Hacksplaining: Free Hacking Lessons for Beginners (2026)

What Is Hacksplaining?

Hacksplaining is a free online training site that teaches web security through short interactive lessons. In each lesson you play the attacker against a fake website, watch the vulnerability unfold in animations, then learn how developers prevent it with secure code examples in languages like Python, JavaScript, Java and Go.

The site is written by Malcolm McDonald, its founder and editor-in-chief, who also wrote the Manning book Grokking Web Application Security. It has been around for a decade: a 2016 i-programmer article already described it as a site where you "hack" a test site and see the vulnerability in animated graphics. Today the homepage claims more than 500,000 registered learners (as of July 2026).

One thing to know up front: Hacksplaining's real audience is software developers. Its tagline is "Learn the attacks. Defend your code," and companies pay for it as secure coding training. That does not make it less useful for aspiring hackers. Understanding why code breaks is exactly what makes a good pentester. It just explains the tone: every lesson ends with how to fix the bug, not how to go further with it.

What the Lessons Cover

The lesson catalog lists 45 lessons, filterable by OWASP Top 10, PCI DSS and LLM. Grouped the way a beginner should think about them:

• Injection classics: SQL injection, command execution, remote code execution, XML external entities, XML bombs and regex injection.
• Browser-side attacks: stored, reflected and DOM-based XSS, cross-site script inclusion, CSRF, clickjacking, CSS injection, CORS and open redirects.
• Login and access flaws: broken access control, privilege escalation, user enumeration, session fixation, weak session IDs, password mismanagement and mass assignment.
• Infrastructure and network: SSRF, directory traversal, file upload vulnerabilities, DNS poisoning, SSL stripping, downgrade attacks, subdomain squatting, email spoofing and denial of service.
• LLM and AI: prompt injection, sensitive information disclosure, model poisoning and slopsquatting, the newer attack where hackers register package names that AI coding tools hallucinate.

Is Hacksplaining Free?

Yes, for individuals. Hacksplaining's own FAQ says it "is free for personal use" and that only team features (dashboards, team progress tracking and compliance reports) are paid. You can preview any lesson without an account, but you need a free account to start the interactive lab. Sign-up takes an email address, or a Google, GitHub or Microsoft login.

Here is what you get at each level, checked on the site in October 2026:

• No account: lesson previews, the written explanation of each vulnerability, and the glossary.
• Free account: all 45 interactive labs, the prevention guides, quizzes, and progress tracking across lessons.
• Team plan ($50 per user per year): admin dashboards, a custom curriculum, SSO, API access, and certificates and compliance reports for PCI DSS and ISO 27001. There is a 14-day free trial with no credit card.
• Self-hosted: SCORM lessons for a company's own learning platform, priced through sales.

As a learner, you will never need the paid plans. They exist for companies that have to prove to an auditor that their developers did security training.

How a Hacksplaining Lesson Works

Every lesson page starts with three small ratings (how common the bug is, how easy it is to exploit, and how bad the impact is), a short definition, and the OWASP Top 10 and PCI DSS requirements it relates to. Then come the three parts that matter:

1. The interactive lab: a simulated website where you carry out the attack step by step. The lesson tells you what to do at each stage and animates what happens on the server.
2. The prevention guide: the same bug from the developer's side, with vulnerable and fixed code next to each other.
3. The quiz: two or three questions. Passing marks the lesson as complete in your progress tracker.

Lessons also use a recurring cast of characters, such as the Savant, the Cowboy and the Hacker, who stand in for different kinds of attackers. It sounds gimmicky. In practice, it is what makes the lessons memorable: you remember the stored XSS lesson as "the one where Mal, the lesson's attacker, ruins a bakers' forum", and the details come back with it.

Walkthrough: The SQL Injection Lesson

The SQL injection lesson is where almost everyone starts, and it shows the Hacksplaining style well. You attack a login form backed by a real database running in your browser:

1. Break it: you type a single quote ' into the password field. The app crashes.
2. Read the error: the lesson shows you the server log, where a SQL syntax error reveals that your input landed inside a query.
3. See the code: you look at the vulnerable code that builds the query by gluing strings together.
4. Exploit it: you enter ' or 1=1-- as the password and log in without knowing it.

Why that works: the query ends up as something like ... WHERE password = '' or 1=1--'. Since 1=1 is always true, the database returns a user, and -- comments out the rest of the line. The prevention guide then shows the fix, parameterized statements, which Hacksplaining calls "the most reliable defense". In Python that is the difference between building a query with an f-string and passing the value separately to cursor.execute().

That single lesson teaches the three habits every hacker uses daily: poke an input with a special character, read the error carefully, and reason about what the code behind it must look like. For the techniques that come next, such as UNION queries and blind injection, our PortSwigger Web Security Academy guide covers the free platform that goes much deeper.

