About PentestingHere
A community for penetration testers and bug bounty researchers to publish their work and build a reputation from it.
What this is
PentestingHere is where security researchers publish findings (what they broke), writeups (how they broke it), resources (methodologies, checklists and tools) and reviews of bug bounty programs. A researcher's profile is their portfolio, ranked by a reputation computed from the work they have published — not bought, not assigned, recomputed from the rows every time.
Authorized work, not instructions to attack anyone
Every finding and writeup here comes from authorized security work: a report made to a bug bounty program under its own rules, or testing against a system the researcher owned or was explicitly permitted to test. The Academy and Labs sections are deliberately vulnerable applications we built and host ourselves, for anyone to practice against legally. Nothing published here is an invitation to test a system without permission — that line is in the terms every member agrees to, and moderation enforces it.
Who it's for
Penetration testers and bug bounty researchers at every level: people deciding which program to try next, people writing up a finding they are proud of, and people starting out who want a free curriculum and labs to practice on before they hunt for real.
Reach us
Questions, corrections, or something that looks wrong on the site — the support desk reaches a person.