Programming for Security
Certified Secure Programmer
Learn programming by building security tooling: Python and shell for automation, C and C++ for systems understanding, JavaScript for the browser, SQL for injection, and API and network programming with a security mindset throughout.
Why programmers make the best security people
You cannot assess a vulnerability you cannot read. Every serious security tool — a fuzzer, a
packet parser, an exploit, a log analyser, a scanner — is a program, and the people who write them
understand the systems in a way that cannot be taught from a slide deck.
This course teaches programming by building things that are useful. Not toy exercises: a real
socket scanner, a real log parser, a real fuzzer, a real API client. Every language is taught
through a security problem it is good at solving.
What you will be able to do
- Read and write code in Python, shell, C, C++ and JavaScript well enough to build real tooling
- Understand memory, pointers and the difference between a value and a reference — which is where
most security-relevant bugs live
- Write shell scripts that parse logs, chain tools and handle untrusted input correctly
- Write Python that talks to sockets, APIs and files without trusting a single byte
- Identify injection, deserialisation, path traversal and resource exhaustion in code you read
- Use Git properly and review a diff for security problems the way a reviewer should
Assumed knowledge
No programming experience required. Module 1 exists for that reason. You do need basic command line
comfort by module 3.
Syllabus
-
1
Programming fundamentals
Variables, types, control flow, functions, errors — the concepts that never change.
Locked -
2
Python for security work
The language you will use most: sockets, files, parsing, automation, and where Python gets you into trouble.
Locked -
3
Shell, permissions and command-line tooling
Scripting that holds up when the input is hostile and the environment is a shell.
Locked -
4
C, C++ and memory safety
Pointers, the stack and the heap, and the bugs that turn a parser into a remote shell.
Locked -
5
JavaScript, SQL and the web attack surface from the inside
The languages you will read in every web finding, written from the programmer side.
Locked -
6
Git, code review and secure development lifecycle
Version control done securely, reviewing a diff for security, and getting defects found early.
Locked
Final exam
Locked. Enrol in the course to unlock the final exam.