August 30th, 2024
New Hacking Challenge 🎉
Hack the Gradebook
It's been a while since we launched a new hacking challenge, but the wait is over. Traditionally, hacking challenges—like capture the flag exercises—have been known for their high difficulty and focus on a single vulnerability. However, the Hack the Gradebook challenge is different. This challenge requires learners-turned-hackers to exploit multiple vulnerabilities, all covered by our OWASP Top Ten curriculum, reinforcing key concepts in a hands-on way.
Learner are presented with the login page for an old-school gradebook application inspired by the 1983 Movie WarGames. Check it out here.
May 3rd, 2024
New OWASP Alternative Path 🎉
You asked and we delivered! Our new OWASP Top Ten | Alt 1 course delivers comprehensive lessons aimed at deepening developers' understanding of critical security principles. This can be used alongside the original OWASP Top Ten course or as the next step in their learning. This course introduces alternative lessons that address new Common Weakness Enumerations (such as use of hard coded credentials, overreliance on cookies, authentication bypass by spoofing and others) and offers innovative solutions to strengthen applications against potential attackers.
To learn more, check out our Help Desk article.
January 25th, 2024
Additional Language Support 🎉
Our content team added Ruby to 8 more of our lessons:
Encoding (Cryptography)
Encryption (Cryptography)
Hashing (Cryptography)
Account Lockout (Credential Reuse)
CAPTCHA (Credential Reuse)
Persistant Cookies (Credential Reuse)
Device Fingerprinting (Credential Reuse)
Encoding, Hashing and Encryption (Credential Reuse)
January 18th, 2024
Content Improvements 💪
We continue expand our language support for our lessons:
Security Misconfiguration now supports Ruby
Unsafe Consumption of APIs is available for C++
Unrestricted Access to Sensitive Business Flows is now available for Rust, Perl, C and C++
December 8th, 2023
Updated OWASP API Top Ten 🎉
Our team has been busy and we are ending the year with an important update to the OWASP API Top Ten to be in alignment with the changes made this year!
This includes:
Updated and new Break/Fix lessons:
Broken Object Level Authorization
Broken Authentication
Broken Object Property Level Authorization
Unrestricted Resource Consumption
Broken Function Level Authorization
Unrestricted Access to Sensitive Business Flows
Security Misconfiguration
Improper Inventory Management
Unsafe Consumption of APIs
FAQs
What will happen to the old API Top Ten course on HackEDU?
It will disappear. The following will happen:
The old API Top Ten course will be hidden.
The old preset plan will be disabled.
A new API Top Ten course will be created.
A new preset plan will be created.
What will happen to HackEDU learners that have been assigned a training plan containing content from the previous course?
Nothing. They will still see their existing training plan. The content will no longer appear in the "All Training" section but will continue to appear in the learners "My Plan" section.
October 6th, 2023
Content Improvements 🚨
We continue expand our language support and you can now use C++ and Kotlin when completing our Credential Reuse lessons.
You can now choose C++ when completing Encoding, Hashing, and Encryption, too.
September 29th, 2023
Content Improvements 🚨
We continue expand our language support and you can now use C++ when completing:
Persistent Cookies (Credential ReUse)
Device Fingerprinting (Credential ReUse)
We've also added Perl & PHP as language options when completing:
Information Exposure through Query String Parameters
September 9th, 2023
New Content Alert 🚨
We've released a new Break/Fix lessons this week!
Information Exposure through Query String Parameters: Lesson showcasing information exposure through query string parameters.
August 3rd, 2023
Content Improvements 🚨
We continue expand our language support and you can now use C++ when completing these Cryptography lessons:
Encryption
Encoding
Hashing
August 1st, 2023
New Content Alert 🚨
We've just released new content that covers Credential Reuse and you can find it within our Web Application Security (Extended) Course.
