After years of pen testing and bug bounty hunting, if someone asked me "what should I learn to find first?" — here's my list, in order:

1. IDOR (Insecure Direct Object Reference)

Change a number in a URL, access someone else's data. It's embarrassingly simple and still everywhere. Most beginner-friendly bug class by far.

2. Reflected XSS

Inject a script tag into a search parameter. Not always high severity, but it teaches you how user input flows through an application — which is the foundation of everything else.

3. Broken Access Control

Can a regular user hit admin endpoints? Can you access features you shouldn't? Most apps mess this up. Test every role boundary.

4. SQL Injection (classic)

Yes, it still exists. Especially in older apps, internal tools, and anything with custom search/filter functionality. Learn to spot the error messages.

5. Authentication Bypass

Password reset flows, session handling, token leakage. There's almost always something wrong with how apps handle auth. Learn to think like someone trying to get in without credentials.

The pattern: start with logic bugs (IDOR, access control) before injection bugs (XSS, SQLi). Logic bugs require less tooling and more critical thinking — which is what actually makes a good hacker.

If you want a structured 90-day path to learn all of this and build a real portfolio, check out Modern Hacker Academy.