From bae2a28f45d502e22993f09e05c2487fcd22c448 Mon Sep 17 00:00:00 2001 From: Dmytro Koziatynskyi Date: Thu, 10 Sep 2026 10:08:04 +0300 Subject: [PATCH] roadmaps: add hands-on security exercises to 17 topics (#10297) --- .../security-and-privacy-concerns@sWBT-j2cRuFqRFYtV_5TK.md | 1 + .../content/agentic-ai-security@FVsKivsJrIb82B0lpPmgw.md | 3 ++- .../content/llm-security-testing@xJYTRbPxMn0Xs5ea0Ygn6.md | 3 ++- .../content/prompt-injection@XOrAPDRhBvde9R-znEipH.md | 3 ++- roadmaps/aws/content/iam@xmKeB4hEi2DunmhAsvS1X.md | 1 + roadmaps/aws/content/s3@PN3xAYfQ-_QgZCRCnsEca.md | 1 + roadmaps/aws/content/security-groups@Cd9gdbkCFdrTLrnJMy5F3.md | 1 + .../backend/content/authentication@PY9G7KQy8bF6eIdr1ydHf.md | 3 ++- roadmaps/backend/content/owasp-risks@AAgciyxuDvS2B_c6FRMvT.md | 3 ++- .../devops/content/secret-management@hcrPpjFxPi_iLiMdLKJrO.md | 1 + .../docker/content/container-security@78YFahP3Fg-c27reLkuK4.md | 3 ++- .../docker/content/image-security@M5UG-ZcyhBPbksZd0ZdNt.md | 3 ++- .../docker/content/runtime-security@vYug8kcwrMoWf8ft4UDNI.md | 3 ++- .../using-3rd-party-container-images@LShK3-1EGGuXnEvdScFR7.md | 3 ++- .../content/github-security@f2PG4t6iVtfIH8BVe5H7f.md | 3 ++- .../content/secrets-and-env-vars@aflP7oWsQzAr4YPo2LLiQ.md | 1 + .../content/prompt-injection@6W_ONYREbXHwPigoDx1cW.md | 1 + 17 files changed, 27 insertions(+), 10 deletions(-) diff --git a/roadmaps/ai-engineer/content/security-and-privacy-concerns@sWBT-j2cRuFqRFYtV_5TK.md b/roadmaps/ai-engineer/content/security-and-privacy-concerns@sWBT-j2cRuFqRFYtV_5TK.md index d1baae8fe..cb25854f2 100644 --- a/roadmaps/ai-engineer/content/security-and-privacy-concerns@sWBT-j2cRuFqRFYtV_5TK.md +++ b/roadmaps/ai-engineer/content/security-and-privacy-concerns@sWBT-j2cRuFqRFYtV_5TK.md @@ -5,4 +5,5 @@ Security and privacy concerns in AI revolve around the protection of data and th Visit the following resources to learn more: - [@article@Examining Privacy Risks in AI Systems](https://transcend.io/blog/ai-and-privacy) +- [@course@AI Security Labs: OWASP LLM, Agentic and MCP Top 10](https://ransomleak.com/catalogue/ai-security/) - [@video@AI Is Dangerous, but Not for the Reasons You Think | Sasha Luccioni | TED](https://www.youtube.com/watch?v=eXdVDhOGqoE) \ No newline at end of file diff --git a/roadmaps/ai-red-teaming/content/agentic-ai-security@FVsKivsJrIb82B0lpPmgw.md b/roadmaps/ai-red-teaming/content/agentic-ai-security@FVsKivsJrIb82B0lpPmgw.md index 4c2fd6b35..5124197e0 100644 --- a/roadmaps/ai-red-teaming/content/agentic-ai-security@FVsKivsJrIb82B0lpPmgw.md +++ b/roadmaps/ai-red-teaming/content/agentic-ai-security@FVsKivsJrIb82B0lpPmgw.md @@ -7,4 +7,5 @@ Visit the following resources to learn more: - [@article@AI Agents - Learn Prompting](https://learnprompting.org/docs/intermediate/ai_agents) - [@article@EmbraceTheRed](https://embracethered.com/) - [@official@Model Context Protocol - Authorization Specification](https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization) -- [@article@GitHub MCP Exploited: Accessing Private Repositories via MCP - Invariant Labs](https://invariantlabs.ai/blog/mcp-github-vulnerability) \ No newline at end of file +- [@article@GitHub MCP Exploited: Accessing Private Repositories via MCP - Invariant Labs](https://invariantlabs.ai/blog/mcp-github-vulnerability) +- [@course@Agentic Goal Hijacking: Hands-on Exercise](https://ransomleak.com/exercises/agentic-goal-hijack/) \ No newline at end of file