The Courses
Codebashing offers pre-configured courses which consist of a defined set of interactive lessons that demonstrate how best to understand common vulnerabilities, how they occur, their impact, and how they can be remediated. These courses are referred to as system courses throughout the application and this documentation suite. The table below lists the currently available system courses and their lessons.
In addition, admin users and authorized manager users may build customized courses by selecting and adding available lessons. These courses are referred to as custom courses and appear in a separate list.Customizing Courses
Note
By default, courses are provided in English. Many courses have been translated into various languages as listed in the course table below. Courses without languages listed in the Translated Into column are available in English only.
To view content in a different language, you have to select the desired language from the Content Language list under Account Settings.
System Course | Lessons | Translated Into | |
---|---|---|---|
| Learn how incorrect use of cryptography might lead to vulnerabilities. | ||
| Learn how to defend against and prevent CSRF attacks. | ||
Java | SQL Injection XXE Processing Command Injection Session Fixation Use of Insufficiently Random Values Reflected XSS Stored (Persistent) XSS DOM XSS Directory (Path) Traversal Privileged Interface Exposure Leftover Debug Code Authentication Credentials in URL Session Exposure Within URL User Enumeration Horizontal Privilege Escalation Vertical Privilege Escalation Cross-site Request Forgery (POST) Cross-site Request Forgery (GET) Clickjacking Insecure URL Redirect Insecure TLS Validation Insecure Object Deserialization Components with Known Vulnerabilities | Spanish German Potuguese French Japanese Korean | |
Java Advanced | SQL Injection Second Order SQL Injection Command Injection Session Fixation Cross-site Request Forgery Server-side Request Forgery Use of Insufficiently Random Values Stored (Persistent) XSS Reflected XSS Directory (Path) Traversal | Spanish German Portuguese French Japanese Korean | |
Java Advanced 2 | XXE Processing LDAP Injection User Enumeration Horizontal Privilege Escalation Vertical Privilege Escalation Insecure Object Deserialization Insecure Password Storage Open Redirect Race Condition Denial of Service via Unrestricted File Upload | German | |
IaC Security | Introduction to IaC Security Networking in the Cloud Access Management Object Storage Access Management Security Use Cases Logging Subdomain Takeover Secrets Management Supply Chain Attack & Insecure Templates | ||
Java: Backend Security Basics | Encoding vs. Hashing Vs. Encryption Password Storage SQL Injection Second Order SQL Injection Command Injection Denial of Service via Unrestricted File Upload Directory (Path) Traversal Leftover Debug Code User Enumeration Horizontal Privilege Escalation Vertical Privilege Escalation Cross-site Request Forgery Server-side Request Forgery Race Condition Insecure TLS Validation Insecure Object Deserialization Components with Known Vulnerabilities XXE Processing LDAP Injection | Spanish German Portuguese French Japanese Korean | |
React | Cross-site Scripting (XSS) in React The dangerouslySetInnerHTML Property Sensitive Data in Code Cross-site Request Forgery Components with Known Vulnerabilities | ||
.NET | SQL Injection XXE Processing Command Injection Session Fixation Use of Insufficiently Random Values Reflected XSS Stored (Persistent) XSS DOM XSS Directory (Path) Traversal Privileged Interface Exposure Leftover Debug Code Authentication Credentials in URL Session Exposure Within URL User Enumeration Horizontal Privilege Escalation Vertical Privilege Escalation Cross-site Request Forgery (POST) Cross-site Request Forgery (GET) Clickjacking Insecure URL Redirect Insecure TLS Validation Insecure Object Deserialization Components with Known Vulnerabilities | Spanish German Portuguese French Japanese Korean | |
Language Agnostic Application Security | Cross Site Request Forgery (POST) Vertical Privilege Escalation Horizontal Privilege Escalation Leftover Debug Code XXE Processing Session Fixation Session Exposure Within URL Privileged Interface Exposure Stored (Persistent) XSS Authentication Credentials In URL Direction (Path) Traversal Insecure TLS Validation SQL Injection Cross Site Forgery (GET) Reflected XSS Vulnerable and Outdated Components Command Injection User Enumeration Use of Insufficiently Random Values Click Jacking Insecure URL Redirect | ||
.NET Advanced | SQL Injection Second Order SQL Injection Command Injection Session Fixation Cross-site Request Forgery Server-side Request Forgery Use of Insufficiently Random Values Stored (Persistent) XSS Reflected XSS Directory (Path) Traversal | Spanish German Portuguese French Japanese Korean | |
.NET Advanced 2 | XXE Processing LDAP Injection User Enumeration Horizontal Privilege Escalation Vertical Privilege Escalation Insecure Object Deserialization Insecure Password Storage Open Redirect Race Condition Denial of Service via Unrestricted File Upload | ||
