TL;DR: Learn hacking by practising one small technique at a time on a target you are allowed to attack. Learn enough HTTP to read a request, open a legal target such as CyberGym or your own site, solve one beginner challenge, work out how to fix it, then repeat. Courses and videos help, but the skill itself comes from sending a request, reading the response and deciding what to try next.
This is for complete beginners who want to learn hacking by doing it, without breaking the law. You will get a path from zero, an order to learn things in, and a real first session with the commands we ran and the things that surprised us.
One rule applies to everything below: test only systems you own or have written permission to test. The rules of legal hacking explain where that line sits and why.
How do I learn hacking from zero?
Follow five steps, and spend most of your time on the third and fourth. Each step gives you what the next one needs.
The path in this article. Steps three and four repeat for every challenge, and most of your learning happens there.
- Learn how the web talks. Understand requests, responses, status codes, headers and cookies. MDN's overview of HTTP is free and enough to begin.
- Pick a legal target. Choose one before you touch a tool, so you never have to guess whether a request is allowed.
- Solve one challenge. Form a guess, send one request and read what comes back.
- Fix it and retest. Work out which line of code let you in, change it, and send the same request again. This step separates a learner from someone copying a walkthrough.
- Test your own site. Write the scope down first, and report what you find as findings with evidence.
Do I need to know programming or Linux first?
No, but you do need to be able to read a web request and a little JavaScript. You can start with a browser, its developer tools and curl, all of which are free. Our CTF guide for beginners lists a small starter toolset; add to it only when something stops being enough.
Coding becomes more useful at step 4, because you cannot fix what you cannot read. You do not have to learn it first, though. In our experience, a real bug in front of you is a better reason to learn a language feature than an exercise is.
Where can I learn hacking legally and for free?
Three kinds of target are open to you: CyberGym and a copy of OWASP Juice Shop on your own machine, which are both free, and a site you own. Where to practice hacking legally compares them and covers the legal background.
CyberGym is the quickest start because it runs in your browser. It runs OWASP Juice Shop, an insecure web application built for security training, under its own branding. We read its challenge list on 5 November 2026: 110 hacking challenges on six difficulty levels, and 13 of them with a built-in tutorial.
What the CyberGym challenge list held on 5 November 2026. The 29 challenges at difficulty 1 and 2 are the place to start.
If you want a scoreboard that only counts your work, run Juice Shop locally. CyberGym is shared, so its ticks show everyone's progress. The Juice Shop README gives this Docker command, which binds the app to your own machine:
docker run --rm -p 127.0.0.1:3000:3000 bkimminich/juice-shop
Keep the 127.0.0.1 part. Without it, you could expose a deliberately vulnerable app to your whole network.
What should I learn first?
Start with reading the application, then move through one vulnerability class at a time. CyberGym's own tutorials make a sensible order, because they begin with difficulty 1 and build up:
| Order | What you learn | First challenges | Read more |
|---|---|---|---|
| 1 | Reading what the app exposes | Score Board, Privacy Policy | Glossary |
| 2 | Cross-site scripting | DOM XSS, Bonus Payload, Reflected XSS | XSS |
| 3 | Injection | Login Admin | SQL injection |
| 4 | Access control | Admin Section, View Basket | Broken access control |
Access control deserves time even though it appears late here: Broken Access Control is first and Injection is fifth in the OWASP Top 10:2025. Stay with one class until you can explain why each solve worked, then move on.
What does a first hacking session look like?
It looks like two small challenges, a mistake that taught something, and a note at the end. This is the session we ran on 5 November 2026.
We sent only read requests to the shared CyberGym. Anything that writes data ran on a private copy of the same 19.1.1 code on 127.0.0.1, which also gave us a clean scoreboard. The commands work on CyberGym or on your local Juice Shop, though a newer Juice Shop may differ. If you run them on CyberGym, keep the comment made up and free of personal details, because other people practise there too.
