SECURITY CODE REVIEW TRAINING

▶ On-demand training
Course Overview

The on-demand version of our Web Security Code Review Training, designed for penetration testers, security engineers, AppSec engineers, and developers who want to master security code review. Louis walks you through real code, real CVEs, and the methodology he uses on every review, in short lessons you can watch at your own pace. Each module ends with an exercise to apply what you learned to a codebase of your choice.

Format

107 short lessons across 14 modules, about 9.6 hours of video. Watch at your own pace and pause when Louis asks you to look at the code. Some modules end with a task: apply what you learned to a codebase of your choice. Lessons with a PentesterLab lab count as complete once you have solved the lab (labs marked optional are extra practice).

14
Modules
107
Lessons
~9.6h
Of video
55
Labs
$899 $699
Launch price until 5 November
Lifetime access to the course · 1 year of PentesterLab PRO · private Discord channels
Sign in to buy

Not sure yet? Watch 4 lessons for free

Training a team? Buy in bulk or deploy it in your LMS.

There has never been a better time to learn security code review

One of the most valuable skills in security

Reading code to find vulnerabilities is one of the most valuable skills in AppSec, and one of the hardest to learn on your own. With the source you skip the guesswork of black-box testing: you see how authentication works, where authorization checks happen, and which assumptions developers made.

It takes more than one strategy

Good reviews are not just tracing sources to sinks. You learn when to compare two codebases, when to start from a CVE, when to work back from a dangerous function, and how to keep notes so a large, unfamiliar codebase stays manageable.

Real bugs, from real CVEs

The patterns behind real vulnerabilities, the gotchas that trip up experienced reviewers, and how to read a real CVE from the vulnerable code to the fix, so you recognise the same mistakes in the code you review.

AI helps, but it won't do it for you

AI can help you move faster once you know what you're doing, but it won't tell you where to look, and you need to know when it's wrong. That judgment comes from understanding the fundamentals.

That's what this course is for: the methodology I use on every review, the patterns behind real CVEs, and the strategies that go beyond source to sink. The better you can read code, the sharper every review you do becomes.

Course Content

1Getting StartedFree preview 6 lessons · 33 min
2Reading Code3 free previews 12 lessons · 62 min
Apply it to your target
  • Browse the directory structure of your target.
  • Read through the documentation available.
  • Get familiar with some of the source code (do not grep for bugs, do not look for vulnerabilities).
  • Are there any rules or conventions for the code?
  • Find where "authentication" is done in the codebase: logging in, registration, password reset.
  • Find a function in the source code of your target and test its behaviour.
3Keeping Notes 3 lessons · 28 min
Apply it to your target
  • Setup your project notes for your target.
  • Write anything relevant from what you learnt in the previous steps.
  • Create your meta notes.
  • Make a sequence diagram of the reset password flow of your target.
4Architecture, Routing and Attack Surface 6 lessons · 31 min
Apply it to your target
  • List the available routes in your target.
  • Deploy your target in a test environment.
  • Is your target using some kind of filters/before_action to handle checks/authentication/authorisation/...
  • Check how your target handles HEAD request, HTTP Routes, Path Manipulations, ...
5Data 13 lessons · 68 min
Apply it to your target
  • Look at how data is handled in your application: retrieved from requests, generated, parsed.
6Patterns 13 lessons · 65 min
7Gotchas: Tricks and Traps 14 lessons · 79 min
8CVE Analysis 8 lessons · 34 min
9Tools 11 lessons · 57 min
10AI-Assisted Review 3 lessons · 18 min
11Deep Dive: Signed Data 5 lessons · 28 min
12Deep Dive: Authentication 4 lessons · 26 min
13Strategies 7 lessons · 36 min
14Remediation and Conclusion 2 lessons · 13 min

Prerequisites

A foundational understanding of common web vulnerabilities is required. This knowledge is crucial for understanding the vulnerabilities discussed and reviewed in the lessons.

Practical skills in managing and running Docker containers are also necessary, as part of the course uses Docker to test and explore different security scenarios. Familiarity with basic Docker commands and concepts will let you follow every hands-on activity.

About the Instructor

Louis Nyffenegger is the founder of PentesterLab, a leading educational platform renowned for its comprehensive, hands-on security labs, many of which were personally created by him. Before establishing PentesterLab, Louis honed his expertise in penetration testing across France and Australia. He subsequently specialized in security code reviews at the National Bank of Australia, followed by application security roles at Australia Post and Fitbit, where he regularly performed code reviews. Louis is also a well-regarded speaker, frequently sharing his insights at security conferences such as DEFCON, multiple OWASP events (Auckland, Brisbane, California, Melbourne, ...) and multiple BSides events (Canberra, Perth, Toronto, ...). Additionally, he runs the YouTube channel AppSecSchool, where he shares knowledge and insights on application security.

Reviews from Previous Cohorts

"Louis from PentesterLab is running an outstanding code review training program that you won't find anywhere else. It's a brilliant resource for newcomers, offering content that's hard to come by online. The training is jam-packed with in-depth material, covering every aspect of code review, and it's presented in a clear, well-explained manner. Whether you're in the appsec industry and want a refresher or need to level up your skills, or you're a newcomer wanting to break into appsec or expand your knowledge for other fields of cybersecurity, I highly recommend this training."
"Before doing the training, I had absolutely zero confidence in auditing code. Now, I can say I know where to start & have learned a ton about where to look, what questions to ask and how to go about finding vulnerabilities."
"I highly recommend this training for anyone who wants to get into code review I learned a ton of new stuff and understand most of the recently published CVEs because of it And helped me write a PoC for other CVEs"
"This is the number one code review course your team should be doing this year! The course covers methodology, detailed root causes of source code vulnerabilities, and examples of secure patterns to look up to. These are covered across all the popular languages and frameworks too. The volume of examples and depth of explanations are a great way to open your eyes to your own code or help you become a better code reviewer of other people's code."