Platform
SecureFlag is the most advanced secure coding training platform for Developers, DevOps, and QA engineers.
We have revolutionized the antiquated approach to secure coding training. SecureFlag comprises 100% hands-on exercises designed to enhance developers' secure coding skills via exercises in real working environments.
Explore Our Platform
Labs
Developers have access to a continuously updated library of labs based on real-world vulnerabilities. SecureFlag labs teach participants how to identify and remediate the most prevalent security issues by doing instead of simply seeing. Labs run in real, virtualized development environments.
Learning Paths
Training courses enable participants to attain expert, usable knowledge in a systematic and iterative manner. When candidates complete a Learning Path, they receive a certification which they will maintain by taking refresher exercises. Our Learning Paths have been carefully designed to incorporate relevant, related, and escalating issues, building on one another in complexity to ensure that the solidity of the foundation is continuously and logically augmented.
Adaptive Learning
With SecureFlag, organizations can automatically assign participants training in the areas they need it most by adapting topics and difficulty levels based on each individual user's previous results. Organizations can effortlessly implement iterative and individualized training to fill competence gaps and thus ensure they include and retain the most skilled workforce to help them achieve their business ambitions.
Tournaments
Managers can set up tournaments, the perfect way to both engage with the broader, enterprise-wide developer community and promote learning in a fun and team-oriented manner. Contact your Customer Success Manager for communication templates, posters, certificates, and swag for the winners.
Metrics and Reporting
SecureFlag measures participants' real secure coding competence with powerful, in-depth analytics and on-demand reports. Developers and managers can easily interpret which areas to focus on with a dashboard that displays actionable information derived from individual, team, and organization-wide learning outcomes. All completed exercises, scores, tournaments, and test stats can be reviewed and used for ongoing on-the-job improvement.
SDLC Integrations
Organizations can embed our security training as part of the Software Development Lifecycle by using our APIs, plugins, and SCORM integration. We also support custom exercise creation via our open-source SecureFlag SDK.
What We Cover
Technologies
Java
.NET
NodeJS
Scala
PHP
Python
Go
Ruby
C
C++
Smart Contracts
JavaScript
TypeScript
Angular
React
Vue.js
Android
Kotlin
Objective-C
Swift
React Native
Flutter
ABAP
APEX
COBOL
SQL
Attack Log Analysis
Exploitation
QA Security Testing
Code Review
Pseudocode
Secure SDLC
Security Awareness
Server Hardening
Docker
Kubernetes
Terraform
AWS
Azure
GCP
AI
CI/CD
Secure Coding Topics
Arbitrary File Download
Arbitrary File Upload
Authentication Bypass
Authorisation Bypass
Bad Randomness
Broken JWT Authentication
Broken Memory Management
Broken OAuth Authentication
Broken SAML Authentication
Clickjacking
Content Security Policy Compliance
Cross-Site Request Forgery
Cross-Site Scripting DOM-based
Cross-Site Scripting Reflected
Cross-Site Scripting Stored
Cross-Site WebSocket Hijacking
Dangerous File Inclusion
Denial of Service
Denial of Service
Double-Free
Dynamic Code Evaluation
Elasticsearch Misconfiguration
Encryption Key Reuse
Expression Language Injection
Format String Injection
Function Default Visibility
GraphQL Misconfiguration
Hardcoded Secrets
Heap Overflow
HTTP Header Injection
HTTP Parameter Pollution
HTTP Response Splitting
Inadequate CORS Policy
Inadequate Error Handling
Information Exposure
Insecure Content Sniffing
Insecure Direct Object References
Insecure Network Communication
Insecure Randomness
Insecure Secrets Handling
Insufficient Logging
Integer Overflow
Integer Overflow/Underflow
Invalidated Iterator
Leftover Debug Functionality Exposed
Local File Inclusion
Log Injection
Logic Bug
Logout Does Not Invalidate Session
Lack of Resources & Rate Limiting
Mass Assignment
Memory Leak
Missing Anti-Automation Protections
Missing Sub-resource Integrity
NoSQL Injection
NULL Pointer Dereference
Open Redirect
OS Command Injection
Padding Oracle
PCI Privacy Violation
Prototype Pollution
Race Condition
Re-entrancy
Reflected File Download
Remote File Inclusion
Sensitive Strings in Memory
Server-Side Request Forgery
Server-Side Template Injection
Session Fixation
Short Address Attack
SQL Injection
Stack Overflow
String Truncation
Time Stamp Dependency
Type Juggling
Unchecked Call Return Values
Unchecked Post Message
Unsafe Deserialization
Use After Free
Vulnerable and Outdated Components (Log4j)
Weak Encryption
Weak Hashing Algorithm
Wrong Constructor Name
XML Entity Expansion
XML Injection
XPath Injection
XQuery Injection
XSLT Injection
DevOps Topics
Exposed internal service
Permissive RBAC
Unrestricted access to the Kubelet API
Exposed Docker Socket
Exposed Kubelet read-only port
Insufficient namespace separation
Insecure API port enabled
Improper secrets management
Improper certificates management
Exposed Docker Socket
Privileged Containers
Missing Network Isolation
Exposed Docker Port
Exposed Network Service
Exposed Host Devices
Exposed Host Sensitive Data
Shared Host Network
Shared PID Namespace
Permissive Capabilities
Hardcoded Build Secrets
Unrestricted User Privileges
Secrets Disclosure via Build Arguments
Secrets Disclosure via Environment Variables
Insecure Sudo rules
Insecure SUID binaries
Permissive MySQL Privileged Grants
Permissive MySQL Grants on System Tables
Writable MySQL Plugin Dir
Sensitive Data Disclosure in MySQL Logs
Data Disclosure due to Nginx Missing Root Location
Insecure Nginx URI Path Restriction (Off-by-slash)
Insecure Nginx Variable Use
Insufficient Nginx Error Handling
Exposed Redis Service
Exposed MQTT Service
Exposed FTP Service
Exposed MongoDB Service
Exposed ElasticSearch Service
Weak Database Password
Insecure System Users Files' Permissions
Insecure Home Directories' Permissions
Insecure Services' Permissions
Insecure SSH Files' Permissions
Insecure SNMPd Configuration
Insecure Crond Configuration
Insecure Library Loading
Exposed Cloud Metadata Services
Insecure Usage of Temporary Files
More on the roadmap...
