Category & Difficulty Filters
Browse drills by vulnerability category (XSS, SSRF, IDOR, SQLi, and more) and filter by difficulty level.
Platform overview
Everything you need to learn bug bounty, in one place.
BountyLabs combines guided drills, structured learning paths, daily challenges, quizzes, notes, and progress tracking into one focused practice loop.
Guided Drills
Short simulated-response scenarios that teach a repeatable testing methodology instead of passive memorization.
Answer Validation
Submit a payload pattern, choice, or written answer and get immediate feedback against the expected reasoning.
Simulated Responses
Inspect supplied HTTP responses, server output, and errors without connecting to external targets. Responses are simulated inside the exercise.
Tiered Hints
Stuck on a step? Request hints progressively — from a concept nudge to a specific technique, near-solution pointer, or full explanation.
Copy-Ready Payloads
Every lab includes copy buttons for payloads, code snippets, and commands so you can focus on understanding the technique instead of typing syntax.
In-Lab Notes
Jot down observations, payloads, and takeaways directly inside each lab. Notes are saved to your profile so you can review them anytime.
Learning Paths
Structured tracks that organize fundamentals and focused vulnerability practice.
Web Security Foundations
HTTP protocol, input handling, authentication basics, session management, and the core concepts every security researcher needs before diving into specific vulnerabilities.
Beginner
HTTP
Auth
Bug Bounty Beginner
Understand scope, reconnaissance workflows, your first report submission, disclosure etiquette, and how to build a sustainable bug bounty practice from scratch.
Beginner
Recon
Reports
XSS Path
Reflected, stored, and DOM-based cross-site scripting. Learn context-aware payloads, CSP bypasses, and proper remediation techniques across different injection points.
Intermediate
Payloads
CSP
IDOR & Access Control
Identify insecure direct object references, broken access control, privilege escalation, and authorization bypass patterns in web applications and APIs.
Intermediate
Authorization
API
SSRF Path
Server-side request forgery from basic URL manipulation to cloud metadata exploitation, internal service pivoting, and protocol smuggling techniques.
Intermediate
Cloud
Internal
SQL Injection Path
Detect SQL injection, extract data, bypass authentication, understand blind and time-based techniques, and learn parameterized query remediation.
Intermediate
Database
Auth Bypass
API Security Path
Broken object-level authorization, mass assignment, excessive data exposure, rate limiting gaps, and other OWASP API Security Top 10 vulnerabilities.
Intermediate
REST
GraphQL
Report Writing Path
Write clear, actionable vulnerability reports with proper evidence, impact analysis, reproduction steps, and remediation guidance that triagers appreciate.
All Levels
Evidence
Impact
AI Mentor
Four specialized modes that adapt to what you are working on — labs, paths, quizzes, or general security questions.
Explain Mode
Ask the mentor to break down any concept — from how CSRF tokens work to why a specific payload triggers an XSS vulnerability. Explanations are lab-aware and reference your current context when available.
Nudge Mode
When you are stuck on a lab step, Nudge mode gives you a directional hint without revealing the full answer. It asks guiding questions to help you think through the problem yourself.
Review Mode
Submit your lab answer or approach for the mentor to review. It evaluates your reasoning, identifies gaps in your methodology, and suggests improvements without grading on syntax alone.
Policy Mode
The mentor refuses to help with unauthorized real-world exploitation. Policy mode explains responsible disclosure, scope boundaries, and why certain techniques should only be used in authorized environments.
Lab-Aware Context
The AI Mentor understands which lab you are working on, your current step, your previous attempts, and your note history. Responses are contextual to your actual training session, not generic chatbot replies.
Daily Challenges
One focused challenge per day, generated by AI to reinforce concepts from your active learning paths.
AI-Generated, One Per Day
Each day, BountyLabs generates a single focused challenge tailored to your current skill level and active paths. Complete it to maintain your streak and earn XP. Challenges cover a range of vulnerability types and difficulty levels, so you always have something new to practice without decision fatigue.
Streak Tracking
Daily challenges are tied to your streak counter. Maintain a consistent practice habit and watch your streak grow. Miss a day and the streak resets — a simple but effective motivator to keep showing up.
Quizzes & Mastery
Topic checks that reinforce what labs teach and expose weak areas you need to revisit.
Topic Checks
After completing labs or paths, take quizzes to verify your understanding. Questions cover concepts, techniques, remediation, and real-world application — not just memorization.
Explanations for Every Answer
Every quiz question comes with a detailed explanation of the correct answer. Learn from mistakes immediately instead of just seeing a score.
Weak Area Identification
Quiz results are analyzed to identify topics where you consistently struggle. BountyLabs highlights these weak areas on your dashboard and recommends specific labs or path modules to revisit.
Mastery Charts
Visual mastery charts show your proficiency across each vulnerability category. Track how your understanding deepens over time as you complete more labs and quizzes in each topic area.
Progress Tracking
XP, streaks, achievements, and mastery charts that reward meaningful learning progress.
Experience Points
Earn XP for completing labs, solving daily challenges, passing quizzes, and finishing path modules. XP accumulates on your profile and feeds into leaderboard rankings.
Streaks
Maintain daily practice streaks by completing at least one challenge or lab per day. Streaks are displayed on your profile and reset when you miss a day.
Achievements
Unlock achievements for milestones like your first solved lab, a 7-day streak, completing a full path, or reaching XP thresholds. Achievements are displayed on your profile.
Mastery Charts & Dashboard
Your dashboard shows path completion percentages, category-wise mastery charts, recent activity, streak status, XP balance, and recommended next steps — all in one view. Track your growth from beginner to confident security researcher.
Notes & Flashcards
Capture knowledge as you learn and review it with spaced repetition.
In-Lab Notes
Write notes directly inside labs — capture payloads, observations, and takeaways while the context is fresh. Notes are saved to your profile and searchable across all your lab sessions.
Flashcards with Spaced Repetition
Convert key concepts into flashcards and review them using a spaced repetition algorithm. Cards you struggle with appear more frequently, while well-known cards are spaced out over longer intervals.
Ready to start training?
Pick a learning path, complete your first guided drill, and let progress guide what you practise next. No credit card required.
Start Training