Ten weeks of structured web application security training on PortSwigger labs. Then fourteen weeks hunting on real VDPs and bug bounty programs, with live Q&A, chat support and report reviews behind you.
Join 450+ active Cyber Armory members · One-time payment · No screening, basic web knowledge is enough · Registrations close 30 Nov
Every junior applicant lists "Burp Suite" and "OWASP Top 10" under skills. Very few can point to an experience section with real targets, real reports and a vulnerability a program actually accepted.
Labs tell you the bug is there. Real programs don't. Nobody showed you how to pick a target, read the scope and decide where to look first.
You found something, wrote it up alone and hit submit. It came back closed, and nobody told you whether it was the impact, the reproduction steps or the scope.
Hundreds of programs, and no idea which ones a beginner can realistically find something on. So you open a few, feel lost, and close the tab.
Self-study has no deadline and no one checking in. One busy week becomes four, and you're back to square one.
This internship is built around those four moments: a fixed lab path, real targets, feedback on every report you submit, and a weekly check-in so you don't drift.
A fixed order of PortSwigger Web Security Academy modules and labs. Core Apprentice and Practitioner labs are required. Expert labs are optional bonus work.
You hunt on real targets. Choose VDPs (the easier route to a first valid bug) or paid bug bounty programs. All four video courses unlock at the start of Phase 2.
You'll know how to pick a program, read its scope, map the app and decide where to look first, instead of staring at a login page.
How: the How to Approach a Target course, plus a weekly live Q&A where you bring the target you're stuck on.
Clear reproduction steps, real impact, in scope. The difference between "informative" and "triaged" is usually the report, not the bug.
How: a lab write-up every week in Phase 1, report writing in week 10, and a review of your submitted reports showing what went wrong and how to improve.
An internship under Experience, real hunting you can talk through, and ideally an accepted bug report to point to.
How: a completion certificate, and for top performers: CV review, referrals, interview prep and a LinkedIn shoutout.
All four open at the start of Phase 2. Watch them in whatever order fits the targets you're hunting. No bug class is forced on you each week.
Picking a program, reading scope, mapping the app and deciding where to look first.
The lower-severity bugs that are most realistic for a first valid report, and how to find them.
Going deep on BAC and IDOR on real applications, building on Phase 1 week 3.
How to use AI tools to speed up recon, understand unfamiliar code and write clearer reports.
Every week: a lab target, a short quiz and one write-up. Tap a week to see what it covers.
Burp Suite setup, HTTP refresher, note-taking and how to write up a lab. Then SQL injection.
Authentication vulnerabilities and directory traversal.
Access control vulnerabilities and IDOR. The base for the Broken Access Control course in Phase 2.
Reflected, stored and DOM-based XSS.
Cross-site request forgery, CORS misconfigurations and clickjacking.
Server-side request forgery and OS command injection.
File upload vulnerabilities, XXE injection and information disclosure.
Business logic vulnerabilities, race conditions and API testing.
JWT attacks, OAuth authentication and an introduction to server-side template injection.
Redo weak areas, complete the Phase 1 assessment, and learn report writing and program rules before hunting.
Requests, responses, cookies, a bit of HTML. That's the only entry requirement. There's no screening.
Not another certificate of completion, but an accepted bug report you can point to on your CV.
If you hunt on VDPs, complete the program requirements, and still haven't landed a valid bug by the end of the 6 months, you keep getting free support until you do: live Q&A, tips, chat support and course access through our bug bounty hunters membership. No cap on the extension.
"I was sceptical in the beginning but definitely worth the price."
"Amazing course gives you a strong foundation for beginners. Everything is explained and structured clearly. The hands-on labs are amazing, clear and easy to set up… 10/10 I highly recommend it."
"Cyber Armory provides a well-structured foundation for individuals beginning their cybersecurity journey. The curriculum introduces technical concepts in a way that supports gradual learning and skill development."
"This course is excellent and explains everything a beginner needs to know in a clear and practical way. The lessons are well structured and easy to follow, making it simple to understand each topic step by step."
until registrations close on 30 November
Secure checkout via Whop · Limited seats
The labs are free, and we use them. What you're paying for is everything around them: a fixed order to learn in, a weekly target and check-in so you don't drift, feedback on the reports you submit, so you learn why one got closed, four hunting courses, and a weekly live Q&A where you can bring the real target you're stuck on. Most people who go it alone have the same free labs. What they don't have is the structure and the feedback.
No. You need basic knowledge of how the web works. Phase 1 starts with Burp Suite setup and an HTTP refresher, and builds up from there.
About 1 to 2 hours a day. In Phase 1 that covers the week's labs, a short quiz and one write-up. In Phase 2 it's hunting time, and the people who find bugs are the ones who hunt consistently.
Yes. It's built for 1 to 2 hours a day. Apart from the weekly live Q&A, everything runs on your own schedule.
The batch starts on 1 December. Registrations close on 30 November.
No. Burp Suite Community Edition is free and covers the required labs. A few optional Expert labs use Burp Collaborator, a Pro feature, but you don't need them to progress.
Sessions aren't recorded, since they're live Q&A rather than lectures. If you can't make one, post your question in the chat or forum and it gets answered there. The next session is never more than a week away.
English.
No. It's a single one-time payment of ₹6,000. No subscription and no hidden fees.
To move into Phase 2, you complete at least 80% of the required core labs plus the weekly write-ups. If you fall a little short, there's a catch-up window during week 11 while Phase 2 onboarding runs.
We understand that life happens. You won't be dropped. Keep working through the Phase 1 labs at your own pace, and as soon as you complete them, we'll move you up to Phase 2 with full access to the hunting courses, live Q&A and report reviews.
No one can honestly guarantee a bug. What we guarantee is support: if you hunt on VDPs, meet the program requirements and haven't landed a valid bug by month 6, you keep getting free support until you do.
A report the program has accepted or triaged as valid. Duplicates, informative and not-applicable closures don't count. You confirm it with a screenshot of the program's acknowledgment, with sensitive details removed.
Your choice. VDPs are the easier route to a first valid bug, and only VDP hunters are covered by the support guarantee. Paid programs pay bounties but are more competitive.
Yes, if you clear the Phase 1 gate and meet the Phase 2 participation requirements. The certificate doesn't depend on finding a valid bug.
Top performers get a CV review, referrals to our contacts, interview prep and a LinkedIn shoutout from Cyber Armory. Top performers are the interns with the most valid bugs across the whole internship, with severity and then report quality as tie-breakers.
Yes. You only test programs and assets that are explicitly in scope, under each program's policy. No denial of service, no rule-breaking automated scanning, no accessing other users' data beyond the minimum proof of concept, and no public disclosure before the program allows it.
On Whop. Courses, announcements, forums for check-ins and report reviews, and chat for day-to-day support all live in one place.
Batch starts 1 December. Registrations close 30 November.