency. Show up every day, break one thing, learn one lesson, and write about it. Do that for a year and you will be unstoppable.