"Hack Yourself First" is all about building up defensive skills in developers. It looks at security from the attacker's perspective and takes them through the steps necessary to exploit vulnerable software on the web so that they can experience hacking first hand. Workshop participants are set specific goals they must complete that involve probing for risks and then exploiting discrete vulnerabilities in a specially built vulnerable application. The interactive nature of the workshop means that multiple attack vectors are usually identified across the spectrum of participants and each person contributes their own unique perspective as to how specific risks are exploited.


The objective of the workshop is that each person walks away with demonstrated experience across a broad spectrum of specific risks. They not only learn about but also demonstrate practical experience across a range of different vulnerabilities targeted to the specific needs of the group.

Courses run for two days on the following schedule:


The first day build fundamental security skills that all technology professionals delivering applications on the web should posses:

- Discovering Risks via the Browser
- Using an HTTP proxy
- XSS
- SQL Injection
- CSRF
- HTTPS
- Framework Disclosure


The second day delves deeper into online risks, covering more advanced topics in greater depth:

- Password Cracking
- Account Enumeration
- FiddlerScript
- Content Security Policy
- Session Hijacking
- Subresource integrity
- Brute Force Attacks
- Automating Attacks and Review


Attendees will get taught the mechanics of each of these risks and of course the defensive patterns required to defend against them. But more than that, they get exposed to how to think about security; how to apply it in depth via multiple defences, how to choose appropriate controls based on the specific risk of the feature and how to have the discussion about what makes sense in different circumstances.

Above all though, security is just one factor in delivering working software and it has to be applied appropriately. Sometimes it comes with a trade-off against usability or cost and decisions have to be made about not what's just most secure, but what's in the overall best interests of the product being built. This workshop helps those who attend have the right discussions about when and where to invest in security.


- Software Developers
- System Administrators
- Testers

This workshop is aimed at any software developer, system admin or tester who wants to get a better understanding what is going on in cyber space if it comes to hacking and cracking of systems. This workshop enables you to take a pro-active approach and you learn how hackers will try to break your system. This workshop will be an eye opener for most attendees and it is the starting point of becoming a better developer. It all starts with awareness and improving your own habits. So start hacking yourself first, to become a better developer!


Attendees will need to use their own computer with one of following software options installed: Fiddler: 

https://portswigger.net/burp/communitydownload

If possible, please also bring your smartphone.

2 Days

Hack Yourself First: How to go on the Cyber-Offence

Security

This workshop is here to give you the skills you need to make your APIs secure. We're going to think like an attacker to test APIs and like a defender to figure out the best ways to protect them. With deep-dive talks, real-world demos, fun quizzes, and hands-on labs, you'll learn how to lock down your APIs.
During this hands-on training, we'll explore:

The security model of API-based web applications

Recognizing and addressing authorization failures

Understanding Broken Object Property Level Authorization (BOPLA)

Fixing Broken Object Level Authorization (BOLA)

Testing the security of APIs that use JWTs

Best practices for making JWTs secure in modern APIs

Identifying, exploiting, and fixing Server-Side Request Forgery (SSRF) issues

Understanding Cross-Origin Resource Sharing (CORS)

Configuring secure CORS policies for various use cases

Tracking user authentication securely with sessions or tokens

Relying on OAuth 2.0/2.1 for securing APIs

Q & A throughout the workshop to clear up any doubts


This workshop is about more than theory. We're all about giving you practical security tips you can use right away as an API developer. We dig into the root causes of API threats and how to handle them. We don't just skim the surface of problems and solutions - we get into the why's and how's, looking at common fixes, why some fall short, and which ones are currently the best way to go.
By the end of this workshop, you'll be up-to-speed on the best practices for API security. You'll also leave with a handy list of steps to check and boost the security of your applications.




This training is perfect for developers and architects who work a lot with APIs. If your role involves building, testing, or designing modern apps, this workshop will give you a thorough, up-to-date understanding of the best ways to keep things secure. We'll often use NodeJS, Flask, and Spring Boot in our code examples and demos, but you'll easily be able to apply what you learn to other languages and frameworks.




These testimonials from previous workshops give you a good idea of what to expect:

Trainer is great and an expert in the domain. All of the topics are very relevant. Practical examples for most of the topics. Excellent communication and addressing of questions.

Even though the topic is broad, there was no single moment where my focus went astray. Philippe talks in a way to keep you interested to listen to him.

I liked the the pleasant and relaxed way of speaking and the fresh style of presentation of this kind of dry stuff :)

Philippe is a friendly and knowledgable trainer and delivered an interesting course that was well presented. Questions were answered promptly and in a detailed way.


To participate in this training, you should have some experience with building API-based applications. Knowledge of application security can be helpful, but is not required.




To participate in the lab sessions, participants need a computer with a full-featured modern browser installed (preferably Chrome).


Bulletproof APIs: Hands-On API Security

For each attack, vulnerability and technique presented in this training, there is a lab exercise to help you develop your skills step by step. What's more, when the training is over, you can take the complete lab environment home to hack again at your own pace.

I found security bugs in many companies including Google, Yahoo, Mozilla, Twitter and in this training I'll share my experience with you.

After completing this training, you will have learned about:

Hacking with Google & GitHub search engines

Automated SQL injection detection and exploitation

Finding metadata with sensitive information

Automated detection of JavaScript libraries with known vulnerabilities


Students will be handed in a VMware image with a specially prepared lab environment to play with all attacks, vulnerabilities and techniques presented in this training. When the training is over, students can take the complete lab environment home (after signing a non-disclosure agreement) to hack again at their own pace.