Challenge 1: find the exposed metrics
Read the challenge first. Exposed Metrics, difficulty 1, says to find the endpoint that serves usage data to a popular monitoring system, and it links to Prometheus. That gives you a guess to test: the app may use the default path, and Prometheus's documentation says it expects metrics at /metrics.
curl -s -o /dev/null -w '%{http_code} %{content_type}\n' https://cybergym.hackergpt.app/metrics
200 text/plain; version=0.0.4; charset=utf-8
No login was needed. Next, see what a stranger can learn from it, reading only the descriptions:
curl -s https://cybergym.hackergpt.app/metrics \
| grep -E '^# HELP cybergym_(version_info|users_registered_total|wallet_balance_total|orders_placed_total)'
# HELP cybergym_version_info Release version of CyberGym.
# HELP cybergym_orders_placed_total Number of orders placed in CyberGym.
# HELP cybergym_users_registered_total Total number of registered users.
# HELP cybergym_wallet_balance_total Total balance of all users' digital wallets.
This is the finding: business numbers and the exact software version, open to anyone. On our private copy, the app's own record went from "solved":false to "solved":true after that one request. The shared CyberGym already showed it solved, which is why a clean scoreboard is useful when you are learning.
Challenge 2: give a zero-star review
Zero Stars, also difficulty 1, asks for a rating the form does not offer. Start by reading what the browser enforces. The feedback page is at /#/contact, and its rules are in the JavaScript the app sends you:
curl -s https://cybergym.hackergpt.app/main.js | grep -o '"id","rating","min","1","max","5"'
"id","rating","min","1","max","5"
So the slider stops at 1, and the source shows the submit button stays disabled while the rating is 0. That gives one testable guess: the minimum exists only in the browser, so a request sent directly may not be checked at all.
The form also needs a CAPTCHA, so we asked for one:
TARGET=http://127.0.0.1:3000 # or https://cybergym.hackergpt.app
curl -s "$TARGET/rest/captcha"
{"captchaId":0,"captcha":"10-3-7","answer":"0"}
Our first surprise: the response includes the answer. A CAPTCHA that hands its answer to the client stops very little. We used that to build the request, starting with a valid rating of 1 to confirm the format, then changing that single value to 0:
CAPTCHA=$(curl -s "$TARGET/rest/captcha")
curl -s -i -X POST "$TARGET/api/Feedbacks" \
-H 'Content-Type: application/json' \
-d "$(jq -n --argjson c "$CAPTCHA" --argjson rating 0 \
'{comment:"Practice note (anonymous)", rating:$rating, captchaId:$c.captchaId, captcha:$c.answer}')" \
| sed -n '1p;$p'
HTTP/1.1 201 Created
{"status":"success","data":{"id":10,"comment":"Practice note (anonymous)","rating":0,"updatedAt":"2026-11-05T23:36:43.405Z","createdAt":"2026-11-05T23:36:43.405Z","UserId":null}}
Solved, and the guess held. Do not stop at the solve, though. Ask how far the flaw goes. We tried two more values, and the server accepted both with 201 Created: a rating of 6 and a rating of -1. So the problem is not a missing zero. The server does not check the range at all.
The mistake that taught something
We then sent the request without the CAPTCHA fields, to see whether they were required. They were, but not in the way we expected:
500
Error: WHERE parameter "captchaId" has invalid "undefined" value
The response was a full error page with a stack trace, showing the database library and server file paths. And the Score Board ticked a third challenge we had not been trying for, Error Handling. A careless request taught us something, which is why it pays to read every response, including the ones that look like failures.
Step 4: fix it and retest
The fix belongs on the server. OWASP's Input Validation Cheat Sheet puts it plainly: "Client-side validation is bypassable." On our private copy, we added one line to the rating field, using Sequelize's built-in validators:
validate: { isInt: true, min: 1, max: 5 },
Then we restarted the app with a clean database and compared the same requests:
| Rating sent | Before the fix | After the fix |
|---|---|---|
1 |
201 Created |
201 Created |
5 |
201 Created |
201 Created |
0 |
201 Created |
400 Bad Request |
6 |
201 Created |
400 Bad Request |
-1 |
201 Created |
400 Bad Request |
The last surprise came here. With the fix in place, rating 0 returned 400, yet the Score Board still marked Zero Stars as solved. The check that awards the challenge runs when the value is set, before validation rejects it. The lesson goes beyond this app: judge a fix by the server's response, not by a dashboard.
