Web & Bug Bounty Path
The bug classes that actually get paid, in the order a hunter meets them. Map the attack surface first, then walk the classes one at a time, and finish on a real programme: a written policy, a scope you have to respect, and findings of genuinely different severity — including one that is real and worth nothing.
Start here
🎬 Uncle Rat walks the whole path, and why it runs in this order.
Captions only, no audio. Watch on YouTube →
How to work this path
Each module pairs the theory with the targets. Read the lesson, then go and do it.
1 — Read the lesson
Every module links the matching Labs pages: what the bug class is, why it happens, how to approach it, and how it gets fixed. No spoilers for any specific machine.
2 — Work the machines
Then the live targets for that class, easiest first. Flagged machines so you get a clear signal that you actually landed it, not a vague feeling that you might have.
3 — Keep notes like a hunter
Write down what you tested and what you ruled out, not just what worked. On a real programme the inventory of what you have not looked at is the valuable half.
4 — Finish on a programme
The capstone has no flags. You get a policy, a scope and a report to write. It is graded the way a programme grades you — and stepping outside the scope ends the attempt.
▶ Watch: how a hunt runs An animated walk through the method, before you touch a target.
Recon is not the warm-up
The single most common reason a hunter finds nothing.
The Eight Modules
38 machines. Start anywhere, but module 1 pays for itself and module 8 assumes the rest. 30 of them are free; the 8 marked premium need RatCTF Premium. Every module has free machines, so you can learn every bug class without paying.
Recon & Attack Surface
Bounties are won and lost before the first payload. The hunters who get paid are the ones who found the asset nobody else looked at. This module is about building an inventory: what hosts exist, what the application tells you about itself for free, and which forgotten corner of the estate is running something older than the rest.
- Subdomain and host enumeration — turning one domain into an asset list
- Reading what a site volunteers: robots, sitemaps, headers, error pages, generated docs
- Pulling routes and endpoints out of client-side bundles
- Metadata and archive leftovers as an intel source
- Keeping a surface inventory that tells you what you have NOT tested yet
📖 Lessons for this module
🎯 Targets
🧪 Extra practice on HackXpert Labs — free single-bug drills, for more reps on this module's classes · opens labs.hackxpert.com
🎓 Go deeper with Uncle Rat — my courses for this module, half price with code DISCOUNT
Access Control
Broken access control is the most-paid bug class in bounty, and the most boring to find — which is exactly why it survives in production. The question is never "can I log in", it is "now that I am logged in as the lowest-privileged user in the system, what can I still reach?"
- Object-level authorization — records that belong to someone else
- Function-level authorization — privileged actions a normal role can still call
- Mass assignment — fields the client was never meant to set
- Forced browsing to unlinked routes and legacy endpoints
- Testing every role against every action, methodically, instead of guessing
📖 Lessons for this module
🎯 Targets
🧪 Extra practice on HackXpert Labs — free single-bug drills, for more reps on this module's classes · opens labs.hackxpert.com
🎓 Go deeper with Uncle Rat — my courses for this module, half price with code DISCOUNT
Client-Side
Everything that executes in the victim's browser. Start with the simple reflected and DOM cases so the mechanics are automatic, then work up to the ones that only fire somewhere you cannot see — which is where the severity, and the money, actually is.
- Reflected, stored and DOM-based XSS — and telling which one you have
- Sink hunting in client-side code
- Out-of-band confirmation for payloads that fire out of your sight
- Cross-site request forgery on state-changing actions
- Cache behaviour as a way to expose another user's response
- Prototype pollution and the object graph as an attack surface
- Escalating a script execution into real account impact
📖 Lessons for this module
🎯 Targets
🧪 Extra practice on HackXpert Labs — free single-bug drills, for more reps on this module's classes · opens labs.hackxpert.com
🎓 Go deeper with Uncle Rat — my courses for this module, half price with code DISCOUNT
Injection
One root cause, many names: untrusted input ended up somewhere it was parsed as code. Once you recognise the shape — a value crossing from data into an interpreter — SQL, shell, template and deserialization all read like the same bug wearing different clothes.