Which Hacksplaining Lessons to Start With

The catalog is not ordered for beginners. It is alphabetical, with the newest lessons on top, so it is easy to land on buffer overflows or DNS poisoning first and get lost. Here is the order we recommend for someone who wants to learn ethical hacking. It takes three to four hours in total, so about a week of lunch breaks:

1. SQL Injection: the cleanest example of "my input changed what the server does". Start here.
2. Cross-Site Scripting: the stored XSS lesson. You watch a script hidden in a forum comment run in another user's browser and hand over their cookies.
3. Reflected XSS: the same idea delivered through a link instead of a saved comment.
4. Cross-Site Request Forgery: how a malicious page makes your browser perform actions on a site you are logged in to.
5. Directory Traversal: reading files the server never meant to share, using ../. Short, and it sticks forever.
6. Command Execution: your first taste of running operating system commands through a web form.
7. Broken Access Control: the bug class ranked first in the OWASP Top 10:2025. Changing an ID in a URL is often all it takes.
8. User Enumeration: how a login page leaks which usernames exist through tiny differences in its error messages.

After those eight, pick by curiosity. SSRF and file upload are the most useful for CTFs. Prompt injection is worth 20 minutes if you are curious about AI security. Skip the infrastructure lessons (DNS poisoning, SSL stripping, downgrade attacks) until later: they are interesting background, but you cannot practice them in a beginner lab yet.

Is Hacksplaining Good for Learning Ethical Hacking?

Yes, as a first step. No other free resource explains web attacks as clearly in so little time. But it is a first step, not a full path, and it helps to know its limits before you spend weeks on it.

What it does very well:

• Mental models: the animations show the request, the server and the database at once, which is exactly what beginners cannot picture on their own.
• Zero setup: no virtual machine, no proxy, no VPN. A browser and 20 minutes are enough.
• Both sides of the bug: you see the attack and the fix. That makes you a better hacker, and a much better candidate in a job interview.
• Accuracy: lessons are written by a human expert and updated regularly. The SQL injection and XSS lessons were both marked "Updated Sep 2026" when we checked.

Where it falls short for hackers:

• The labs are on rails: the lesson tells you where the bug is and often what to type. You never have to find anything, which is the actual job.
• No real tools: you never use Burp Suite, a terminal or a browser's DevTools, which you need from your very first CTF.
• No difficulty curve: every lesson sits at roughly the same beginner level. There is no "now try a harder version".
• No flags or points: nothing rewards you for going off script, and there is no competition element.

Our take: use Hacksplaining for what it is great at, understanding an attack in 20 minutes, then immediately go and exploit the same bug somewhere that does not hold your hand. Read the SQL injection lesson, then go find a SQL injection yourself the same evening. That pairing is far more effective than finishing all 45 lessons before touching a real target.

Hacksplaining vs Other Free Ways to Learn Web Hacking

Hacksplaining is often mentioned alongside a few other platforms. They do different jobs, and knowing which is which saves you time:

They fit together in a natural order. Hacksplaining explains the idea. The PortSwigger Academy teaches the technique properly with Burp Suite. OWASP Juice Shop drops you into one big app where nothing is labeled. CTF-style labs then make you chain everything together: recon, exploitation, and sometimes privilege escalation, until you capture a flag.

When testing real applications, it is the last two that matter most. Real bugs never announce themselves. The sooner you practice on targets that do not tell you what is wrong, the sooner the lessons turn into skill.

From Hacksplaining to Your First CTF

Here is a concrete four-week plan that turns Hacksplaining lessons into hands-on skill, at about three to four hours a week:

1. Week 1, understand: do the eight lessons above, including every quiz. Write one sentence per lesson in your own words explaining why the attack works.
2. Week 2, reproduce: for SQL injection and XSS, exploit the same bug in a lab that does not script the steps. Our XSS Playground lab is a community message board with a stored XSS bug, the same scenario as Hacksplaining's forum lesson, except you write the payload and steal the admin's session yourself.
3. Week 3, learn the tools: install Burp Suite Community Edition and redo week 2 with every request going through the proxy. This is the step Hacksplaining cannot teach.
4. Week 4, play: pick a beginner web CTF challenge and solve it with no walkthrough for the first hour. Getting stuck is part of the training.

By the end of the month, you will have gone from watching an animation of ' or 1=1-- to finding injections yourself. That jump, from understanding to doing, is what every CTF player and pentester had to make.

Legal and Ethical Considerations

• Simulated is not permission: typing ' or 1=1-- into a real login page "just to see if the lesson works" is unauthorized access in most countries, even if nothing happens.
• Practice where you are invited: use platforms built to be attacked (Hacksplaining, PortSwigger, Juice Shop, CTF labs) or bug bounty programs with a written scope.
• Respect the platform: the attack happens inside the lesson. Do not scan, fuzz or attack hacksplaining.com itself.
• Use the defensive half: if you find one of these bugs in software you use, report it to the owner responsibly instead of testing further.

Frequently Asked Questions