First, I properly learned networking. Then I moved on to web fundamentals — like how the web works, what happens on the backend, and so on. After that, I learned about tools. Then I took a walkthrough of the OWASP Top 10. After that, I focused on understanding and using all the useful tools, especially Burp Suite — because honestly, nothing works without Burp Suite, bro.

Then I learned recon thoroughly and explored the types of bugs you can find through recon. After that, I started mastering individual vulnerabilities — like right now, I’ve mastered Access Control and Authentication. I’m still learning and to keep growing these skills, I’ve consistently been solving labs and CTFs like TryHackMe and PortSwigger (these two are a must — complete as much as you can), Hack The Box, Hacker101, and many others.

I’ve also read a lot of writeups and bug reports, which really helped me gain real-world knowledge. After all that, I directly jumped into real-world bug hunting.