Practice safely and with permission
Only test systems you own, purpose-built training labs, or assets for which you have explicit authorization. For bug bounty programs, read the program policy and scope before sending any traffic. When in doubt, stop and ask.
You do not need a computer science degree
Many people begin with curiosity, a willingness to learn, and a little practice. Cybersecurity is broad, and the best first step is usually the one that feels clear and sustainable.
Six steps to get started
You do not need to learn everything at once. Pick one concept, try it in a legal lab, take notes, and move on when you are ready.
Learn how the web communicates
Start with HTTP requests, responses, headers, methods, status codes, cookies, and sessions. These are the building blocks you will inspect later.
02Recognize common security risks
Use the current OWASP Top 10 as a guide to common web application risks. You do not need to memorize it.
03Explore requests with Burp Suite
Follow PortSwigger’s beginner path to learn how a proxy captures traffic, then use Repeater to make one controlled change at a time.
04Practice in realistic labs
Hacker101 combines free lessons with capture-the-flag levels inspired by real-world web security problems.
05Write a report
Explain the issue, list exact steps to reproduce it, include evidence, and describe the likely impact.
06Learn with the community
Look through past Glass Firewall programs, then bring your questions and notes to the next conference.
Places to learn and practice
These resources offer lessons and legal practice environments. You can build skills without touching a system you do not have permission to test.
Web Security Academy
Free explanations, learning paths, and interactive labs covering beginner through advanced web security topics.
Hacker101
Free classes, video lessons, guides, and capture-the-flag challenges from HackerOne.
picoCTF
A Carnegie Mellon learning environment with challenges spanning web exploitation, cryptography, forensics, and more.
OWASP Top 10
A common starting point for learning about major web application security risks.
Keep learning at Glass Firewall
You do not need to finish this list before attending. Bring what you know, write down your questions, and work at your own pace.
Plan your visit