Hacker101 CTF Guide (2026): Earn Private Bug Bounty Invites

What Is Hacker101?

Hacker101 is a free online web security class run by HackerOne, the bug bounty platform. It combines video lessons on web hacking with the Hacker101 CTF, a capture the flag game that HackerOne describes as the course's official coursework. You log in with a free HackerOne account, and there is no paid tier.

The site has two halves, and beginners often only notice one of them.

• The videos. The Hacker101 site organizes its lessons into learning tracks, including Hacker101 for Newcomers, Burp Suite, Web Hacking, Mobile Hacking, Cryptography and a Pentest Series. You can watch them in any order.
• The CTF. A separate site, ctf.hacker101.com, hosts the levels. Each one is a small vulnerable application that you launch on demand and attack from your browser. Most are web apps, with a few Android and native binary levels for later.
• The community. Hacker101 runs a Discord server, and HackerOne's own hacker success guide points newcomers there when they get stuck.

The audience is clear from the material. Hacker101 was built to turn programmers and curious beginners into bug bounty hunters, so almost everything it teaches is web application security. That focus is its biggest strength and, as you will see further down, its main limit.

How the Hacker101 CTF Works

The Hacker101 CTF is a jeopardy-style game: a list of levels, each hiding one or more flags, and points for every flag you submit. You play solo, at your own pace, with no clock running. It is about as low-pressure as the format gets, and if capture the flag is new to you, our CTF for beginners guide explains the basics first.

Getting started takes four steps, according to HackerOne's documentation:

1. Sign in with a HackerOne account. Create one on HackerOne if you do not have it yet. It is the same account you will later use to submit real bug reports.
2. Authorize the CTF. Hacker101 asks for access to your public HackerOne profile and your flags, so your points follow your hacker identity.
3. Pick a level. The level list shows each level's difficulty, points per flag, skills involved and how many flags you have found.
4. Click Go. The site starts a private instance of that application for you. Restarting a slow or broken instance does not cost you any flags you already captured.

A flag is a long random string wrapped in markers, starting with ^FLAG^ and ending with $FLAG$. When you see that pattern on a page, in a response or in source code, copy the whole thing and submit it. Flags can be hidden in pages, files, databases or source code, which is why the CTF's own instructions tell you to check every page, button and input.

Difficulty runs from Trivial to Expert, and points per flag rise with it. On the level list, the Trivial warm-up pays 1 point, Easy levels pay 2 to 4 points per flag, Moderate levels 3 to 6, Hard levels 7 or 9, and the Expert levels 9 or 13. Point values are set per level, so two Easy levels can pay differently.

Hints are built in. Click the Hints link next to a level's Go button and you get a series of nudges, usually three to five per level. Each later hint sits behind a longer timer, which is a nice touch: it forces you to sit with the problem before the next clue appears.

The 26-Point Rule: From CTF Flags to Private Bug Bounty Invites

Once you have earned 26 points in the Hacker101 CTF, you become eligible to receive invitations to private bug bounty programs on HackerOne. Both the Hacker101 getting-started page and HackerOne's documentation state this threshold, and it is the reason the CTF is worth more than most free practice games.

Private programs matter because of competition. A public program is open to every hunter on the platform, so the easy bugs tend to get reported within hours of launch, and a beginner's first valid finding is often marked as a duplicate. A private program is invite-only, with far fewer people looking at the same targets.

When HackerOne launched the current version of the CTF in 2018, its announcement added that every further 26 points earns another invitation. Treat that as a launch-era detail: the documentation today only promises eligibility at 26 points, not a fixed number of invites.

Keep your expectations honest about what an invitation is:

• It is eligibility, not a guarantee. Invitations depend on which programs are recruiting. Some hunters get one quickly, others wait.
• It is not easier hacking. A private program is a real production system. The bugs are not labeled and nothing tells you a flag exists.
• It is not a reason to rush. HackerOne's hacker success guide recommends working through all of the CTF even after you have an invite, because the levels you skip are skills you will be missing on real targets.

Read the rules of any program you accept before you send a single request. Scope, banned test types and disclosure rules are in the program policy, and breaking them can get you removed from the program or the platform.

Your First Hacker101 CTF Levels, in Order

The level list is not sorted from easiest to hardest, and the hard levels are listed alongside the easy ones. Here is the order we would give a friend, with the points each one pays. We give the idea behind each level, not the answers. The level list, not this guide, is the source of truth for current point values.

1. A little something to get you started (Trivial, 1 point)

One flag, one lesson: the page you see is not the whole page. Open the source (Ctrl+U in most browsers) and look at everything the page loads, not just the text it shows. If a file is referenced, you are allowed to request it directly.

2. Micro-CMS v1 (Easy, 4 flags at 2 points each)

A tiny content management system where you can create and edit pages. It is the best beginner level on the site because each flag teaches a different bug class:

• Access control. Pages have numeric IDs. Notice which numbers are missing, and notice the difference between "not found" and "forbidden". Then think about what other actions exist for a page besides viewing it.
• SQL injection. The hint says to tamper with every input. The page ID in the URL is an input too.
• Stored XSS, twice. The app blocks script tags. Ask where else your page title appears on the site, and what other HTML elements can run JavaScript through an event handler.