.NET: Backend Security Basics | Encoding vs. Hashing Vs. Encryption Password Storage SQL Injection Second Order SQL Injection Command Injection Denial of Service via Unrestricted File Upload Directory (Path) Traversal Leftover Debug Code User Enumeration Horizontal Privilege Escalation Vertical Privilege Escalation Cross-site Request Forgery Server-side Request Forgery Race Condition Insecure TLS Validation Insecure Object Deserialization Components with Known Vulnerabilities XXE Processing LDAP Injection | Spanish German Portuguese French Japanese Korean | |
Front End Security Basics | Reverse Tabnabbing HTTP Strict-Transport-Security (HSTS) No Server-side Validation Clickjacking Cross-site Request Forgery Components with Known Vulnerabilities DOM XSS in URL DOM XSS in AJAX DOM XSS in eval() Secure Cookie Flag HttpOnly Cookie Flag DOM Open Redirect Reflected XSS Stored (Persistent) XSS Common XSS Use Cases | Spanish German Portuguese French Japanese Korean | |
HTTP Security Principles | HTTP GET and POST Requests: Overview HTTP Security Headers HTTP GET and POST Requests: Headers HTTP Headers That Are Misused For Security Purposes HTTP Response Splitting HTTP Content Security Policy Web Cache Deception HTTP Cache Basics and Cache Poisoning Same-Origin Policy and Cross-Origin Resource Sharing | Spanish German Portuguese French Japanese Korean | |
C/C++ | Interface Tour Stack Overflows – Primer Stack Overflows Off By One Overflow Heap Introduction Heap Overflows – Primer Heap Overflows Integer Overflows – Primer Format String – Primer Format String Attack Format String Server Attack Clearing Memory Dangerous or Insecure Use of API Compiler Optimization Bugs NULL Pointer Dereference Race Conditions | ||
Python Django | SQL Injection XXE Processing Command Injection Session Fixation Use of Insufficiently Random Values Reflected XSS Stored (Persistent) XSS DOM XSS Directory (Path) Traversal Privileged Interface Exposure Leftover Debug Code Authentication Credentials in URL Session Exposure Within URL User Enumeration Horizontal Privilege Escalation Vertical Privilege Escalation Cross-site Request Forgery (POST) Cross-site Request Forgery (GET) Clickjacking Insecure URL Redirect Insecure TLS Validation Insecure Object Deserialization Components with Known Vulnerabilities | Spanish German Portuguese French Japanese Korean | |
Python Advanced | SQL Injection Second Order SQL Injection Command Injection Cross-site Request Forgery Server-side Request Forgery Use of Insufficiently Random Values Stored (Persistent) XSS Reflected XSS Directory (Path) Traversal | Spanish German Portuguese French Japanese Korean | |
Python Advanced 2 | XXE Processing User Enumeration Horizontal Privilege Escalation Vertical Privilege Escalation Unrestricted File Upload Race Condition Open Redirect LDAP Injection Insecure Password Storage | ||
Python: Backend Security basics | Encoding vs. Hashing vs. Encryption Password Storage SQL Injection Second Order SQL Injection Command Injection Denial of Service via Unrestricted File Upload Directory (Path) Traversal Leftover Debug Code Server-side Request Forgery Race Condition LDAP Injection User Enumeration Horizontal Privilege Escalation Vertical Privilege Escalation Insecure TLS Validation Insecure Object Deserialization XXE Processing Cross Site Request Forgery (POST) Vulnerable and Outdated Components | ||
Ruby on Rails | SQL Injection XXE Processing Command Injection Session Fixation Use of Insufficiently Random Values Reflected XSS Stored (Persistent) XSS DOM XSS Directory (Path) Traversal Privileged Interface Exposure Leftover Debug Code Authentication Credentials in URL Session Exposure Within URL User Enumeration Horizontal Privilege Escalation Vertical Privilege Escalation Cross-site Request Forgery (POST) Cross-site Request Forgery (GET) Clickjacking Insecure URL Redirect Insecure TLS Validation | Spanish German Portuguese French Japanese Korean | |
PHP | SQL Injection XXE Processing Command Injection Session Fixation Use of Insufficiently Random Values Reflected XSS Stored (Persistent) XSS DOM XSS Directory (Path) Traversal Privileged Interface Exposure Leftover Debug Code Authentication Credentials in URL Session Exposure Within URL User Enumeration Horizontal Privilege Escalation Vertical Privilege Escalation Cross-site Request Forgery (POST) Cross-site Request Forgery (GET) Clickjacking Insecure URL Redirect Insecure TLS Validation Insecure Object Deserialization Components with Known Vulnerabilities | Spanish German Portuguese French Japanese Korean | |
PHP Advanced | SQL Injection Command Injection Second Order SQL Injection Use of Insufficient Random Values Server Side Request Forgery Cross Site Request Forgery (POST) Reflected XSS Stored (Persistent) XSS Directory (Path) Traversal Session Fixation | ||
PHP: Backend Security Basics | Encoding vs. Hashing vs. Encryption Password Storage SQL Injection Second Order SQL Injection Command Injection Denial of Service via Unrestricted File Upload Directory (Path) Traversal Leftover Debug Code Server-side Request Forgery Race Condition LDAP Injection User Enumeration Horizontal Privilege Escalation Vertical Privilege Escalation Insecure TLS Validation Insecure Object Deserialization XXE Processing Cross Site Request Forgery (POST) Components with Known Vulnerabilities | ||
