Hacker101 is HackerOne's free class for people who want to find security bugs in web applications. It is a mix of video lessons, written guides and a capture-the-flag game, and it gets around 480 searches a month in the US, with another 110 or so for the CTF on its own. The CTF is why I would send someone here. The levels are small, self-contained web apps with bugs planted in them, and the difficulty ramps up at a sensible rate. It teaches the thing beginners most need, which is the habit of poking at every parameter and asking what the developer assumed.
HackerOne has also used CTF progress as a route into private bug bounty programs over the years. Check the current rules on the How To Play page before you count on that, but it is a nice incentive when it applies. The video side is more mixed. The core lessons on XSS, SQL injection, CSRF, SSRF and so on are clear and still correct, because those bug classes have not changed much. But a lot of it was recorded years ago, and newer additions, like STÖK's JavaScript for hackers session, are more like guest talks than a structured course.
The public GitHub repository behind the site was last pushed in February 2025. The gap that matters for readers of this site is AI. Bug bounty programs for LLM features, chatbots and agent tooling are one of the fastest growing parts of the market, and Hacker101 has nothing on them. For that you need Lakera's Gandalf, Hack The Box's AI Red Teamer path or PortSwigger's LLM attack labs. My take: an easy recommendation because it costs nothing and the CTF is good. Treat it as the on-ramp, and pair it with PortSwigger for depth and an AI-specific resource if you want to hunt on AI products.