DEVELOPER TRAINING

Hands-on security training for your developers, taught by the analysts who find vulnerabilities in our assessments, and built around the code you write.

Built for Developers

Much security training consists of slides and generic advice, far removed from the work of writing code. Ours is taught by the analysts who find vulnerabilities in our security assessments, many of whom worked as software developers before moving into security. Most of the time is spent in code: vulnerable code, how attackers exploit it, and how to fix it. Our courses grew out of Vulnerability Discovery and Exploitation, a lecture series we teach to Bachelor’s Honours students at Stellenbosch University, one of South Africa’s leading universities.

Training for Teams We Work With

Most of our training starts from work we are already doing with you. Because we know your code and what we found in it, the training is about your vulnerabilities, not generic examples.

Findings Workshop

Half a day with your developers after a security assessment. We walk through the vulnerabilities we found in your code, show how each one is exploited, and fix one or two of them together. Your developers leave knowing why the bugs occurred and how to avoid them in the next pull request.

Recurring Sessions

When our analysts work with you as an embedded security team, they can run short, regular sessions on bugs from your own code base and their fixes, and help new developers get started with your security practices.

Tailored Courses

For more depth, we run the courses below for your team, with examples and exercises adapted to your languages and frameworks, or built around the vulnerabilities we found in your code.

Courses

Each course runs for two to five days, on-site or remote. We agree the scope with you: which topics, how deep the labs go, and whether the exercises use your own code.

Web Application Security for Developers

For: Web developers and tech leads, whatever language and framework they use
Format: 2 to 5 days, instructor-led, on-site or remote; also available as self-paced e-learning
Prerequisites: Programming experience in a web language

Your developers see how attackers approach a web application, exploit each vulnerability class themselves, and then fix it, so they recognize the same flaw in their own code. The course follows the vulnerabilities we find most often in our security assessments, and can be built around the ones we found in yours.

Web applications from an attacker's perspective
Injection: SQL and command injection, and why parameterization works
Authentication and authorization: sessions, JWTs, IDOR, privilege escalation
Cryptography and secure storage of passwords and keys
Cross-site scripting and Content Security Policy
Cookies and session management
File handling: uploads and path traversal
XXE and server-side request forgery
Insecure deserialization
Software supply chain and dependency scanning
Security logging and monitoring

Each topic comes with a lab, and real-world case studies show the same bugs in widely used software, such as an account takeover through a WordPress plugin and a file download in Typo3 through PHP type juggling. For onboarding and as a refresher between sessions, the course is also available as twelve self-paced e-learning modules for your learning platform.

Vulnerabilities and Exploits in Native Code

For: C and C++ developers, embedded and firmware teams, security engineers
Format: 2 to 5 days, instructor-led, on-site or remote
Prerequisites: C and the basic Linux command line

How memory corruption works, from the machine code up, and why it is still found in code written today. Developers learn to recognize the patterns in their own code, and why mitigations raise the bar but do not remove the bug. A natural follow-up to a security assessment of C or C++ code.

From source to machine code: executables, calling conventions, the stack
Stack-based buffer overflows and shellcode
Mitigations and how they are bypassed: canaries, non-executable memory, ROP, ASLR
Heap overflows and allocator internals
Integer vulnerabilities: overflows, truncations, signedness
64-bit migration vulnerabilities, from our research published at ACM CCS
Use-after-free and double free
Auditing C and C++ code: strategies that work in practice

Case studies follow real bugs from discovery to a working exploit: Heartbleed, a heap overflow in MPlayer, and an unauthenticated remote root in a D-Link router.

Vulnerability Discovery with Code Property Graphs

For: Application security engineers, security researchers, and engineers who build tools on Joern
Format: 2 to 5 days, instructor-led, on-site or remote
Prerequisites: Programming experience; we teach the Scala you need

Taught by the inventor of the code property graph and lead developer of the open-source platform Joern. Our team has taught hands-on Joern workshops at RSA Conference, NorthSec, and SCALE since 2020. Participants learn how code is represented as a graph, what static analysis can and cannot do, and how to find vulnerabilities with their own queries. Longer courses go on to automating Joern and building tools on top of it. The course also covers how code property graphs and large language models work together: the graph gives a model precise facts about the code, such as where attacker-controlled data flows, and the model helps write queries and assess their results. After a custom static analysis project, the course prepares your security team to run, maintain, and extend the checks we built for your code base.

The code property graph and the limits of automated vulnerability discovery
The Joern shell, and enough Scala to be productive
What is in the graph: syntax trees, calls, types, control flow, and dominators
Data-flow tracking: sources, sinks, and data-flow semantics
Reducing false positives
Binary code with Ghidra and Joern: from a firmware image to a remote root
Encoding the patterns of your own code base as reusable checks
Scripting and automation: Scala scripts, joern-scan, and Joern from Python
Building on Joern: using it as a library, custom passes, and extending the graph schema
Code property graphs and LLMs: precise program analysis for AI agents

Each day combines a presentation with an exercise session on real code, including vulnerable services built for the course, with solutions provided as Joern scripts.

Joern Internals

For teams that build products on Joern or contribute to it, we also offer an advanced course on request: Joern's architecture, the phases of building the code property graph, writing language frontends, and the data-flow engine in depth.

Built on Your Findings

Patterns that keep coming back in your code can also become custom static analysis that catches them in every pull request, so that what your developers learned is also checked automatically.

Talk to Us About Your Project

Tell us what you are building and what worries you about it. We reply within one business day.