These four lessons will teach you techniques for preventing credential reuse and credential stuffing attacks:
Multi-Factor Authentication
Persistent Cookies
Device Fingerprinting
Account Lockout
CAPTCHA
July 12th, 2023
Content Improvements 🚨
We continue expand our language support and you can now use C++ when completing:
Diffie-Hellman Key Exchange
We also made some updates to Insufficient Cryptography Lesson (iOS & Android) and OAuth Implementation Vulnerabilities: Part 2.
July 6th, 2023
Content Improvements 🚨
We continue expand our language support and you can now use C++ when completing:
Encoding (Cryptography Course)
We also made some updates to our Server Side Request Forgery (SSRF) lesson from the OWASP Top 10.
June 15th, 2023
Content Improvements 🚨
We continue expand our language support and you can now use C++ when completing:
Secure Password Storage: Part 2
Secure Password Storage: Part 3
Identification and Authentication Failures
May 3rd, 2023
Content Improvements 🚨
We continue expand our language support and you can now use Kotlin when completing:
OWASP Top 10
Broken Access Control
Command Injection
Identification and Authentication Failures
Insecure Design
OAuth: Part 1
OAuth: Part 2
SQL Injection: Part 1
SQL Injection: Part 2
SQL Injection: Part 3
Secure Side Request Forgery
Reflected Cross-Site-Scripting
Stored Cross-Site-Scripting
XXE
API Top 10
Broken Function Level Authorization
Broken Object Level Authorization
Excessive Data Exposure
Mass Assignment
Cryptography
Encoding
Encryption
Hashing
Encoding, Hashing, and Encryption
Diffie-Hellman Key Exchange
Digital Signatures
Secure Password Storage: Part 1
Secure Password Storage: Part 2
Secure Password Storage: Part 3
April 12th, 2023
Content Improvements🚨
We improved our Hashing lesson tests. The Hashing Lesson now verifies that the hash a learner inputs is:
of a fixed length
deterministic
collision resistant
April 3rd, 2023
Content Improvements🚨
Our Engineering team was busy making some updates to our content! This week we released:
Updated the example for C# in SQL Injection: Part 1
Fixed an error with the Ruby code in Insecure Design
Added a narrative solution in the Java Spring Coding Challenge for Broken Authentication
Fixed an issue with SSRF Coding Challenge in #C
Fixed an issue with Clojure tests in our Mass Assignment lesson
March 28th, 2023
New Feature & Content Improvements🚨💪
We have a new data integration with HCL AppScan available in the HackEDU Platform. To learn more about this feature and the benefits, check out this article!
Additionally, we've added C as an option when completing the Hashing lesson!
March 6th, 2023
New Content Alert & Improvements🚨
We've added a new lesson to our Cryptography Course! It's called Digital Signatures and it teaches engineers how to use digital signatures to ensure the integrity of messages!
Additionally, we continue to expand our language support and you can now use Scala in these Cryptography lessons:
February 10th, 2023
Content Improvements 🚨
We continue expand our language support and you can now use C++ when completing:
Broken Function Level Authorization
January 23rd, 2023
Content Improvements 🚨
We continue expand our language support and you can now use C++ when completing:
SQL Injection: Part 1
SQL Injection: Part 2
SQL Injection: Part 3
Reflected Cross-Site Scripting (XSS)
Stored Cross-Site Scripting (XSS)
Broken Access Control
You can now use C when completing:
Server Side Request Forgery (SSRF)
Identification and Authentication Failures
Secure Password Storage: Part 2
Secure Password Storage: Part 3
To review the full list of HackEDU Break/Fix lessons visit: https://app.hackedu.com/all
January 11th, 2023
Update 👀
Our Help Desk article URL was updated from https://help.hackedu.com/en to https://help.securityjourney.com/en to be more in alignment with our branding changes! Any URLs still using the previous domain will be redirected.
January 5th, 2023
Content Improvements 🚨
Happy New Year from the Security Journey team! We are starting the year out strong with Rust language support being added to the following lessons:
Broken Function Level Authorization
Broken Object Level Authorization
Excessive Data Exposure
Mass Assignment
Broken Access Control
Identification and Authentication Failures
Insecure Design
SQL Injection: Part(s) 1-3
Server-Side Request Forgery
Reflected Cross-Site Scripting (XSS)
Store Cross-Site Scripting (XSS)
Secure Password Storage: Part(s) 1-3
December 19th, 2022
New Content Alert 🚨
We are excited to announce that our 9 lesson Cryptography Course is now live in the HackEDU Platform! This content can be added to any current or new Training Plan or assigned as a stand alone course.
