Fully virtual and fully hands-on, this course with a veteran mobile security expert aims to arm security champions, advanced developers, testers and pentesters with the skills, in-depth knowledge and battle-proven techniques necessary to exploit and test iOS applications. The boutique course also covers unique platform features and security services that make developers’ lives easier – and create new difficulties for penetration testers. Starting from the ground up, the course discusses the Cupertino philosophy towards security on the iOS platform, consequent approaches to security mechanisms, developer choices and associated risks. You’ll get a quick start on analysing iOS applications both statically and using a physical device (nevertheless, an up-to-date iOS 15 device will do just fine as a build target in Xcode). You’ll learn to add Frida and Burp to your tooling arsenal. Attendees will complete the course with all of the knowledge they need to get hands-on with real mobile application testing and take their skills even further. Click for details!   

A hands-on course aiming to arm developers with the skills, in-depth knowledge and battle-proven techniques necessary to exploit mobile applications. The course also covers unique platform features and security services that make developers' lives easier – and create new difficulties for penetration testers. Starting from the ground up, the course discusses the underlying security philosophy of both major mobile platforms, consequent approaches to security mechanisms, developer choices and associated risks. You’ll get a quick start on analysing mobile applications both statically and using an emulator or physical device. Attendees will complete the course with all of the knowledge they need to get hands-on with real mobile applications and take their skills even further. Click for details!   

Since we first delivered our iOS security course four years ago, we’ve consistently put effort into polishing it to perfection – and of course keeping it up to date with the newest trends on the platform. Most recently, we’ve incorporated a wealth of practical exercises (re)written in Swift. The advanced level course covers the foundations of security on iOS, as well as each chapter of the Mobile Application Security Verification Standard (OWASP MASVS). Besides an exciting exploration of the real-life hacker experience through Black Hat / DEF CON talks and popular podcasts, we engage participants with stories, labs, quizzes, and two off-the-schedule facultative classes (on-demand). Click for details!   

Five years in the making, we’ve continued to develop and polish our Android security course, with the incorporation of a huge bundle of practical exercises rewritten in Kotlin being the latest addition. As with our iOS course, this advanced level course covers the foundations of security on the platform alongside comprehensive coverage of each chapter of the Mobile Application Security Verification Standard (OWASP MASVS). Participants will explore the real-life hacker experience through Black Hat / DEF CON talks and popular podcasts and garner hands-on experience through a variety of stories, labs, quizzes, and two off-the-schedule facultative classes (on-demand). Click for details!   

Our Webapp & API security workshop covers both the basics of secure coding and framework-specific skills. It stands above other courses like it — expect 3 days of intense hands-on learning, with many topics on the table. The basics are explained using a platform-agnostic approach and examples in Python; students can also learn platform/framework related patterns in their framework of choice (eg. Node.js). The course covers both offense and defense: detecting and exploiting vulnerabilities, finding them in the source, and – most importantly – mitigating them and preventing them from the start by applying secure development patterns. Click for details!   

Our Java/Kotlin security workshop covers the fundamentals of secure coding in the Java environment. Throughout the course, developers will deep dive into the custom-built labs and sample applications. We believe that developers understand security concepts best within the context of their preferred programming languages, libraries and frameworks, so we offer a variety of exercises and examples to fit your company's particular toolset. With these tailored labs, we create actionable knowledge that enables the developers to improve the security quality of their code from the very earliest stages of development. Click for details!   

This training course introduces developers to Secure Software Development Life Cycle (S-SDLC) methodologies and practices and provides a clear strategy for recognizing insecure patterns using various technologies (mobile and web) and programming languages. Attendees will familiarize themselves with commonly-used security tools, exploit vulnerabilities in real code, create a fix based on the OWASP ASVS, mASVS (for mobile) and SKF recommendations and validate the effectiveness of their solution. Click for details!   

Practice-changing impact, long lasting security knowledge and skills -- are the expected outcomes of this new-school webapp security training. This is a training with minimum lectures and all focused on hands-on exercises. We start off with some understanding of secure development and the secure coding principles. Then we do basic hacking challenges and move gradually to the advanced topics, but after that we do exercises that are about fixing vulnerable code. The attendees will have after this course a vast set of actionable knowledge and practise to be used straight away. Click for details!   

This workshop provides testers and developers with an overview of how the Burp Suite can be used for web testing. Even though Burp is primarily designed for penetration testers, its sophisticated feature set also makes it a great tool for anyone doing general bug hunting in web applications. Participants will gain a general understanding of how web applications work under the hood, how to use Burp for troubleshooting and how to utilize its toolset to re-create error conditions through manual HTTP traffic manipulation. In the final steps, we'll take an in-depth look into how to leverage the Burp API through Python in convoluted scenarios. Click for details!   

Mobile security test automation workshop focuses on how to set up security test automation in your CI/CD pipelines. But also how to create an agnostic pipeline approach that works over different CI tooling. Build once, run everywhere! In the course we will in depth cover different security tooling for mobile software development. We cover static analysis tools and dynamic analysis tools, and in what stages of development to introduce these tools. By learning the tools that the hackers will run against your application, we will learn how to create more robust and hardened applications. Click for details!