diff --git a/roadmaps/ai-red-teaming/content/llm-security-testing@xJYTRbPxMn0Xs5ea0Ygn6.md b/roadmaps/ai-red-teaming/content/llm-security-testing@xJYTRbPxMn0Xs5ea0Ygn6.md index 64bc98d5a..c40b7a3be 100644 --- a/roadmaps/ai-red-teaming/content/llm-security-testing@xJYTRbPxMn0Xs5ea0Ygn6.md +++ b/roadmaps/ai-red-teaming/content/llm-security-testing@xJYTRbPxMn0Xs5ea0Ygn6.md @@ -6,4 +6,5 @@ Visit the following resources to learn more: - [@course@AI Red Teaming Courses - Learn Prompting](https://learnprompting.org/blog/ai-red-teaming-courses) - [@article@SecBench: A Comprehensive Multi-Dimensional Benchmarking Dataset for LLMs in Cybersecurity](https://arxiv.org/abs/2412.20787) -- [@article@The Ultimate Guide to Red Teaming LLMs and Adversarial Prompts (Kili Technology)](https://kili-technology.com/large-language-models-llms/red-teaming-llms-and-adversarial-prompts) \ No newline at end of file +- [@article@The Ultimate Guide to Red Teaming LLMs and Adversarial Prompts (Kili Technology)](https://kili-technology.com/large-language-models-llms/red-teaming-llms-and-adversarial-prompts) +- [@course@OWASP LLM, Agentic and MCP Top 10: Exploit-then-Fix Labs](https://ransomleak.com/catalogue/ai-security/) \ No newline at end of file diff --git a/roadmaps/ai-red-teaming/content/prompt-injection@XOrAPDRhBvde9R-znEipH.md b/roadmaps/ai-red-teaming/content/prompt-injection@XOrAPDRhBvde9R-znEipH.md index ab7a5dd15..a8ea3b1c9 100644 --- a/roadmaps/ai-red-teaming/content/prompt-injection@XOrAPDRhBvde9R-znEipH.md +++ b/roadmaps/ai-red-teaming/content/prompt-injection@XOrAPDRhBvde9R-znEipH.md @@ -8,4 +8,5 @@ Visit the following resources to learn more: - [@article@Prompt Injection & the Rise of Prompt Attacks](https://www.lakera.ai/blog/guide-to-prompt-injection) - [@article@Prompt Injection (Learn Prompting)](https://learnprompting.org/docs/prompt_hacking/injection) - [@article@Prompt Injection Attack Explanation (IBM)](https://research.ibm.com/blog/prompt-injection-attacks-against-llms) -- [@article@Prompt Injection: Impact, How It Works & 4 Defense Measures](https://www.tigera.io/learn/guides/llm-security/prompt-injection/) \ No newline at end of file +- [@article@Prompt Injection: Impact, How It Works & 4 Defense Measures](https://www.tigera.io/learn/guides/llm-security/prompt-injection/) +- [@course@Prompt Injection: Hands-on Exercise Against a Live Assistant](https://ransomleak.com/exercises/clawdbot-prompt-injection/) \ No newline at end of file diff --git a/roadmaps/aws/content/iam@xmKeB4hEi2DunmhAsvS1X.md b/roadmaps/aws/content/iam@xmKeB4hEi2DunmhAsvS1X.md index 948fc1c49..bdab8b08b 100644 --- a/roadmaps/aws/content/iam@xmKeB4hEi2DunmhAsvS1X.md +++ b/roadmaps/aws/content/iam@xmKeB4hEi2DunmhAsvS1X.md @@ -5,3 +5,4 @@ IAM, or Identity and Access Management, in AWS is a service that enables you to Visit the following resources to learn more: - [@official@IAM - User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html) +- [@course@Over-Permissive IAM: Hands-on Privilege Escalation Exercise](https://ransomleak.com/exercises/over-permissive-iam/) diff --git a/roadmaps/aws/content/s3@PN3xAYfQ-_QgZCRCnsEca.md b/roadmaps/aws/content/s3@PN3xAYfQ-_QgZCRCnsEca.md index 23ecd47dc..1898b7be8 100644 --- a/roadmaps/aws/content/s3@PN3xAYfQ-_QgZCRCnsEca.md +++ b/roadmaps/aws/content/s3@PN3xAYfQ-_QgZCRCnsEca.md @@ -5,3 +5,4 @@ Amazon S3 (Simple Storage Service) is an object storage service offered by Amazo Visit the following