The lessons include:
Encoding
Hashing
Encryption
Encoding, Hashing, and Encryption
Secure Password Storage: Part 1
Secure Password Storage: Part 2
Secure Password Storage: Part 3
Diffie-Helman Key Exchange
Padding Oracle
December 5th, 2022
Content Improvements 🚨
We continue to add C language support! You can now use C when completing:
November 2th, 2022
Content Improvements 🚨
We are excited to share that we've added C language support in more lessons this week! You can now use C when completing:
October 7th, 2022
New Content Alert 🚨
HackEDU now has a Hands-on Blockchain Security lesson which compliments our new Blockchain content in the Security Journey Platform. It's available to be added to any new or existing Training Plan. It's located under our Publicly Disclosed Vulnerabilities course. Check it out!
We also added C language support to the Reflected Cross-Site Scripting (XSS) Lesson!
September 29-30th, 2022
Improvements 💪
We resolved some issues in two of our lessons.
Insecure Design: Our content team updated the hint for Step 4 - Remediation to make it clear that authorize() returns a promise.
Command Injection: A function was changed to return the error (if any) from running the exec.Command function.
September 21st, 2022
Update 👀
We've updated the messaging in our in-app cookies banner to make it more clear to learners and admins what data we collect and why. It now reads: "Our Platform uses cookies to customize your learning experience, however we do not sell any user data. To learn more, please see our privacy policy."
September 15th, 2022
Update 👀
The following emails from the HackEDU Platform will now be sent from our Security Journey domain:
Password reset
Account Verification
Reminder emails (training assignments)
Onboarding Invitations
All emails will now come from no-reply@securityjourney.com.
September 14th, 2022
Improvements 💪
The HackEDU Platform now supports session timeout. Admins and learners will be logged out of the Platform after 1 day of inactivity. Here, inactivity means that the UI is still open and idle - not that the session tab has been closed. This is how the Security Journey Platform functions so customers will have a consistent experience.
September 14th, 2022
New Content Alert 🚨
Our latest course, Secure Password Storage is live in the HackEDU platform!
These three lessons will teach you how to:
Understand the basics of hashing passwords
Learn how to create and incorporate salts into hashes
Use Argon2 to simplify and strengthen the authentication process
If you would like to take this course or assign it out to your learners it's located under the Web Application Security (Extended) Course!
September 2nd, 2022
Updates and Improvements🚨💪
Companies who are using SSO & deep-links will now see users being redirected to the initially requested URL after authentication - instead of the "My Plan" or "All Training" page.
We've also updated our branding in the HackEDU Platform to the new joint Security Journey + HackEDU logo!
August 22nd, 2022
Updates and Content Improvements🚨💪
Our team updated the Safelisting Requirements for our live sandbox application and Platform. For more details, see this Help Desk article.
We also made some changes to our Mass Assignment lesson to improve the learner experience when taking the coding exercise at the end.
August 17th, 2022
HackEDU is now Security Journey 🎉
Our transition from HackEDU to Security Journey is well underway! Our HackEDU site now redirects to securityjourney.com. You can find out more about the acquisition and rebrand here!
As you navigate the platform, you’ll likely notice updated Security Journey branding throughout. Rest assured, even though we may look a little different, you’ll still have all the same functionality and features as before.
Should you have any questions along the way, reach out to your Customer Success Manager or drop us a line at support@securityjourney.com anytime.
August 12th, 2022
Improvements 💪
You now have the ability to enable/disable Hacking Challenges just like you can with Coding Challenges. We also added some additional help text to these Admin settings to more clearly define what they do!
