I've been trying to learn ethical hacking for more than that two years thus far, I did a lot of practice on things like DVWA, hackthissite.org, metasploitable and some more similar apps and sites. Yet I can't find any vulnerability in a real-world website, like my friend's site that he asked me to test.

I don't know what I am missing here or what I am doing wrong.

I need to know how to sharpen my skills and how to advance my level to more complicated ones.

closed as too broad by Steffen Ullrich, Tom K., Philipp, Anders, Rory Alsop Aug 27 '18 at 12:04

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    Ethical hacking has nothing to do with your skill and abilities to find vulnerabilities. – mootmoot Aug 27 '18 at 7:49
  • 1
    Please rephrase your question, e.g. "how do I polish my ethical hacking skill". – mootmoot Aug 27 '18 at 8:47
  • Does your friend's site have a vulnerability? – schroeder Aug 27 '18 at 13:44
  • @hossam You can accept my answer if you think I gave it right. It will also help others to find the correct answer. – Err0rr Aug 29 '18 at 7:31

Yet i can't find any vulnerability in a real-world website.

Not sure what are you actually trying to do. If you find vulnerable sites and exploit it then you will no longer be ethical. Since you have spend two years in this field you should know the definition already.

If you want to find the real world vulnerabilities then you can start with google dorks. In most of the case you will find the vulnerable websites, for example the website which are vulnerable to SQLi use this view.php?cid=. Of course you need to check further. You can start here

Secondly, for sharpen your hacking skills I recommend you to try hackthebox, it have a range of vulnerable box where you can show your real hacking skills. All of the box content the real world vulnerabilities and you will also get chance to learn more. Alternatively, there are other sites too which you can try, for example pentestit but I find hackthebox better.

Lastly, if you are seeking hacking profession then you can go for infosec certs like OSCP or may be some SANs certs

  • 2
    If you are doing penetration testing then you can follow penetration standard. For sharpen you skills you can checkout the links in above answer. – Err0rr Aug 27 '18 at 7:00

Ethical Hacking is a long-term study, you need to improve your skills on daily basis, and keep up-to-date with latest techs.

This is not a guide that you have to follow, but most of these ideas should help you:

  • Maintain a perfect coding knowledge, improve your coding skills in programming languages that is used by developing "hacking" tools, such as Python, C, Perl.
  • Work on a real-world examples, but try not to do harm, there's plenty of sites that's made vulnerable on purpose, try on them!
  • Keep your Networking knowledge at its best, IPs, masks, routing, ... etc. You need to know all of that to become a better Ethical Hacker
  • Take some courses, like CEH EC-Council, you need to know the full track of becoming a professional, some of the steps are basic and boring, but it's an educational track.
  • Find any job in a networking field, it doesn't have to be in a security field. This will help you encounter the problems in a best way.

Next steps

There's a lot in the way of Ethical Hacking, keep an aye of the level you want to be in. Some people focus on networking level, while others interested in web-level applications, after all there are many levels of security flaws, each needs a specialist in that level!

For example, you'll need a good database knowledge in order to exploit a flaw in some database server, or even to find the flaw!


Keep listening to security news, read hacking articles, and make it a habit. After all, you won't be benefit of Ethical Hacking unless you find a job in a security position in some company, and walk your way through it!

  • 2
    So you have to be perfect in coding and networking? I think this is a bit of an overstatement.. – Tom K. Aug 27 '18 at 8:24
  • Well, you need to overcome someone's code to find a flaw in it, so yes, at least you should be on a higher level than a normal developer – Emadeddin Aug 27 '18 at 8:41
  • 3
    This is a false conclusion. You have to be an outstanding programmer to build something with no flaws, but you only have to be a mediocre programmer to find one flaw in somebody else's code. – Tom K. Aug 27 '18 at 8:57
  • 4
    I will agree that coding is a must in information security field, but I disagree with "at least you should be on a higher level than a normal developer", as Tom K. pointed out a professional developer has to be a lot better coder than an infosec specialist. – game0ver Aug 27 '18 at 9:03
  • No one have to be perfect, actually no-one is perfect. This is where hacker should be good at. S/he should be good at finding those errors like @Nat did. I do not agree that hacker need to have better coding skills. According to me all developers are hackers but all hackers are not developers. You can take an example of this page. Developers have found many vulnerabilities. – Err0rr Aug 27 '18 at 9:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.