resources to learn more: - [@official@S3](https://docs.aws.amazon.com/AmazonS3/latest/userguide/Welcome.html) +- [@course@Public S3 Buckets: Hands-on Exercise](https://ransomleak.com/exercises/public-storage-buckets/) diff --git a/roadmaps/aws/content/security-groups@Cd9gdbkCFdrTLrnJMy5F3.md b/roadmaps/aws/content/security-groups@Cd9gdbkCFdrTLrnJMy5F3.md index c5506940e..166ad4508 100644 --- a/roadmaps/aws/content/security-groups@Cd9gdbkCFdrTLrnJMy5F3.md +++ b/roadmaps/aws/content/security-groups@Cd9gdbkCFdrTLrnJMy5F3.md @@ -5,3 +5,4 @@ Security Groups in AWS act as a virtual firewall for your instance to control in Visit the following resources to learn more: - [@official@Security Groups](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html) +- [@course@Cloud Network Exposure: Hands-on Security Group Exercise](https://ransomleak.com/exercises/cloud-network-exposure/) diff --git a/roadmaps/backend/content/authentication@PY9G7KQy8bF6eIdr1ydHf.md b/roadmaps/backend/content/authentication@PY9G7KQy8bF6eIdr1ydHf.md index 32e966fa6..ed6771e14 100644 --- a/roadmaps/backend/content/authentication@PY9G7KQy8bF6eIdr1ydHf.md +++ b/roadmaps/backend/content/authentication@PY9G7KQy8bF6eIdr1ydHf.md @@ -9,4 +9,5 @@ Visit the following resources to learn more: - [@article@Token Based Authentication](https://roadmap.sh/guides/token-authentication) - [@article@JWT Authentication](https://roadmap.sh/guides/jwt-authentication) - [@article@OAuth - Open Authorization](https://roadmap.sh/guides/oauth) -- [@article@SSO - Single Sign On](https://roadmap.sh/guides/sso) \ No newline at end of file +- [@article@SSO - Single Sign On](https://roadmap.sh/guides/sso) +- [@course@Broken Authentication: Hands-on Exercise](https://ransomleak.com/exercises/broken-user-authentication/) \ No newline at end of file diff --git a/roadmaps/backend/content/owasp-risks@AAgciyxuDvS2B_c6FRMvT.md b/roadmaps/backend/content/owasp-risks@AAgciyxuDvS2B_c6FRMvT.md index 0bc8a1391..e764a0cff 100644 --- a/roadmaps/backend/content/owasp-risks@AAgciyxuDvS2B_c6FRMvT.md +++ b/roadmaps/backend/content/owasp-risks@AAgciyxuDvS2B_c6FRMvT.md @@ -7,4 +7,5 @@ Visit the following resources to learn more: - [@official@OWASP Website](https://owasp.org/) - [@opensource@OWASP Application Security Verification Standard](https://github.com/OWASP/ASVS) - [@article@OWASP Top 10 Security Risks](https://cheatsheetseries.owasp.org/IndexTopTen.html) -- [@article@OWASP Cheatsheets](https://cheatsheetseries.owasp.org/cheatsheets/AJAX_Security_Cheat_Sheet.html) \ No newline at end of file +- [@article@OWASP Cheatsheets](https://cheatsheetseries.owasp.org/cheatsheets/AJAX_Security_Cheat_Sheet.html) +- [@course@OWASP Top 10: Exploit-then-Fix Labs](https://ransomleak.com/catalogue/application-security/) \ No newline at end of file diff --git a/roadmaps/devops/content/secret-management@hcrPpjFxPi_iLiMdLKJrO.md b/roadmaps/devops/content/secret-management@hcrPpjFxPi_iLiMdLKJrO.md index 8d704edc7..f43fecfdc 100644 --- a/roadmaps/devops/content/secret-management@hcrPpjFxPi_iLiMdLKJrO.md +++ b/roadmaps/devops/content/secret-management@hcrPpjFxPi_iLiMdLKJrO.md @@ -6,4 +6,5 @@ Visit the following resources to learn more: - [@article@How to Manage Secrets in Web Applications?](https://cs.fyi/guide/secret-management-best-practices) - [@article@Why DevSecOps Teams Need Secrets Management](https://www.keepersecurity.com/blog/2023/01/26/why-devsecops-teams-need-secrets-management/) +- [@course@CI/CD