- SQL injection: detection, boolean/blind inference, mapping schema before reading data
- OS command injection and the metacharacters that get you there
- Server-side template injection — identifying the engine from its behaviour
- XML external entities and parser-level trust
- Insecure deserialization and gadget-chain reasoning
- Writing a finding that proves the interpreter ran your input
📖 Lessons for this module
🎯 Targets
🧪 Extra practice on HackXpert Labs — free single-bug drills, for more reps on this module's classes · opens labs.hackxpert.com
🎓 Go deeper with Uncle Rat — my courses for this module, half price with code DISCOUNT
Server-Side Requests & Files
Bugs where you borrow the server's position on the network or its view of the filesystem. These are high-severity on real programmes because the server is inside the perimeter and you are not.
- Server-side request forgery and why internal network position matters
- Local file inclusion and path traversal
- Turning a file read into code execution
- Unrestricted upload: content type, extension and parser mismatches
- Debug and development surfaces left reachable in production
- Reasoning about blast radius when the server makes the request for you
📖 Lessons for this module
🎯 Targets
🧪 Extra practice on HackXpert Labs — free single-bug drills, for more reps on this module's classes · opens labs.hackxpert.com
🎓 Go deeper with Uncle Rat — my courses for this module, half price with code DISCOUNT
Auth & Account Takeover
Account takeover is the finding that ends triage arguments. Almost none of it is brute force — it is token handling, signature verification, state machines in reset and multi-factor flows, and delegated-auth plumbing that trusts the wrong parameter.
- Token structure and signature verification — what the server actually checks
- Algorithm and key confusion in signed tokens
- Password-reset and multi-factor flows as state machines with skippable steps
- Delegated authorization flows and the parameters that must not be attacker-controlled
- Chaining a weak primitive into full takeover of another account
📖 Lessons for this module
🎯 Targets
🧪 Extra practice on HackXpert Labs — free single-bug drills, for more reps on this module's classes · opens labs.hackxpert.com
🎓 Go deeper with Uncle Rat — my courses for this module, half price with code DISCOUNT
Logic, Races & APIs
The bugs no scanner will ever hand you, because nothing is malformed — the application does exactly what it was built to do, and that is the problem. Read the business rules, then find the sequence of entirely valid requests the developer never pictured.
- Business-logic abuse — using a feature as designed, against its intent
- Race conditions and the gap between check and use
- Concurrency as an exploitation primitive
- API schema discovery and over-exposed query surfaces
- Quantifying logic bugs in money or records so triage scores them properly
📖 Lessons for this module
🎯 Targets
🧪 Extra practice on HackXpert Labs — free single-bug drills, for more reps on this module's classes · opens labs.hackxpert.com
🎓 Go deeper with Uncle Rat — my courses for this module, half price with code DISCOUNT
Capstone — a Real Programme
No flags. A scope document, in-scope and out-of-scope assets, rate-limit rules, and an application with several issues of genuinely different severity — including at least one that is real but will not pay. You are graded the way a programme grades you: on the report and on a short debrief. Testing anything the policy puts out of scope fails the attempt, exactly as it would end an engagement.
- Reading a policy and testing inside it
- Prioritising a surface under a time budget
- Severity triage — and recognising a finding that is valid but worthless
- Evidence: the exact request that proves the issue
- Impact in the programme's language, not the bug's
- A ≤10-minute debrief on how you worked
📖 Lessons for this module
🎯 Targets
🧪 Extra practice on HackXpert Labs — whole apps to hunt end to end, no hints about what is inside · opens labs.hackxpert.com
🎓 Go deeper with Uncle Rat — my courses for this module, half price with code DISCOUNT
No flags on this module. You submit a report and a debrief of ten minutes or less through the Pentest Reporting flow on the machine page — that is the deliverable. The capstone also ships a binding scope: testing an out-of-scope host fails the attempt, exactly as it would end a real engagement.
Optional side module
Not counted in the path total. A detour from the main line, but it turns up constantly in tokens, reset links and licence checks.
CryptoVault (optional side module)
The maths is almost never the bug. How the maths was wired in is. Keys that are too short or too predictable, hashes doing a job they were never designed for, padding and signature checks that are lenient in exactly the wrong place — all of it shows up in tokens, reset links and licence checks on real programmes.
- Predictable and reused secrets in security-relevant values
- Hash misuse — integrity, passwords and tokens each fail differently
- Padding-oracle reasoning
- Signature verification that is too permissive
📖 Lessons for this module
🎯 Targets