Node.JS | SQL Injection XXE Processing Command Injection Session Fixation Use of Insufficiently Random Values Reflected XSS Stored (Persistent) XSS DOM XSS Directory (Path) Traversal Privileged Interface Exposure Leftover Debug Code Authentication Credentials in URL Session Exposure Within URL User Enumeration Horizontal Privilege Escalation Vertical Privilege Escalation Cross-site Request Forgery (POST) Cross-site Request Forgery (GET) Clickjacking Insecure URL Redirect Insecure TLS Validation Insecure Object Deserialization Components with Known Vulnerabilities | Spanish German Portuguese French Japanese Korean | |
iOS | Forceful Browsing Excessive Logging Cached Login Credentials Unprotected Background Screenshots Enable Autocomplete Fields Insecure Local Storage Sensitive Data in Plist File Client-side Injection | Spanish German Portuguese French Japanese Korean | |
Android | Forceful Browsing Excessive Logging Cached Login Credentials Unprotected Background Screenshots Enable Autocomplete Fields Insecure Local Storage Sensitive Data in File Storage Client-side Injection | Spanish German Portuguese French Japanese Korean | |
Angular JS | Sanbox Introduction Sandbox Escaping Scenarios Strict Contextual Escaping Cross-Site Request Forgery HTML and URL Sanitizers DOM Open Redirect Sensitive Data Exposure Templates From Untrusted Sources | Spanish German Portuguese French Japanese Korean | |
Angular 2+ | Angular Anti-XSS Mechanism – HTML Sanitizer Angular Anti-XSS Mechanism – URL Sanitizer Mind the Pipe Cross-Site Request Forgery XSS Protection Bypass Sensitive Data in Code Components with Known Vulnerabilities No Server-side Validation | Spanish German Portuguese French Japanese Korean | |
Scala | SQL Injection XXE Processing Command Injection Session Fixation Use of Insufficiently Random Values Reflected XSS Stored (Persistent) XSS DOM XSS Directory (Path) Traversal Privileged Interface Exposure Leftover Debug Code Authentication Credentials in URL Session Exposure Within URL User Enumeration Horizontal Privilege Escalation Vertical Privilege Escalation Cross-site Request Forgery (POST) Cross-site Request Forgery (GET) Clickjacking Insecure URL Redirect Insecure Object Deserialization Components with Known Vulnerabilities | Spanish German Portuguese French Japanese Korean | |
Scala: Backend Security Basics | Encoding vs. Hashing vs. Encryption Password Storage SQL Injection Second Order SQL Injection Command Injection Denial of Service via Unrestricted File Upload Directory (Path) Traversal Leftover Debug Code Server-Side Request Forgery Race Condition LDAP Injection User Enumeration Horizontal Privilege Escalation Vertical Privilege Escalation Insecure Object Deserialization XXE Processing Cross Site Request Forgery (POST) Vulnerable and Outdated Components | ||
Go | SQL Injection Command Injection Session Fixation Use of Insufficiently Random Values Reflected XSS Stored (Persistent) XSS DOM XSS Directory (Path) Traversal Privileged Interface Exposure Leftover Debug Code Authentication Credentials in URL Session Exposure Within URL User Enumeration Horizontal Privilege Escalation Vertical Privilege Escalation Cross-site Request Forgery (POST) Cross-site Request Forgery (GET) Clickjacking Insecure URL Redirect Insecure TLS Validation Components with Known Vulnerabilities | Spanish German Portuguese French Japanese Korean | |
Source Code | Java .NET Ruby PHP Python Scala C/C++ Android APEX ASP.NET Groovy JavaScript Kotlin Perl Go Visual Basic Visual Basic .NET | ||
.NET API Security | Introduction to API Security Authentication in APIs Separating Authentication Authorization in APIs Broken Object Level Authorization Broken Function Level Authorization Brute Force Attacks Authentication Credentials in URL | German | |
Java API Security | Introduction to API Security Authentication in APIs Separating Authentication Authorization in APIs Broken Object Level Authorization Broken Function Level Authorization Brute Force Attacks Authentication Credentials in URL | German French | |
AppSec for Decision Makers | Introduction for Application Security Injection Flaws Identification and Authentication Failures Sensitive Data Exposure Broken Access Control Security Misconfigurations Vulnerable and Outdated Components Cross-Site Request Forgery XXE Injection Security Logging and Monitoring Failures Insecure Object Deserialization Best Practices for Managers Server-Side Request Forgery (SSRF) Cryptographic Failures Insecure Design | German | |
AppSec for QA | Introduction to Application Security Injection Flaws Identification and Authentication Failures Sensitive Data Exposure Broken Access Control Security Misconfigurations Vulnerable and Outdated Components Cross-site Request Forgery XXE Injection Security Logging and Monitoring Failures Insecure Object Deserialization Server-Side Request Forgery (SSRF) Cryptographic Failures Insecure Design | German French | |
Hacking Headlines | Pippo Deserialization Vert.X XXE Flask Panel XSS Eslint scope Apache Unomi Mozilla-Bleach Mutation Cross-Site Scripting (mXSS) Cryptiles Log4J Pwnkit Zabbix | German (except for Pippo Deserialization, Log4j, Pwnkit and Zabbix) |
To enter the course overview, go to the relevant course in the course list and click <Start>.
