LinkedIn
Facebook
X (Twitter)
WhatsApp
Beschreibung
A hands-on introduction to finding vulnerabilities in web apps and to how AI agents are reshaping both attack and defense. We will break three CTF challenges on OWASP Juice Shop by hand, then compare how AI pentesting agents tackle the same targets. Covers red, blue and purple teaming, recent incidents, and small-scale automation. Ethics and rules of engagement up front; all work on sanctioned, self-hosted targets only.
Learning Goals:
- Planning and running security tests within a sanctioned scope and agreed rules of engagement.
- Finding and exploiting vulnerabilities by hand in a deliberately vulnerable web app like OWASP Juice Shop.
- Applying open-source AI pentesting agents and comparing their findings with the manual approach.
- Assessing what AI agents contribute to red, blue and purple teaming, using concrete incidents.
- Carrying out a pentesting project of their own and documenting the findings in a vulnerability report.
What you get
The course instruction is hybrid, which means you can participate either online or in person in Kiel (see location listed in the dates).
Each challenge follows the same rhythm: you attack our deliberately vulnerable Juiceshop web-app by hand first, we discuss and show-and-tell what everyone found, and only then, once thoroughly understood, will we discuss AI/LLM-based approaches against the same target.
You get your own access to a safe-to-attack CTF environment (self-hosted, network-isolated), reachable via VPN, plus an introduction to current open-source AI pentesting agents/frameworks.
The course will offer real-world context and a capstone project where you apply what you've learned end to end.
All needed software is free and open-source.
What you should bring
All tests stays inside the course's defined, sanctioned scope — you'll sign a commitment to the rules of engagement up front.
You don't need prior pentesting experience, but you should be comfortable with a computer: running a terminal, installing software (git, Docker, a VPN client, SSH), and getting Docker and a VPN client running on your own machine.
You should bring sufficient time and a willingness to show your work, including dead ends: the format runs on show-and-tell, not polished results or AI slop. We are as interested in this topic as you are. Between sessions you'll work on CTF homework challenges. Expect a written note after each manual challenge (what you found, how, how long it took, what dead ends you hit) — this is what makes the later manual-vs-AI comparison possible, and doubles as practice for writing the vulnerability report.
In order to receive a certificate of achievement (Leistungszertifikat / 2.5 ECTS) for this course, active participation is expected, and you have to conduct a practice project and submit a finished report.
Termine
Dienstag, 10.11.2026
16:00 - 18:00
Dienstag, 17.11.2026
16:00 - 18:00
Dienstag, 24.11.2026
16:00 - 18:00
Dienstag, 01.12.2026
16:00 - 18:00
Dienstag, 08.12.2026
16:00 - 18:00
Dienstag, 15.12.2026
16:00 - 18:00
Dienstag, 22.12.2026
16:00 - 18:00
Dienstag, 05.01.2027
15:00 - 17:00
Dienstag, 12.01.2027
16:00 - 18:00
Online
Buchungszeitraum:
01.09.2026
-
23.10.2026
Dienstag, 10.11.2026
16:00 - 18:00
Dienstag, 17.11.2026
16:00 - 18:00
Dienstag, 24.11.2026
16:00 - 18:00
Dienstag, 01.12.2026
16:00 - 18:00
Dienstag, 08.12.2026
16:00 - 18:00
Dienstag, 15.12.2026
16:00 - 18:00
Dienstag, 22.12.2026
16:00 - 18:00
Dienstag, 05.01.2027
15:00 - 17:00
Dienstag, 12.01.2027
16:00 - 18:00
Buchungszeitraum:
01.09.2026
-
23.10.2026