Write it down
Finish every challenge with three lines. Ours for Zero Stars:
- What: the feedback API accepts any integer as a rating.
- How: the 1 to 5 limit exists only in the browser, so a direct
POST /api/Feedbackswithrating: 0returned201. - Fix: validate the range on the server, then confirm that
0and6return400.
Those three lines are the shape of a real finding. Many CyberGym challenges take this further: 31 have a coding challenge, where you find the vulnerable line in the source and choose the fix.
Can AI help me learn hacking?
Yes, if you use it as a coach and still do the steps yourself. Ask it why a response changed or what your next guess should be, then send the request yourself. If you only ask for the solution, you get the tick and skip the skill.
HackerGPT's CTF Mode is built for that style of learning. It works through your own site, or CyberGym, step by step and explains each move, and the CTF Mode workspace guide shows what each tab is for. We did not use it in the session above; every step there was done by hand. AI tools can be wrong, so verify what they tell you with a request of your own. Before using one in a competition, check that event's rules.
How do I become a web pentester from here?
Keep the same loop and widen the target, from single challenges to a whole application. Move up the difficulty levels, enter a CTF, and read the OWASP Web Security Testing Guide for a structured list of what to test. NIST SP 800-115 describes the planning, discovery, attack and reporting phases that professional testing is organised around.
Then test something of your own. How to pentest your own website covers scope and safety, and what penetration testing is explains how a pentest differs from a scan. Keep your three-line notes, because a set of clear write-ups shows how you work; how to write a CTF writeup shows how to turn them into one.
Bug bounty programs are a possible later step, not a first target. They are live systems, and only a program's written policy gives you permission, within the scope it sets. Read the rules of legal hacking before you send a single request.
Key takeaways
- Choose a target you are allowed to attack before you open a tool, and stay inside it.
- Start with CyberGym's difficulty 1 challenges, and run Juice Shop on
127.0.0.1if you want your own scoreboard. - Treat browser limits as suggestions: send the request directly and see what the server enforces.
- After each solve, ask how far the flaw goes, fix it if you can, and judge the fix by the server's response.
- Write three lines for every challenge: what you found, how you found it and how to fix it.
FAQ
Is it legal to learn hacking?
Yes. Learning the techniques is generally not the offence; using them on a system without authorisation is. Practise on targets you own, have written permission to test, or that are built to be attacked, such as CyberGym. This is general information, not legal advice, and laws differ by country.
Can I learn ethical hacking for free?
Yes. MDN's HTTP documentation, the OWASP guides, a browser, curl, CyberGym and OWASP Juice Shop are all free. You do not need to pay for anything to work through the path in this article.
How long does it take to learn hacking?
There is no reliable figure, because it depends on your starting point, your time and what you want to do with the skill. A more useful measure is whether you can explain a solve and its fix without a walkthrough. Your first difficulty 1 challenge can happen in a single session; becoming job-ready takes far longer.
Can I learn hacking without coding?
You can start without it. Your first challenges need a browser, curl and the ability to read a request and a response. You will want to read JavaScript and at least one server-side language soon after, because finding and fixing a flaw depends on reading code.
Should a beginner start with bug bounty?
Usually not. Bug bounty programs are live systems with written rules, and a mistake there affects a real company. Build your method on practice targets first, then read each program's policy closely before you test anything in its scope.
Sources
- An overview of HTTP, MDN
- OWASP Juice Shop project page
- OWASP Juice Shop README, GitHub
- OWASP Top 10:2025
- First steps with Prometheus, Prometheus documentation
- Input Validation Cheat Sheet, OWASP
- Validations and constraints, Sequelize documentation
- OWASP Web Security Testing Guide
- NIST SP 800-115, Technical Guide to Information Security Testing and Assessment
Start your first session on CyberGym, or try HackerGPT on your own site at hackergpt.app.