The list of lessons appears with an overview for each lesson. Each lesson is listed with an overview and a time estimate5-8 MIN for completing it. Some lessons are only completed once you answered end-of-lesson test questions. These lessons have an additional CHALLENGE icon and generate points once you correctly answered the questions.
Note
Lessons without end-of-lessons questions do not generate points upon completing them.
Although, lessons with end-of-lesson questions are labeled CHALLENGE, these questions are not the challenges that Codebashing lets you take in order test your knowledge. For further information, refer to Challenges.
To display the completed lessons, open the Completed tab. To display the incomplete lessons, open the Not Completed tab respectively.
To start the course, click <Start>.
To start a specific lesson, click its name, for example SQL Injection.
To share a specific lesson with a team mate. click the Share icon next to the desired lesson, complete the email form and then click <Send Now!>. Your team mate receives an email invitation with a short introduction and an invitation to start playing.
From the menu, select Course Progress. A list of courses appears indicating the user progress in each one.
Item | Description |
---|---|
Course Name | The name assigned to the course by the admin user. Click a course name for additional information and statistics of that course, for example Java. |
Course Type |
|
Total Enrolled | Number of users who signed up for the respective course. |
Progress | 1 - The number of users who completed the course. 11 - The number of users who are currently taking the course. |
Duration (avg) | The avarage time it took users to complete this course. If nobody completed the course yet, No Data is displayed instead. |
Points (avg) | The average score of all users. If nobody completed the course yet, No Data is displayed instead. |
Click the desired course, for example Java. A dashboard with statistics and additional data on each course and each lesson appears.
The user completion rate for the selected course as outlined below.

Item | Description |
---|---|
User Completion - primary course only | User progress on this course, if it is the primary course.
|
User Completion - assigned lessons only | User progress on lessons of this course, if at least one lesson of this course has been assigned to the total number of the users in this status. In this example, 3 users (100%) have been assigned to at least one lesson of this course and therefore their status is indicated here.
|
The graph below shows the user engagement for this course.

In this example, 12 users completed lessons of this course.
11 users completed 1-6 lessons.
1 user completed 19-23 lessons.
1059 users did not start any lesson (98%).
The graph below summarizes statistics on the performance of users in the course.

Item | Description |
---|---|
Email Address | The user name of a participating individual user. |
Teams | The name of a participating team. |
Started On | The date at which the user or team started taking the course. |
Completed On | The date at which the user or team completed the course. For users or teams who did not complete the course, this column is empty |
Duration | The time it took the user or the team to complete the course. |
Points | The score achieved in the lesson by the user or the team. |
Lesson Progress | 2 - The number of lessons completed by the user or the team. 6 - The number of lessons that have not been started by the user or the team. |
Certificate | The user or team who completed all the lessons of the course can download the certificate. For all other users or teams, this column is empty. ![]() |
The graph below summarizes statistics on the lessons as part of the course.

Item | Description |
---|---|
Lesson Name | Specifies the lesson as part of the course. |
Enrolled Users | Indicates how frequented the specified lesson is by the users. |
Lesson Progress | Displays the number of users who did not start the lesson and those who completed it. |
Duration (avg) | The average time it took the users to complete the lesson. |
Points (avg) | The average score achieved by the users who completed the lesson. |
To sort content in an ascending order with respect to a certain column, point to that column and click the arrow until it shows upwards.
To sort content in a descending order with respect to a certain column, point to that column and click the arrow until it shows downwards.
To hide a column, point to that column, click
and then select Hide from the menu.
To hide multiple columns in one run or show previously hidden columns, click
and then select Show Columns from the menu. A switchboard appears that allows showing or hiding columns.