SECURE CODING IN GOLANG

▶ On-demand training for Go developers
Course Overview

The on-demand version of our Go training, designed for developers who want to write and review safer Go. Louis uses real-world Go vulnerabilities and CVEs to show how and why bugs happen, the Go quirks that catch experienced developers, the safer APIs and tools to use instead, and how to fix issues so they stay fixed, in short lessons you can watch at your own pace. Most lessons come with a PentesterLab lab, and a lesson counts as complete once you've solved its lab.

Format

34 short lessons across 9 modules, about 2.5 hours of video. Watch at your own pace and pause when Louis asks you to look at the code. Lessons with a PentesterLab lab count as complete once you have solved the lab (labs marked optional are extra practice).

9
Modules
34
Lessons
~2.5h
Of video
23
Labs
$249 $199
Launch price until 1 November
Lifetime access · includes 3 months of PentesterLab PRO · private Discord channels
Sign in to buy

Training a team? Buy in bulk or deploy it in your LMS.

Not your basic OWASP Top 10 training

No basic bugs

A lot of secure coding trainings are based on the OWASP Top 10, with simplified snippets. This one starts where they stop: the bugs that get past experienced Go developers, and how to catch them in your own code.

Real bugs from real CVEs

The patterns come from vulnerabilities in real Go projects: an overwritten error that bypassed Navidrome's authentication, Vikunja's password reset, go-zero's CORS bypass. You read the vulnerable code, see why it was exploitable, and how it was fixed.

Complex bugs

Bugs that hide in the details: a ToLower that changes a string's length and leads to code execution in FrankenPHP, then the bypass of its fix; SSRF checks that fall to DNS rebinding; a gift you can claim twice with a race condition.

That's what this course is for: how real Go vulnerabilities happen, the Go quirks that catch experienced developers, the safer APIs to use instead, and how to fix bugs so they stay fixed.

Course Content

1Getting Started 2 lessons · 9 min
2Patterns: Secrets, Trust and Races 6 lessons · 26 min
3Patterns: Filtering, Matching and Logic 7 lessons · 31 min
4Go Quirks and Safer APIs 5 lessons · 27 min
5Learning from Real Go CVEs 6 lessons · 24 min
6Tools for Go Code Review 2 lessons · 10 min
7AI-Assisted Development 1 lessons · 4 min
8Defensive Programming 3 lessons · 16 min
9Remediation and Conclusion 2 lessons · 6 min

Prerequisites

A foundational understanding of common web vulnerabilities, as this knowledge will be essential for fully grasping the security concepts discussed in the lessons.

Working knowledge of Go. Familiarity with basic git commands helps too, as the CVE analysis lessons compare vulnerable and fixed versions with git.

About the Instructor

Louis Nyffenegger is the founder of PentesterLab, a leading educational platform renowned for its comprehensive, hands-on security labs, many of which were personally created by him. Before establishing PentesterLab, Louis honed his expertise in penetration testing across France and Australia. He subsequently specialized in security code reviews at the National Bank of Australia, followed by application security roles at Australia Post and Fitbit, where he regularly performed code reviews. Louis is also a well-regarded speaker, frequently sharing his insights at security conferences such as DEFCON, multiple OWASP events (Auckland, Brisbane, California, Melbourne, ...) and multiple BSides events (Canberra, Perth, Toronto, ...). Additionally, he runs the YouTube channel AppSecSchool, where he shares knowledge and insights on application security.