August 9th, 2022
Content Update 💪
Our Content Engineers updated the vulnerability code and lesson text in all three SQL Injection lessons as well as in the Functional Level Authorization lesson.
August 5th, 2022
Improvements 💪
Resolved an issue which was causing the start dates and due dates on our Secure Development Training: 1-Year Plan to be incorrect.
August, 1st, 2022
Improvements 💪
The HackEDU team wrapped work on updating our lesson infrastructure to improve user experience and performance.
July, 26th, 2022
Content Update 💪
The HackEDU team updated the XSS in Third-Party Integration (English only) lesson and hacktivity so that the vulnerability and recommended fix were easier to understand.
We also updated our four Memory Managment Lessons (Stack Overflow, Off-By-One, Format String & Heap Overflow) by creating a new vulnerable app and rewriting the lesson text to make things clearer to learners.
July, 18th, 2022
Improvements 💪
We updated our Security Unit Tests lesson: Restructured app so we can unit test without starting up a live Flask server & added "File Browse" feature.
We corrected a UI issue that was causing our edit buttons on the Users page and "Start Lesson" button to get squished when resizing the browser.
July, 1st, 2022
UI Refresh 👀
Our website's login page and Platform navigation bar now feature the new joint Security Journey + HackEDU logo.
Additionally, all of our buttons and links have been updated from blue to green!
June 30th, 2022
Training Plan Improvements: Updated Phase Names 🎉
We discovered that for some of our Preset Training Plans the "phase title" was different from the course title. This was causing unnecessary confusion for Training admins and learners. Now, the phase titles match the Course title:
2021 OWASP Top 10
Old Phase title: Web Application Security
New Phase title: 2021 OWASP Top 10
PCI Compliance
Old Phase title: Web Application Security
New Phase title: PCI Compliance
OWASP API Top 10
Old Phase Title: API Security
New Phase Title: OWASP API Top 10
June 24th, 2022
New Preset: DevSecOps Preset Plan 🎉
Today, we introduced a brand new training plan to our available presets!
Our DevSecOps training plan is made up of 26 lessons and articles that cover all stages of the DevSecOps lifecycle: Pre-Development, Development, Testing, Deployment and Ongoing maintenance.
Although it is a preset, content can be added or removed as needed to meet the specific training needs of your organization.
June 24th, 2022
New Content Alert 🚨
Today, we released "Kubernetes Security" which is the final lesson in our DevSecOps course! You can find it under the DevSecOps Course in the HackEDU Platform.
June 16th, 2022
New Language Support: TypeScript 🚨
We are so excited to announce the availability of TypeScript as a language! It is now live in 18 of our lessons.
June 14th, 2022
Improvements💪
The following lessons had updates to their instructions/text this week:
We also resolved an issue with the Capital One: Part 3 which was causing learners to receive an "import error" when trying to complete the lesson.
June 8th, 2022
Updates this week | New Article & Improvements 🚨💪
HackEDU released the Penetration Testing article which is our final piece of content for our NEW DevSecOps course. You can find the complete course list by visiting All Training > DevSecOps
We also fixed an issue with our user management workflow which was causing the delete function to become unresponsive when attempting to delete multiple users in a row.
June 2nd, 2022
New Content Alert 🚨
Today, we added four more articles as part of our DevSecOps course which is comprised of 26 pieces of content. You can find these located under All Training > DevSecOps
Security Acceptance Testing
Threat Intelligence
Security Smoke Tests
Blameless Post Mortems
June 1st, 2022
Updates to the All Training Page 🎒
We've updated the DevSecOps Course content into the following sections:
Pre-Development
Development
Testing
Deployment
Ongoing
May 24th, 2022
Login Enhancement ✨
Our team has improved the sign in workflow! All users can now hit ‘enter’ when entering their email and password to login. Previously, we did not support this and you had to manually click into each form to add your information.
May 19th, 2022
All Training UI Update 🚨
HackEDU has renamed the "General Security" section of the "All Training" page to "DevSecOps".
The content found in that section will be turned into a Training Plan preset once we've completed all the content for our DevSecOps course.
