Defensive Cloud Native App and DevSecOps Workshop
Find, hack and fix security vulnerabilities in cloud native apps. From Integer Overflow to Prompt Injection — a hands-on, instructor-led workshop built on Defensive Programming principles.
The Full Spectrum of Handling Security Vulnerabilities
Numerous critical vulnerabilities in cloud-native apps arise from logical flaws, incorrect assumptions about dependent technologies, and insecure patching — flaws with no known syntax or patterns detectable by SAST or DAST tools.
Defensive Programming, taught hands-on
After years of penetration testing and secure code review, we developed a workshop that teaches Defensive Programming principles — battle-tested approaches that ensure effective remediation of security vulnerabilities, making your app secure by design. You will gain expertise in finding, hacking, and fixing security vulnerabilities in modern apps.
Three parts, beginner to advanced
From essential foundational AppSec topics, to hard-to-find vulnerabilities via Black Box, White Box and Fuzzing approaches, to effective remediation and the common mistakes in security patching.
At a glance
- For: Software engineers, Security champions, Security engineers, AppSec & DevOps engineers, Code auditors, Penetration testers, Bug hunters
- Languages: JavaScript, Python, Go, Java, TypeScript, C# (.NET), Ruby, Docker
- Levels: Three parts — Starter, Intermediate and Advanced
- Duration: Starter: 2 days · Intermediate: 2 days · Advanced: 1 day
- Delivery: In-person or online
- Instructor: Dr. Pedram Hayati — LinkedIn | Twitter
From Integer Overflow to Prompt Injection
A subset of topics is selected based on participants’ skill level and the available class time.
Module 1: Introduction
Understand the root cause behind software security vulnerabilities, and explore why they are challenging to identify and remediate effectively:
How software is developed
What we believe our software does vs what it actually does
It is difficult to make a deterministic system
Why we have many software vulnerabilities
Software security is fundamentally a software engineering problem
Common but inadequate approaches to fix vulnerabilities
Security vulnerability is not a software bug
Why post-release patching is dangerous
Module 2: Rapid Threat Modelling
Learn a technique for early detection of software vulnerabilities and develop a hacker mindset:
Identify software vulnerabilities during team stand-ups
Trust boundary analysis
Five + three threat actors
Discover threats
Common insecure assumptions that are targeted
Rapid Threat Modelling
STRIDE
SecDim's Threat Thinking Matrix
🧑🏾💻 Build a threat model in an attack and defence game
🧑🏾💻 Hack your own program exploitation lab
Module 3: Find, Hack and Fix Numeric Overflow Vulnerabilities
There are edge cases that can turn an arithmetic result into a security disaster. In this module, we learn how to identify and exploit Numeric Overflow vulnerabilities. We learn the first part of a defensive programming principle that effectively remediates this vulnerability class.
Boeing 787 shutdown: a related security incident
Numeric datatypes: int, long, double, float
How a computer does arithmetic
Why overflow happens
Patriot surface-to-air casualty: a related security incident
Float datatype
How a computer does floating-point arithmetic
Issues with IEEE 754 standard
Rounding imprecision
Approximate representation
What Numeric Overflow is
Root cause of Numeric Overflow
Affected languages by Numeric Overflow
🧑🏽💻🔍 Find: Techniques to discover Numeric Overflow
Identify Numeric Overflow at runtime (blackbox testing)
Identify Numeric Overflow in the code (whitebox testing)
🧑🏽💻💀 Hack: Techniques to exploit Numeric Overflow
🧑🏽💻🩹 Fix: How to remediate Numeric Overflow
Common pitfalls to patch Numeric Overflow
Introduction to Defensive Programming Principle 1 (part 1)
Parse Untrusted Data, Don't Validate
Anti-pattern: Lack of data recognition
Part 1: Void and range check
Module 4: Find, Hack and Fix Unicode Vulnerabilities
Unicode is complex, and its complexity has introduced new classes of vulnerabilities. In this module, we learn how to identify and exploit Unicode vulnerabilities. We learn the second part of a defensive programming principle that effectively remediates this vulnerability class.