The ticket price includes FREE access to my 6 online courses:

Exploiting Race Conditions with OWASP ZAP

Case Studies of Award-Winning XSS Attacks: Part 1

Case Studies of Award-Winning XSS Attacks: Part 2

How Hackers Find SQL Injections in Minutes with Sqlmap

Web Application Security Testing with Google Hacking


References are attached to my LinkedIn profile (

https://www.linkedin.com/in/dawid-czagan-85ba3666/

https://silesiasecuritylab.com/services/training/#opinions

 – training participants from companies such as Oracle, Adobe, ESET, ING, …




To get the most of this training intermediate knowledge of web application security is needed. Students should have experience in using a proxy, such as Burp Suite Proxy or Zed Attack Proxy (ZAP), to analyze or modify the traffic.

Students will need a laptop with 64-bit operating system, at least 8 GB RAM, 35 GB free hard drive space, administrative access, ability to turn off AV/firewall and VMware Player/Fusion installed (64-bit version). Prior to the training, make sure there are no problems with running x86_64 VMs.

Full-Stack Pentesting Laboratory: 100% Hands-On + Lifetime LAB Access

The course blends actionable guidance (e.g., AI-assisted coding security) with hands-on insights into securing AI itself (e.g., protecting model endpoints, managing drift, and red teaming AI pipelines). After completing this workshop, participants will be equipped with both the technical know-how and the processes needed to embed security into every stage of their AI-driven products.

Day 1: Using AI to Build Secure Software


Key AI security concepts and common threats

Overview of AI-related vulnerabilities in software development

Quick review of how attackers exploit AI-driven software

Understand the foundational principles of AI security

Recognize the broad threat landscape surrounding AI

Using AI-powered tools (e.g., ChatGPT, Copilot) for code generation

Common pitfalls and vulnerabilities (injected flaws, licensing, dependency issues)

Assess the security implications of AI-driven code generation

Adopt best practices to minimize vulnerabilities introduced by auto-generated code

Integrating security throughout AI/ML system development (planning, data ingestion, modeling, deployment)

Secure DevOps and MLOps practices (CI/CD with security gates)

Handling sensitive data used to train AI models

Incorporate security gates into each phase of AI software development

Properly manage and protect training data and models

Unique threat modeling considerations for AI/ML pipelines (data poisoning, model extraction)

Differences between typical web-app threat modeling vs. AI-centric threats

Identify critical assets and attack vectors in AI workflows

Apply threat modeling to preempt attacks unique to AI pipelines

5. OWASP Top 10 for Large Language Model (LLM) Applications

Top vulnerabilities specific to LLM-based applications

Prompt injection, data exfiltration, malicious chat manipulation

Recommendations, mitigations, and real-world case studies

Recognize and remediate LLM-specific security flaws

Secure LLM-based features in a production environment

Third-party libraries, datasets, and pre-trained models

Checking trustworthiness of external dependencies (data lineage, library patch levels)

Understand how AI supply chain vulnerabilities can undermine entire systems

Implement best practices to vet and protect external model/data sources

Types of adversarial attacks (evasion, poisoning, model inversion)

Techniques to detect and mitigate adversarial inputs

Gradient masking pitfalls and robust model training

Recognize adversarial attacks and how they manifest

Integrate detection and defense strategies into AI models

How to structure AI-specific penetration tests

Tools and frameworks for adversarial testing

Red vs. Blue Team exercises for AI pipelines

Conduct targeted security assessments on AI systems

Operationalize red teaming to continuously improve defenses

Lifecycle management for AI models in production

Security-driven versioning and rollback strategies

Responding quickly to emerging threats or discovered vulnerabilities

Implement robust model update/patching workflows

Reduce downtime and exposure during patch cycles

5. AI Model Interpretability and Security

Why interpretability is critical for detecting malicious behavior or biases

How more interpretable models can reveal vulnerabilities (model extraction, inversion attacks)

Balance interpretability with security concerns

Use interpretability tools to spot anomalies and potential threats

Securing AI workloads and vector databases with strict role-based and zero-trust principles

Credential management for AI model endpoints (API tokens, ephemeral credentials)

Architect AI systems with principle-of-least-privilege at every layer

Apply zero-trust approaches to protect critical AI resources

7. AI Model Drift and Security Monitoring

How models degrade over time (concept drift, data distribution shift)

Continuous monitoring and anomaly detection in production

Mitigating risks introduced by drift (potential new vulnerabilities)

Set up effective monitoring to detect model performance and security anomalies

Know when/how to trigger model retraining or security re-evaluations

Building and Deploying Secure AI: Practical Strategies for Developers

Multi-platform, multi-client, and highly-mobile users bring a new set of challenges, so the approaches of the past are no longer appropriate for modern applications. This two-day workshop is your chance to dive into all things security related to these new technologies. Learn how to securely connect native and browser-based applications to your back-ends and integrate them with enterprise identity management systems as well as social identity providers and services.


.NET Core, ASP.NET Core, MVC, Web APIs, Claims, OpenID Connect, OAuth 2.0, WS-Federation, SAML, JSON Web Tokens, Single Sign-on and off, Federation, Delegation, Home Realm, Discovery, CORS

Social Logins (e.g. Google, Facebook, Twitter, etc.)


Attendees will need to bring a computer with the latest .NET Core SDK and the IDE of their choice (e.g. Visual Studio) installed.

NDC { Security }

Workshops

09:00 - 17:00 (UTC+01)

Full-Stack Pentesting Laboratory: 100% Hands-On + Lifetime LAB Access

Dawid Czagan

Bulletproof APIs: Hands-On API Security

Philippe De Ryck

Identity & Access Control for modern Applications and APIs using ASP.NET 9

Anders Abel

Hack Yourself First: How to go on the Cyber-Offence

Scott Helme

Building and Deploying Secure AI: Practical Strategies for Developers

Jim Manico