SOC Analyst Topics
Gaining initial access within a network
Achieving Remote Execution with WMI
Common persistence techniques
Privilege Escalation from "SeImpersonate" Account IIS
LOLBAS: AppLocker Bypass
Credential Theft from LSASS Memory
Credential Dumping: DCSync
Password Spraying against LDAP and Kerberos
Password Spraying against SMTP
Suspicious mail header
Maintain access through Golden Ticket
Kerberoasting and Silver Ticket
LDAP Domain Discovery
Exploiting Zerologon vulnerability
Man In The Middle: NTLMv2 Relaying and Kerberos delegation
Malicious email extensions analysis
Memory dump importance for IoC auditing
Net-NTLMv2 Relaying and Kerberos delegation
Exfiltration Over Obfuscated protocol towards C2
Event Log Clearing
Email attachment hash analysis
Exploiting PetitPotam vulnerability
Alan: injection into a legitimate process
Detecting evidences with YARA - Log4j
Detecting phishing with Sigma
Detecting Business Email Compromise
Exploiting PrintNightmare Vulnerability
Injection Into a Legitimate Process
More on the roadmap...
Cloud Topics
Remediate Overly Permissive S3 bucket Permissions
Enforce S3 Bucket Policies and Conditions to Restrict Specific Permissions
Enable Logging on All S3 buckets
Remediate Improperly Configured CloudTrail
Monitoring AWS CloudTrail Events with Amazon CloudWatch
Securing the VPC using Public and Private Subnets
VPC security groups allow broad IP range access
Network ACLs allow All Inbound Traffic
IAM Users Granted Direct Permissions
Unintentionally Public AMIs
Implementing Cross-Account Access Using IAM
Using IAM roles to promote the Principle of Least Privilege
Using IAM permissions boundaries to delegate administration in AWS
Sharing CMKs Across Multiple Accounts Using AWS KMS
Sharing Secrets Between Multiple Accounts
Storing and Rotating RDS Credentials in Secrets Manager
Using Amazon Key Management Service to Encrypt S3 and EBS Data
Server-side encryption using AWS KMS and S3
Client-side encryption using AWS KMS and S3
Client-side encryption with data key caching
Lambda functions security
Enforce SQS policies and permissions
Server-Side Encryption using AWS KMS and SNS
Server-Side Encryption using AWS KMS and SQS
Enforcing encryption for data-in-transit for SQS requests
Auditing and remediating exposed SNS topics
Using Cloudformation to securely deploy S3 buckets
Cloudformation and IAM manage access management
Mobile Topics
Cross-Site Scription in WebView
Session Fixation
Flag Secure Not Set
Event Based Local Authentication Bypass
Logging of Sensitive Data
Local Storage Misuse
Path Traversal in Content Provider
Regular Expression DoS (ReDoS)
Sensitive Activity Exported
Insecure Data Storage
Insecure App Transport Security
Insecure OAuth Configuration
Insecure Secret Storage in the System Keychain
Backup of Sensitive Data
Sensitive Service Exported
SQL Injection in Content Provider
Sensitive String in Memory
Inadequate Error Handling
Insufficient Logging
Sensitive Content Provider Exported
Sensitive Broadcast Receiver Exported
Insecure Cryptography
Extraneous Functionality
Hardcoded Secrets
Insecure Authentication
Lack of Root Check
Lack of Obfuscation
Intent Redirection
Insecure Deep Linking
Inadequate Use of the Cookie Jar Storage
Improper Platform Usage
Improper Usage of Core Data Storage
Improper Usage of NSUserDefaults Storage
Secrets Disclosure via Reverse Engineering
Use of PList Files for Secret Storage
More on the roadmap...
Security Awareness Topics
Cyber Fundamentals
How to Avoid Phishing Attacks
Safe Internet Usage
Impersonation Fraud
Avoiding Ransomware
Password Security
Social Engineering
Privacy & GDPR
Account Takeover
CEO Fraud
Safe Home Working
More on the roadmap...
SDLC Security Topics
Secure Software Concepts
Secure Software Requirements
Secure Software Design
Secure Software Implementation
Secure Software Testing
Software Security Lifecycle
Software Deployment, Operations and Maintenance
Supply Chain & Software Acquisitions
More on the roadmap...