Paypal Homograph: a related security incident
From ASCII to Unicode
Two types of string equivalency in Unicode
Homoglyph and Homograph
Spotify BigBird: a related security incident
Unicode Confusable Characters
Normalisation
Four forms of normalisation
What Unicode Vulnerabilities are
What Visual Spoofing is
What Unsafe Normaliser is
Root cause of Unicode Vulnerabilities
Affected languages by Unicode Vulnerabilities
🧑🏽💻🔍 Find: Techniques to discover Unicode Vulnerabilities
Identify Unicode Vulnerabilities at runtime (blackbox testing)
Identify Unicode vulnerabilities in the code (whitebox testing)
🧑🏽💻💀 Hack: Techniques to exploit Unicode Vulnerabilities
🧑🏽💻🩹 Fix: How to remediate Unicode Vulnerabilities
Introduction to Defensive Programming Principle 1 (part 2)
Part 2: Character-set, format and semantic check
Module 5: Find, Hack and Fix URL & Filepath Handlers Vulnerabilities
Parsing URL and file paths is not a trivial task and requires careful handling to avoid vulnerabilities. This module is dedicated to identifying and exploiting two specific vulnerabilities: Path Traversal and Server Side Request Forgery that impact URL or filepath handlers. Additionally, we explore best practices for effectively remediating these vulnerabilities:
Capital One Leak: a related security incident
URL handling is complex
Relative and absolute filepath
What Path Traversal is
What Server Side Request Forgery (SSRF) is
Root causes of Path Traversal & SSRF
Affected languages by Path Traversal & SSRF
🧑🏽💻🔍 Find: Techniques to discover Path Traversal & SSRF
Identify Path Traversal & SSRF at runtime (blackbox testing)
Identify Path Traversal & SSRF in the code (whitebox testing)
🧑🏽💻💀 Hack: Techniques to exploit Path Traversal & SSRF
🧑🏽💻🩹 Fix: How to remediate Path Traversal & SSRF
Common pitfalls in patching Path Traversal & SSRF
Anti-pattern: Insufficient data recognition
Canonicalisation
Applying Defensive Programming Principle 1
Module 6: Find, Hack and Fix Injection Vulnerabilities (Intermediate)
There are various types of vulnerabilities stemming from the evaluation and execution of untrusted input. In this module, we delve into the identification and exploitation of Injection vulnerabilities. Additionally, we explore a second defensive programming principle that serves as an effective remedy for this class of vulnerabilities:
Uber rider RCE: a related security incident
Why software evaluate and execute inputs
What XSS, SSTI, and SQLi have in common
Template engine
Expression language
What Server Side Template Injection (SSTI) is
Root cause of SSTI
Affected languages by SSTI
🧑🏽💻🔍 Find: Techniques to discover SSTI
Identify SSTI at runtime (blackbox testing)
Identify SSTI in the code (whitebox testing)
🧑🏽💻💀 Hack: Techniques to exploit SSTI
🧑🏽💻🩹 Fix: How to remediate Injection Vulnerabilities
Introduction to Defensive Programming Principle 2
Anti-pattern: Loosely defined data model
Anti-pattern: Shotgun parser
Make Unsafe State Unrepresentable
Value Objects
Domain Primitives
Module 7: Find, Hack and Fix Parser Differential Vulnerabilities (Intermediate)
Parser differential is a class of vulnerabilities that is challenging to detect and rectify. It is a type of weakness that may not be identified in a standalone system but becomes apparent in communication with other systems. In this module, we focus on the identification and exploitation of Parser Differential vulnerabilities. Additionally, we explore a third defensive programming principle that serves as an effective remedy for this vulnerability class.
Android Signature Bypass: a related security incident
Incomplete protocol design specification
Inconsistent implementation
New security attacks targeting micro service environments
What Parser Differential vulnerability class is
HTTP Desync Request Smuggling
Subject Name Confusion in X.509
JWT Algorithm Confusion
What HTTP Parameter Pollution is
Root cause of HTTP Parameter Pollution
Affected languages by HTTP Parameter Pollution
🧑🏽💻🔍 Find: Techniques to discover HTTP Parameter Pollution
Identify HTTP Parameter Pollution at runtime (blackbox testing)
Identify HTTP Parameter Pollution in the code (whitebox testing)
🧑🏽💻💀 Hack: Techniques to exploit HTTP Parameter Pollution
🧑🏽💻🩹 Fix: How to remediate HTTP Parameter Pollution
Introduction to Defensive Programming Principle 3
Anti-pattern: Security via syntactic idioms
Make Unsafe Behaviour Impossible
Design By Contract
Phantom Type
Module 8: Find, Hack and Fix Race Condition Vulnerabilities (Intermediate)
Race condition vulnerabilities, while challenging to trigger, are prevalent in modern applications. This module delves into the identification and exploitation of Race Condition vulnerabilities. Additionally, we explore a fourth defensive programming principle, which, when implemented correctly, serves as a remedy for this vulnerability class.
