Cybersecurity courses

Browse public Cybersecurity courses with structured lessons, visuals, and practice on Wondering.

  • PHP2Shell: From Flaw to Fix

    PHP2Shell exposed how failures in a widely used web runtime can become code execution and secret theft. For builders and technically curious learners, this course explains the memory bugs, discovery timeline, AI-assisted research, exploitation evidence and practical verification of fixes.

  • Da World: C and ARM64 Reversing

    Build a living-world simulation in C right inside Termux, then tear your own code apart in ARM64 assembly to master the fundamentals of reverse engineering for CTFs. * **Build text-based simulations** using modular C in Termux * **Read ARM64 assembly** by compiling your own code * **Reverse engineer binaries** using command-line Android tools * **Solve beginner crackmes** and CTF-style reversing challenges

  • Cybersecurity Essentials for Builders

    Master core security principles—from OWASP vulnerabilities to threat modeling—so you can confidently ship resilient software and define smart security requirements for your products. * **Threat modeling**: Spot architectural security risks before writing code * **OWASP Top 10 defense**: Eliminate common vulnerabilities in production apps * **Secure auth and encryption**: Implement safe access controls and data protection * **Security requirement definition**: Write clear, sensible security acceptance criteria

  • GitHub Apps JWT 案例學：兩層 Token 認證設計

    讓學習者透過 GitHub Apps 的真實認證設計，理解如何用兩層 token 分離身份驗證與授權存取，並降低私鑰暴露風險

  • OAuth 2.0 完全指南：Authorization Code Flow 與實作安全清單

    讓學習者理解 OAuth 2.0 的 authorization 本質，並能避開常見的實作安全坑（token 儲存、scope 設計、PKCE）

  • The Gemini Hacking Incident: The Story and the Technology

    Understand what happened when Gemini accessed real companies during a May 2026 security evaluation; learn the technology needed to follow the access chain; compare related AI incidents; and explain practical controls that can prevent recurrence. English, beginner-friendly, researched through September 19, 2026. Teach the incident and technology directly, using concrete examples, diagrams and short checks. Attribute Google's account simply to Google, and Irregular's account to Irregular. Keep source links in unobtrusive reference lists. Source-publication history, republication, browsing limitations and journalism methodology are outside the curriculum. WSJ first reported the Gemini incident on September 18; credit that in references where relevant, without making media coverage a lesson topic. Distinguish Google's statements, reported technical details and analysis without repetitive caveats. Keep actual unknowns brief and specific. Do not invent victim names, model versions, transcripts or technical details. Do not add numeric prefixes to any section or lesson title.

  • JWT 完整攻略：原理、實務設計與常見誤區

    讓學習者能正確設計並維運 JWT-based 的身份驗證系統，理解 stateless 驗證的取捨，並避開 revocation 與 algorithm confusion 等常見安全誤區

  • Securing Software Development Lifecycles

    Integrate rigorous defensive research into your engineering workflow to architect resilient systems. This course bridges high-level security theory with practical, production-grade implementation across the entire pipeline. * **Architecting resilient CI/CD pipelines** through automated security integration * **Implementing advanced threat modeling** for complex distributed systems * **Governing supply chain security** via rigorous dependency analysis * **Enforcing shift-left security** with custom automated policy enforcement

  • Penetration Testing for Azure DevOps

    Bridge your expertise in traditional testing and Azure DevOps by mastering cloud-native security audits and automating robust defense mechanisms directly within your CI/CD pipelines. * **Securing CI/CD pipelines** against unauthorized code injection * **Automating security testing** within automated deployment workflows * **Cloud-native security audits** for Azure infrastructure and services * **Exploiting misconfigurations** in DevOps permissions and access controls

  • National Quantum Strategy and Security

    Master the intersection of quantum physics and national security to effectively prioritize R&D investments, secure critical supply chains, and develop robust frameworks for long-term technological sovereignty. * **Quantum fundamentals** for informed strategic policy drafting * **Supply chain analysis** to secure critical technology components * **Security risk assessment** for post-quantum cryptographic transitions * **R&D prioritization** to maximize national competitive advantage

  • HTTP Protocol Internals & Offensive Semantics

    Train an experienced web/API pentester and bug bounty hunter to predict vulnerabilities that arise when two components interpret the same HTTP message differently. Assume fluency with HTTP requests, Burp Suite, common web vulnerabilities, TLS, proxies, APIs and web architecture, and never re-explain them. Use RFC 9110 as the semantic backbone, then RFC 9111, 9112, 9113, 9114, 9204, 9213, 9421, 9530, 9651, 7239 and 6265. Every lesson must state the precise protocol mechanic, distinguish normative HTTP behaviour from implementation behaviour, connect it to real infrastructure (CDN, WAF, load balancer, reverse proxy, API gateway, framework, application), and answer: what could two parsers disagree about here? Show raw request and response bytes rather than describing them. Name real implementations whose behaviour differs. End every lesson with a concrete test the reader can run against a live target and the observable that decides the result. Label claims as established, inferred, or controversial. No fluff, no filler, no generic web-security advice.

  • Bug Bounty Logic Flaw Mastery

    Advance beyond standard security checklists to identify hidden design errors that automated tools miss. You will learn to manipulate business workflows and capture high-impact vulnerabilities on major platforms. * **Identify subtle business logic vulnerabilities** beyond automated scanner capabilities * **Chain minor logic errors** to achieve high-impact account takeovers * **Bypass complex workflows** in payment, authentication, and authorization systems * **Document professional bug reports** that maximize bounty payouts and reputatio

  • Autonomous Agent Security Incidents

    Learn how the reported OpenAI–Hugging Face incident unfolded, why coordinated AI agents changed the security dynamics, and what defenders should do about fully automated offense.

  • Can a document I upload hijack the AI?

    Prompt injection. Recognise an injection attempt, and name which of your own AI setups could actually act on one.