FREE / FOREVER / COMMUNITY-MENTORED

Learn to hack. For free. Prove it.

Structured paths in web exploitation, bug bounty, network defense, malware and cloud, you read a beat, then immediately do it in a real terminal. No card. No setup.

Start hacking tier 0 · no card

paths

lessons

forever

▼ try it now, no signup

mission_01 · find the flag● live

$curl -sI https://acme.test/login

// run the request, then read the response headers carefully.

✓operator_4f solved SSRF → cloud metadata/●scanning 198.51.100.0/24 · 3 hosts up/✓null_byte solved Stored XSS in profile/⚑PROVEN exploitable · acme-auth/2.3/✓recon_dog solved Subdomain takeover/●live lab · find-the-flag · 412 playing/✓m4lware_k solved Unpacking a packed sample/◷streak of the week · 37 days/

★ flagship path

Become a Bug Bounty Hunter

Open path

A territory, not a to-do list. Each node is a real task you have to solve, see exactly where you are and what’s next.

✓Recon4 tasks
✓Web Exploitation9 tasks
Access Control6 tasks
Chaining Bugs5 tasks
Out-of-band4 tasks
The Report3 tasks

One finding, start to finish

scroll to advance

This is the shape of every path here: look, get in, go deeper, connect two things, then write it up so someone can act on it.

$subfinder -d target.lab -silent

api.target.lab
staging.target.lab
legacy.target.lab

Map the surface before touching it. Most findings start here.

$curl -s staging.target.lab/api/v1/user?id=1042

200 OK  {"id":1042,"email":"a***@target.lab"}

One object reference, one identifier you were never meant to change.

$curl -s staging.target.lab/api/v1/user?id=1

200 OK  {"id":1,"role":"admin"}

Access control fails quietly. That is what makes it worth reporting.

$ssrf → 169.254.169.254/latest/meta-data/

iam/security-credentials/app-role

Two medium bugs become one critical when they touch each other.

$report --impact --repro --scope-check

evidence bundle ready · 3 screenshots · 1 request/response pair

Anyone can find it. You get paid for proving it, cleanly.

“Most security training sells you noise. We teach you to find the signal, and to prove it’s real.”

THE THREATFOUND ACADEMY · FREE FOREVER

Learning paths

6 paths · more weekly

Web Application SecurityTIER 1The bread and butter, how web apps break, from HTTP basics to XSS, SQLi and access control.5 modules · ~18H · 5 live · prepares you for: AppSec / Web Pentester Bug Bounty HuntingTIER 1Turn skills into income, programs, scope, recon at scale, and reports that actually get paid.3 modules · ~14H · 3 live · prepares you for: Bug Bounty Hunter Attack Surface & ExposureTIER 1Find what you are already leaking — exposed secrets, open .env and .git, subdomain takeover, and the recon that surfaces them.5 modules · ~10H · 5 live · prepares you for: ASM / Exposure Analyst Network Security & DefenseTIER 1Ports, protocols, TLS, firewalls and detection, how networks are attacked and hardened.3 modules · ~12H · 3 live · prepares you for: SOC Analyst Malware AnalysisTIER 2Safely analyse malicious code, static triage, dynamic sandboxing, and reading what it really does.3 modules · ~16H · 3 live · prepares you for: Malware Analyst / IR Cloud SecurityTIER 2IAM, storage, metadata and misconfigurations across AWS, GCP and Azure.3 modules · ~13H · 3 live · prepares you for: Cloud Security Engineer

early access

Get ThreatFound before everyone else.

We’re opening continuous exposure monitoring — the same proof-first engine, now watching the domains you own for leaked keys, exposed .env/.git files and subdomain takeover. Join the waitlist for first access, plus new courses as they drop.

No spam · we only monitor domains you own · unsubscribe anytime

recent solves · live

✓operator_4fSSRF → cloud metadata2m ago
✓null_byteStored XSS in profile6m ago
✓m4lware_kUnpacking a packed sample11m ago
✓recon_dogSubdomain takeover18m ago

streak of the week

37 days

Join free, keep a daily streak, climb the board. Earn evidence, never pay for it.

Start your streak

⚠ scope

Everything here is for defenders and authorized testing. Practise on the included labs and intentionally-vulnerable targets, only ever test systems you own or are explicitly authorized to assess.