3. Petshop Pro (Easy, 3 flags at 3 points each)

An online shop with a basket and a checkout. Watch what the browser sends when you check out, because shops that trust the client have pricing problems. Another flag hides behind a page the menu never links to, guarded by a login whose error messages say more than they should. The last one asks where the data you type in shows up again.

4. Postbook (Easy, 7 flags at 4 points each)

A small social network. With 28 points on offer, Postbook alone can carry you past the 26-point mark, and it is a crash course in access control: whose post can you read, whose post can you edit, and what happens when you change an ID that the app expected you to leave alone. If you only play one level properly, play this one.

Add it up: the Trivial level (1) plus Micro-CMS v1 (8) and Petshop Pro (9) gives you 18 points, and two Postbook flags take you past 26. That is a realistic target for your first week, without touching anything rated Moderate.

5. After 26: Micro-CMS v2 and the Moderate levels

Micro-CMS v2 (Moderate, 3 flags at 3 points each) is the hardened follow-up to v1: the obvious fixes are in place, so you have to dig further, including a login form that leaks more than it should. After that, Cody's First Blog, Photo Gallery and TempImage are good next steps, along with the BugDB levels if you want an introduction to GraphQL. Leave Encrypted Pastebin and the Model E1337 levels for much later. They are rated Hard or Expert and need cryptography or math knowledge most beginners do not have yet.

The Videos Worth Watching First

You can start the CTF cold, and plenty of people do. You will get further, faster, with a few hours of video first. The Hacker101 getting-started page suggests this order:

1. Hacker101 for Newcomers. Web application basics, the hacker mindset and how to write a report that a triage team can act on.
2. Burp Suite. How to set up and use the proxy that almost every web bug hunter works in.
3. Web Hacking. The core vulnerability classes, which map almost one to one onto the early CTF levels.
4. Report writing and community guidelines. The code of conduct, the CVSS severity calculator and when to ask for help.

Burp Suite is the tool that changes the CTF the most. You can solve the Trivial level and most of Micro-CMS v1 with a browser and DevTools, but Petshop Pro and Postbook are much easier when you can stop a request, change one value and send it again. Our Burp Suite tutorial for beginners gets the Community Edition intercepting traffic in about ten minutes.

One caveat: some of the videos are several years old. The ideas have aged well, since SQL injection and XSS work the same way they did then, but menus and screenshots in tool demos may not match what you see on screen today.

When You Are Stuck: Hints, Writeups and Discord

Hundreds of people have published Hacker101 writeups, so every answer is one search away. That is the trap. A flag you copy from a blog post gives you points and teaches you nothing, and the 26-point invite is worthless if you cannot find the same bug on a real program.

A rule that works well:

• 1Use the built-in hints first. They are written to nudge, not to solve. Read one, then go back to the app.
• 2Write down three things you tried. Before you open any writeup, list three attempts and why each failed. If you cannot list three, you have not tried yet.
• 3Read a writeup for one flag only. Close it as soon as you understand the idea, then find the flag yourself. Never read ahead to the next flag.
• 4Ask on Discord with your attempts. "I tried X and Y on the edit page and got a 403" gets helpful answers. "Any hint for flag 2?" usually does not.

In practice, the people who stall on Hacker101 are rarely missing a technique. They are missing notes. Keep a text file per level with every URL, parameter, error message and odd behavior you notice. By the third flag of Postbook, that file is doing half the work, and it is the same habit that makes a bug bounty report easy to write later.

Hacker101 vs Other Free Hacking Practice

Hacker101 is not the only free place to start, and it is not the best fit for everyone. This is how it compares with the other options beginners usually weigh:

Our take: if your goal is bug bounty, Hacker101 belongs on your list no matter what else you use, because nothing else on this table hands you a route into private programs. If your goal is to compete in CTF events, it is too narrow on its own. Live CTFs include cryptography, forensics, reverse engineering and binary exploitation, and Hacker101 barely touches them.

What Hacker101 Will Not Teach You

Hacker101's levels are small, single-purpose apps. Each one is built around a handful of bugs, and the level list tells you how many flags exist. Real targets do the opposite: thousands of endpoints, no flag count, and most of your time spent on recon and on features that turn out to be safe.

Three gaps are worth filling on purpose:

• Depth on one bug class. Each Hacker101 level touches a bug once. Real hunting rewards knowing one class, like XSS or access control, well enough to find its unusual variants.
• Recon. The CTF gives you the target. Bug bounty starts with finding subdomains, endpoints and forgotten features, a skill the levels barely exercise.
• Everything outside the web. Linux, networks, privilege escalation and forensics are outside Hacker101's scope. They matter if you want a pentesting job and not only bounties.

Fresh, structured repetition is the fix. Practice the same bug class across several different apps until you recognize it on sight, then take that instinct to the CTF and to your first private program.

Legal and Ethical Considerations

• Attack only the level instances. The CTF authorizes attacks on the vulnerable apps it launches for you, not on the platform that hosts them.
• Read every program policy. A private invite is permission to test the assets in scope, under the rules the company wrote. Anything out of scope is still unauthorized.
• Never reuse CTF payloads on random sites. Typing a SQL injection payload into a site you do not have permission to test is illegal under laws like the Computer Fraud and Abuse Act in the US and the Computer Misuse Act in the UK, whatever your intent.
• Report, do not exploit. On a real program, prove the bug with the least impact possible, stop, and write the report. Never access more data than you need to demonstrate the issue.

Frequently Asked Questions