May 5th, 2022
New Content Alert 🚨
Today, we released a new article called "Server Hardening."
Included as part of our DevSecOps course. You can find it under the All Training > General Security course list.
April 12th, 2022
Updates to HackEDU's openAPI 💬
You asked and we delivered!
Our openAPI now provides the ability to retrieve license status for users. For full details, see our Developer Documentation here.
April 11th, 2022
New Content Alert 🚨
Today, we added four more articles as part of our DevSecOps course which is comprised of 25 pieces of content. You can find these located under All Training > General Security
Secrets Management
IDE Plugins
Security Code Review
Introduction to Git Hooks
FAQs
Do they have coding exercises?
Articles, unlike lessons, do not have a coding exercise or sandbox environment.
Are they assignable?
Yes, they can be assigned as part of a training plan or individually from the user view.
What reporting can I expect?
Articles will have similar reporting to lessons. You can expect to see the time it took for an individual learner to complete an article and view this information in their user report card, the User Report or the Completion report.
April 8th, 2022
New Training Plan Interface 🚨
We rolled out a fresh new look for our Training Plan modal!
April 11th, 2022
Improvement: Checkboxes for creating and editing training plans 💪
The existing drag and drop experience for creating/managing a training plan was cumbersome and had a few issues. We’ve simplified the experience to make it even simpler to create a training plan!
March 17th, 2022
New Preset: Secure Coding Training: 2 Year Plan 🎉
Today, we introduced a brand new training plan to our available presets.
This training plan is made up of 58 lessons over 24 months and focuses on a core set of secure coding best practices and the Open Web Application Security (OWASP) Top 10 vulnerabilities. These lessons are seen as the most critical secure coding training content to keep your organization safe!
This course was created to help customers plan content for years one and two of their secure coding training plan. Although it is a preset, it is able to be edited or adjusted to account to the specific training needs of each customer.
For more information, visit here.
March 4th, 2022
New Lesson Alert! 🚨
Dependency Management Lesson
This brand new lesson adds to our DevSecOps course!
Learners will be taught to:
Understand the Phases of Dependency Management:
Enumeration
Investigation
Remediation
Search through source code for a vulnerable dependency
Exploit this dependency in a running app
Remediate the vulnerability and check that the exploit is no longer possible
Available today on the HackEDU Platform under All Training > General Security
March 3rd, 2022
Introducing our new Impact Report 🎉
This report displays vulnerabilities found in your code alongside assigned secure development training to show alignment and impact of Adaptive Training Plans and Application Security Testing Integrations.
What are the benefits?
Allows Learning Administrators to ensure training programs are efficiently addressing current organizational needs
The Report can be shared with internal stakeholders to show the importance of secure coding training programs and their ability to reduce application security risk
The data can be displayed in a customized timeframe, monthly or annually. Filters allow views by vulnerability topic or across the entire training plan all at once.
For more information visit here.
January 25th, 2022
New + Improved OWASP Top Ten 🎉
New content: OWASP Top 10 2021
OWASP has come out with an updated list of top vulnerabilities. Specifically, the addition of Server-Side Request Forgery (SSRF) and Insecure Design
We've added two new lessons that cover SSRF and Insecure Design to our 2021 OWASP Top 10 Training Plan; these can be assigned as part of the new preset plan or as standalone lessons
Existing content was updated with *new names
Sensitive Data Exposure ⇒ Cryptographic Failures
Using Components with Known Vulnerabilities ⇒ Vulnerable and Outdated Components
Broken Authentication ⇒ Identification and Authentication Failures
Insecure Deserialization ⇒ Software and Data Integrity Failures
Insufficient Logging and Monitoring ⇒ Security Logging and Monitoring Failures
*The content description will denote that the names have been updated
XSS Lessons Part 1 & 2 were replaced with Reflected Cross-Site Scripting (XSS), DOM-Based Cross-Site Scripting (XSS) and Stored Cross-Site Scripting (XSS)
Updated preset plans
Option to assign 2017 OWASP Top 10 or 2021 OWASP Top 10 2021