Secret Exposure: Hands-on Exercise](https://ransomleak.com/exercises/cicd-secret-exposure/) - [@video@DevOps Tricks for Managing Secrets in Production](https://www.youtube.com/watch?v=u_L-f7Th_7o) \ No newline at end of file diff --git a/roadmaps/docker/content/container-security@78YFahP3Fg-c27reLkuK4.md b/roadmaps/docker/content/container-security@78YFahP3Fg-c27reLkuK4.md index 184680558..be3871c94 100644 --- a/roadmaps/docker/content/container-security@78YFahP3Fg-c27reLkuK4.md +++ b/roadmaps/docker/content/container-security@78YFahP3Fg-c27reLkuK4.md @@ -5,4 +5,5 @@ Container security encompasses a broad set of practices and tools aimed at prote Visit the following resources to learn more: - [@official@Docker Security](https://docs.docker.com/engine/security/) -- [@article@Kubernetes Security Best Practices](https://www.aquasec.com/cloud-native-academy/kubernetes-in-production/kubernetes-security-best-practices-10-steps-to-securing-k8s/) \ No newline at end of file +- [@article@Kubernetes Security Best Practices](https://www.aquasec.com/cloud-native-academy/kubernetes-in-production/kubernetes-security-best-practices-10-steps-to-securing-k8s/) +- [@course@Container Security Labs: Privileged Containers, Daemon Exposure, Image Layers](https://ransomleak.com/catalogue/cloud-security/) \ No newline at end of file diff --git a/roadmaps/docker/content/image-security@M5UG-ZcyhBPbksZd0ZdNt.md b/roadmaps/docker/content/image-security@M5UG-ZcyhBPbksZd0ZdNt.md index d95e33e6a..3a0e54959 100644 --- a/roadmaps/docker/content/image-security@M5UG-ZcyhBPbksZd0ZdNt.md +++ b/roadmaps/docker/content/image-security@M5UG-ZcyhBPbksZd0ZdNt.md @@ -5,4 +5,5 @@ Image security is a crucial aspect of deploying Docker containers in your enviro Visit the following resources to learn more: - [@official@Docker Content Trust](https://docs.docker.com/engine/security/trust/content_trust/) -- [@official@Docker Hub](https://hub.docker.com/) \ No newline at end of file +- [@official@Docker Hub](https://hub.docker.com/) +- [@course@Secrets in Image Layers: Hands-on Exercise](https://ransomleak.com/exercises/secrets-in-image-layers/) \ No newline at end of file diff --git a/roadmaps/docker/content/runtime-security@vYug8kcwrMoWf8ft4UDNI.md b/roadmaps/docker/content/runtime-security@vYug8kcwrMoWf8ft4UDNI.md index 4ecb9dc2e..f4b575859 100644 --- a/roadmaps/docker/content/runtime-security@vYug8kcwrMoWf8ft4UDNI.md +++ b/roadmaps/docker/content/runtime-security@vYug8kcwrMoWf8ft4UDNI.md @@ -5,4 +5,5 @@ Runtime security in Docker focuses on ensuring the safety and integrity of conta Visit the following resources to learn more: - [@official@Docker Security](https://docs.docker.com/engine/security/) -- [@official@Docker Security Best Practices](https://docs.docker.com/build/building/best-practices/) \ No newline at end of file +- [@official@Docker Security Best Practices](https://docs.docker.com/build/building/best-practices/) +- [@course@Privileged Containers: Hands-on Escape Exercise](https://ransomleak.com/exercises/privileged-containers/) \ No newline at end of file diff --git a/roadmaps/docker/content/using-3rd-party-container-images@LShK3-1EGGuXnEvdScFR7.md b/roadmaps/docker/content/using-3rd-party-container-images@LShK3-1EGGuXnEvdScFR7.md index 159fe3c14..2962f33bd 100644 --- a/roadmaps/docker/content/using-3rd-party-container-images@LShK3-1EGGuXnEvdScFR7.md +++ b/roadmaps/docker/content/using-3rd-party-container-images@LShK3-1EGGuXnEvdScFR7.md @@ -4,4 +4,5 @@ Third-party images are pre-built Docker container images that are available on D Visit the following resources to learn more: -- [@official@Docker Hub Registry](https://hub.docker.com/) \ No newline at end of file +- [@official@Docker Hub Registry](https://hub.docker.com/) +- [@course@Malicious Base Images: Hands-on Exercise](https://ransomleak.com/exercises/malicious-base-images/) \ No newline at end of file diff --git a/roadmaps/git-github/content/github-security@f2PG4t6iVtfIH8BVe5H7f.md b/roadmaps/git-github/content/github-security@f2PG4t6iVtfIH8BVe5H7f.md index 59b2396af..d54e97736 100644 --- a/roadmaps/git-github/content/github-security@f2PG4t6iVtfIH8BVe5H7f.md +++ b/roadmaps/git-github/content/github-security@f2PG4t6iVtfIH8BVe5H7f.md @@ -6,4 +6,5 @@ Visit the following resources to learn more: - [@official@GitHub security features](https://docs.github.com/en/code-security/getting-started/github-security-features) - [@official@Dependabot Quick-start Guide](https://docs.github.com/en/code-security/getting-started/dependabot-quickstart-guide) -- [@official@About user alerts](https://docs.github.com/en/code-security/secret-scanning/managing-alerts-from-secret-scanning/about-alerts#about-user-alerts) \ No newline at end of file +- [@official@About user alerts](https://docs.github.com/en/code-security/secret-scanning/managing-alerts-from-secret-scanning/about-alerts#about-user-alerts) +- [@course@Git and Repository Security: Hands-on Labs](https://ransomleak.com/catalogue/git-security/) \ No newline at end of file diff --git a/roadmaps/git-github/content/secrets-and-env-vars@aflP7oWsQzAr4YPo2LLiQ.md b/roadmaps/git-github/content/secrets-and-env-vars@aflP7oWsQzAr4YPo2LLiQ.md index 8ee21fdb6..1e18d8cf5 100644 --- a/roadmaps/git-github/content/secrets-and-env-vars@aflP7oWsQzAr4YPo2LLiQ.md +++ b/roadmaps/git-github/content/secrets-and-env-vars@aflP7oWsQzAr4YPo2LLiQ.md @@ -6,4 +6,5 @@ Visit the following resources to learn more: - [@official@Using secrets in GitHub Actions](https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions) - [@official@Store information in variables](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/store-information-in-variables) +- [@course@CI/CD Secret Exposure: Hands-on Exercise](https://ransomleak.com/exercises/cicd-secret-exposure/) - [@video@Secrets and Environment Variables in your GitHub Action](https://www.youtube.com/watch?v=dPLPSaFqJmY) \ No newline at end of file diff --git a/roadmaps/prompt-engineering/content/prompt-injection@6W_ONYREbXHwPigoDx1cW.md b/roadmaps/prompt-engineering/content/prompt-injection@6W_ONYREbXHwPigoDx1cW.md index f338633c3..3b067e675 100644 --- a/roadmaps/prompt-engineering/content/prompt-injection@6W_ONYREbXHwPigoDx1cW.md +++ b/roadmaps/prompt-engineering/content/prompt-injection@6W_ONYREbXHwPigoDx1cW.md @@ -6,4 +6,5 @@ Visit the following resources to learn more: - [@official@Mitigate jailbreaks and prompt injections - Anthropic](https://platform.claude.com/docs/en/test-and-evaluate/strengthen-guardrails/mitigate-jailbreaks) - [@official@LLM01:2025 Prompt Injection - OWASP](https://genai.owasp.org/llmrisk/llm01-prompt-injection/) +- [@course@Prompt Injection: Hands-on Exercise Against a Live Assistant](https://ransomleak.com/exercises/clawdbot-prompt-injection/) - [@video@What Is a Prompt Injection Attack?](https://www.youtube.com/watch?v=jrHRe9lSqqA) \ No newline at end of file