Privilege Escalation in Steam Engine: a related security incident
Shared resources used by apps
Concurrency and threading
What Race Condition is
What Time of Check Time of Use (TOCTOU) is
Root cause of TOCTOU
Affected languages by TOCTOU
🧑🏽💻🔍 Find: Techniques to discover TOCTOU
Identify TOCTOU at runtime (blackbox testing)
Identify TOCTOU in the code (whitebox testing)
🧑🏽💻💀 Hack: Techniques to exploit TOCTOU
🧑🏽💻🩹 Fix: How to remediate TOCTOU
Introduction to Defensive Programming Principle 4
Anti-pattern: Branch on a mutable object
Immutable Branching
Defensive Copying
Immutable Object
Easier to Ask Forgiveness than Permission
Module 9: Find, Hack and Fix Unbinding (Deserialisation) Vulnerabilities (Intermediate)
A cloud-native app requires parsing incoming requests and deserialising or unbinding them to in-memory objects. However, this process is susceptible to various vulnerabilities and methods of exploitation. In this module, we focus on identifying and exploiting the Mass Assignment vulnerability, a specific weakness in the unbinding process. Additionally, we explore an approach that serves as an effective remedy for this vulnerability:
Github hack: a related security incident
Unbinding vs deserialisation
Object Relational Mapping
What Mass Assignment is
Root cause of Mass Assignment
Affected languages by Mass Assignment
🧑🏽💻🔍 Find: Techniques to discover Mass Assignment
Identify Mass Assignment at runtime (blackbox testing)
Identify Mass Assignment in the code (whitebox testing)
🧑🏽💻💀 Hack: Techniques to exploit Mass Assignment
🧑🏽💻🩹 Fix: How to remediate Mass Assignment
Defensive Programming Principle 2 and 3
Anti-pattern: Loosely defined data model
Effective remediation of Mass Assignment
Module 10: Find, Hack and Fix Regular Expression Engine Vulnerabilities (Intermediate)
Regular expressions are commonly employed for validating untrusted data. However, as the regular expression engine parses untrusted data, it can become a target for security attacks. This module focuses on identifying and exploiting ReDoS (Regular Expression Denial of Service), a vulnerability in the regular expression systems. Additionally, we delve into best practices for effectively remediating this vulnerability:
StackOverflow Outage: a related security incident
Backtracking
Catastrophic backtracking
What Regular Expression Denial of Service (ReDoS) is
Root cause of ReDoS
Affected languages by ReDoS
🧑🏽💻🔍 Find: Techniques to discover ReDoS
Identify ReDoS at runtime (blackbox testing)
Identify ReDoS in the code (whitebox testing)
🧑🏽💻💀 Hack: Techniques to exploit ReDoS
🧑🏽💻🩹 Fix: How to remediate ReDoS
Best practices in remediation of ReDoS
Regex matcher timeout
Atomic grouping
Possessive quantifiers
Text-directed engine
Module 11: Find, Hack and Fix Container Vulnerabilities (Intermediate)
Containers are second layer of defence in a cloud native security. Learn how to identify, exploit and fix insecure containers:
🧑🏽💻 Docker-in-docker exploitation
🧑🏽💻💀 Compromise host via insecure container
🧑🏽💻💀 Kernel namespaces and capabilities
🧑🏽💻💀 Privileged containers and RCE
🧑🏽💻💀 Root containers vs root in the container
🧑🏽💻💀 Insecure default container capabilities
🧑🏽💻💀 SUID binaries in container
🧑🏽💻🩹Hardening containers
Module 12: Find, Hack and Fix AI Vulnerabilities (Advanced)
Artificial Intelligence (AI) systems have introduced novel classes of vulnerabilities, presenting unique challenges. The vulnerabilities span the pre, during, and post-model creation phases, each with its distinct set of security issues. This module focuses on identifying and exploiting Prompt Injection vulnerabilities in AI systems. Furthermore, we delve into best practices for effectively remediating this vulnerability:
Google Bard disclosed sensitive data: a related security incident
What Large Language Model is
Lack of understanding of LLM capabilities and vulnerabilities
AI vulnerabilities at inference time
What Prompt Injection is
Competitive objectives
Mismatched generalisation
Root cause of Prompt Injection
🧑🏽💻🔍 Find: Techniques to discover Prompt Injection
Identify Prompt Injection at runtime (blackbox testing)
Obfuscation
Token Smuggling
Virtualisation
Context Switching
Payload Splitting
🧑🏽💻💀 Hack: Techniques to exploit Prompt Injection
🧑🏽💻🩹 Fix: Best practices to remediate Prompt Injection
Anti-pattern: interpret data as code
Output filtering
Whitelisting or Blacklisting
Stop Sequences
Reinforcement
User Response Tagging
LLM Reevaluation
Sandwich Defence
Module 13: Fuzzing (Advanced)
Identify hard-to-find security vulnerabilities and automate their discovery using fuzzing techniques:
Write security unit tests
Blackbox fuzzing
Coverage guided fuzzing
Property based fuzzing
Swarm fuzzing
Stateful fuzzing
Metamorphic fuzzing
AI assisted fuzzing
Module 14: Attack and Defence Competition
Wrap up the workshop with a unique attack and defence competition, leveraging the world's first Attack and Defence SecDim Wargames.
What is included?
- Step-by-step delivery by a highly qualified instructor
- Large collection of self-paced git-based labs
- Access to an exclusive support forum
- Certificate of completion
- Full access to workshop content
A Three-Month Pathway, Not a One-Off
We forget almost 60% of newly acquired information within a week. You get a practice schedule and mentorship during a three-month pathway, so secure software engineering becomes your habit.
Reserve Your Seat Today
Our workshops are offered only a few times a year — don't miss out. Get in touch with our team to reserve your seat and confirm workshop details. Graduates can earn the SecDim Certification in Defensive Programming, highly sought after by top employers.