A senior-track Bug Bounty roadmap built around systems knowledge, application architecture, manual reasoning, controlled labs, remediation, and evidence. Not a scanner collection. Not a payload scrapbook.
A serious web hunter should be able to reason from network and operating system behavior through HTTP, browser security, backend logic, identity, APIs, proxies, cloud, logs and remediation. The roadmap is ordered by dependency, not by whatever vulnerability happens to be fashionable this week.
Each level has a purpose, a depth target, and an exit criterion. The goal is not to “finish courses”; it is to produce evidence that you can build, observe, break in a lab, explain, fix and retest.
Authorization, safe harbor, in/out-of-scope assets, rate limits, data minimization, evidence handling, responsible disclosure and reproducible reports.
Network+ depth, Linux Essentials, practical LPIC-1 and Git/GitHub. Understand routing, DNS, TCP/UDP, TLS prerequisites, processes, permissions, services, logs, SSH, systemd and version control.
Very deep HTTP/HTTPS/browser fundamentals, strong HTML, minimal CSS, deep JavaScript, PHP, SQL/MySQL and Nginx/Apache. Build the thing before claiming you understand how to break it.
Sessions, authorization, JWT, OAuth/OIDC, REST/OpenAPI, GraphQL, Python automation, Docker, VPS/DNS/TLS/CDN deployment and virtualized lab isolation.
Very deep Burp Suite, PortSwigger Academy, OWASP Top 10 2025 plus extended vulnerability families, recon/OSINT, logs/forensics and CI/CD supply-chain fundamentals.
Cloud fundamentals, framework literacy, secure code review, threat modelling, exploit/PoC engineering and an end-to-end capstone: build → deploy → instrument → attack in controlled branches → fix → regression test.
Not every prerequisite deserves the same depth. CSS does not need the same investment as HTTP, JavaScript, identity, Burp or modern web vulnerability research. Human beings love flattening everything into “learn this too”; this matrix refuses the nonsense.
OSI/TCP-IP, addressing, subnetting, routing, NAT, DNS, TLS prerequisites, troubleshooting and packet capture.
Processes, permissions, services, packages, logs, networking, SSH, filesystems, hardening and Bash.
HTTP semantics, cookies, caching, origins, CORS, CSP, SNI, ALPN, WebSockets, browser storage and proxies.
DOM, event loop, async flows, fetch, postMessage, storage, sources/sinks, bundles, source maps and prototype behavior.
Server-side parsing, sessions, file handling, PDO, transactions, privileges, reverse proxying, TLS and logs.
Authentication versus authorization, session lifecycle, MFA, recovery, token semantics, PKCE, scopes and OIDC claims.
Objects, properties, functions, rate limits, webhooks, documentation, resolvers, introspection and query controls.
Proxy, history, Repeater, Intruder, Sequencer, Comparer, Logger, Collaborator/OAST, DOM Invader and WebSockets.
Modern vulnerability classes, manual proof, root cause, mitigation, lab discipline and regression testing.
Scope-aware mapping, passive discovery, change detection, service metadata, structured logs and event reconstruction.
IAM, VPC, object storage, edge/WAF, containers, secrets, build pipelines, workflow trust and deployment boundaries.
Assets, actors, trust boundaries, DFDs, abuse cases, STRIDE, attack trees, ASVS, secure defaults and remediation design.
The same dependency graph can be compressed, but compression is not mastery. Pick a mode based on available hours, then keep the same build-test-fix discipline.
Web vulnerability research sits on top of the prerequisites, not instead of them. Learn the families, but force every finding through a root-cause and remediation discipline.
Study each family as a data/control-flow problem, not as a payload list.
Use the smallest tool that exposes the behavior. Keep automation scope-aware and rate-limited.
Progress is measured by things you can produce without following a tutorial. The checklist below persists locally in your browser, because apparently even websites need to nag humans into finishing projects.
Complete these artifacts before treating “prerequisites” as finished.
A real learning system needs an application you understand end-to-end: frontend, backend, database, infrastructure, identity, API, logs and tests. Vulnerable variants stay isolated. Production stays boring. Boring production is a compliment.
“The senior move is not finding more payloads. It is understanding why the system believed the wrong thing.”
TRUST BOUNDARIES • ROOT CAUSE • DURABLE FIXAuthorized web security research, bug bounty methodology, application architecture and responsible disclosure.