roadmaps: add hands-on security exercises to 17 topics (#10297)

2026-09-19 09:32:03 +08:00 · 2026-09-10 09:08:04 +02:00
parent 74a645b853
commit bae2a28f45
17 changed files with 27 additions and 10 deletions
@@ -5,4 +5,5 @@ Security and privacy concerns in AI revolve around the protection of data and th
 Visit the following resources to learn more:

 - [@article@Examining Privacy Risks in AI Systems](https://transcend.io/blog/ai-and-privacy)
+- [@course@AI Security Labs: OWASP LLM, Agentic and MCP Top 10](https://ransomleak.com/catalogue/ai-security/)
 - [@video@AI Is Dangerous, but Not for the Reasons You Think | Sasha Luccioni | TED](https://www.youtube.com/watch?v=eXdVDhOGqoE)
@@ -7,4 +7,5 @@ Visit the following resources to learn more:
 - [@article@AI Agents - Learn Prompting](https://learnprompting.org/docs/intermediate/ai_agents)
 - [@article@EmbraceTheRed](https://embracethered.com/)
 - [@official@Model Context Protocol - Authorization Specification](https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization)
- [@article@GitHub MCP Exploited: Accessing Private Repositories via MCP - Invariant Labs](https://invariantlabs.ai/blog/mcp-github-vulnerability)
+- [@article@GitHub MCP Exploited: Accessing Private Repositories via MCP - Invariant Labs](https://invariantlabs.ai/blog/mcp-github-vulnerability)
+- [@course@Agentic Goal Hijacking: Hands-on Exercise](https://ransomleak.com/exercises/agentic-goal-hijack/)
@@ -6,4 +6,5 @@ Visit the following resources to learn more:

 - [@course@AI Red Teaming Courses - Learn Prompting](https://learnprompting.org/blog/ai-red-teaming-courses)
 - [@article@SecBench: A Comprehensive Multi-Dimensional Benchmarking Dataset for LLMs in Cybersecurity](https://arxiv.org/abs/2412.20787)
- [@article@The Ultimate Guide to Red Teaming LLMs and Adversarial Prompts (Kili Technology)](https://kili-technology.com/large-language-models-llms/red-teaming-llms-and-adversarial-prompts)
+- [@article@The Ultimate Guide to Red Teaming LLMs and Adversarial Prompts (Kili Technology)](https://kili-technology.com/large-language-models-llms/red-teaming-llms-and-adversarial-prompts)
+- [@course@OWASP LLM, Agentic and MCP Top 10: Exploit-then-Fix Labs](https://ransomleak.com/catalogue/ai-security/)
@@ -8,4 +8,5 @@ Visit the following resources to learn more:
 - [@article@Prompt Injection & the Rise of Prompt Attacks](https://www.lakera.ai/blog/guide-to-prompt-injection)
 - [@article@Prompt Injection (Learn Prompting)](https://learnprompting.org/docs/prompt_hacking/injection)
 - [@article@Prompt Injection Attack Explanation (IBM)](https://research.ibm.com/blog/prompt-injection-attacks-against-llms)
- [@article@Prompt Injection: Impact, How It Works & 4 Defense Measures](https://www.tigera.io/learn/guides/llm-security/prompt-injection/)
+- [@article@Prompt Injection: Impact, How It Works & 4 Defense Measures](https://www.tigera.io/learn/guides/llm-security/prompt-injection/)
+- [@course@Prompt Injection: Hands-on Exercise Against a Live Assistant](https://ransomleak.com/exercises/clawdbot-prompt-injection/)
@@ -5,3 +5,4 @@ IAM, or Identity and Access Management, in AWS is a service that enables you to
 Visit the following resources to learn more:

 - [@official@IAM - User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html)
+- [@course@Over-Permissive IAM: Hands-on Privilege Escalation Exercise](https://ransomleak.com/exercises/over-permissive-iam/)
@@ -5,3 +5,4 @@ Amazon S3 (Simple Storage Service) is an object storage service offered by Amazo
 Visit the following resources to learn more:

 - [@official@S3](https://docs.aws.amazon.com/AmazonS3/latest/userguide/Welcome.html)
+- [@course@Public S3 Buckets: Hands-on Exercise](https://ransomleak.com/exercises/public-storage-buckets/)
@@ -5,3 +5,4 @@ Security Groups in AWS act as a virtual firewall for your instance to control in
 Visit the following resources to learn more:

 - [@official@Security Groups](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html)
+- [@course@Cloud Network Exposure: Hands-on Security Group Exercise](https://ransomleak.com/exercises/cloud-network-exposure/)
@@ -9,4 +9,5 @@ Visit the following resources to learn more:
 - [@article@Token Based Authentication](https://roadmap.sh/guides/token-authentication)
 - [@article@JWT Authentication](https://roadmap.sh/guides/jwt-authentication)
 - [@article@OAuth - Open Authorization](https://roadmap.sh/guides/oauth)
- [@article@SSO - Single Sign On](https://roadmap.sh/guides/sso)
+- [@article@SSO - Single Sign On](https://roadmap.sh/guides/sso)
+- [@course@Broken Authentication: Hands-on Exercise](https://ransomleak.com/exercises/broken-user-authentication/)
@@ -7,4 +7,5 @@ Visit the following resources to learn more:
 - [@official@OWASP Website](https://owasp.org/)
 - [@opensource@OWASP Application Security Verification Standard](https://github.com/OWASP/ASVS)
 - [@article@OWASP Top 10 Security Risks](https://cheatsheetseries.owasp.org/IndexTopTen.html)
- [@article@OWASP Cheatsheets](https://cheatsheetseries.owasp.org/cheatsheets/AJAX_Security_Cheat_Sheet.html)
+- [@article@OWASP Cheatsheets](https://cheatsheetseries.owasp.org/cheatsheets/AJAX_Security_Cheat_Sheet.html)
+- [@course@OWASP Top 10: Exploit-then-Fix Labs](https://ransomleak.com/catalogue/application-security/)
@@ -6,4 +6,5 @@ Visit the following resources to learn more:

 - [@article@How to Manage Secrets in Web Applications?](https://cs.fyi/guide/secret-management-best-practices)
 - [@article@Why DevSecOps Teams Need Secrets Management](https://www.keepersecurity.com/blog/2023/01/26/why-devsecops-teams-need-secrets-management/)
+- [@course@CI/CD Secret Exposure: Hands-on Exercise](https://ransomleak.com/exercises/cicd-secret-exposure/)
 - [@video@DevOps Tricks for Managing Secrets in Production](https://www.youtube.com/watch?v=u_L-f7Th_7o)
@@ -5,4 +5,5 @@ Container security encompasses a broad set of practices and tools aimed at prote
 Visit the following resources to learn more:

 - [@official@Docker Security](https://docs.docker.com/engine/security/)
- [@article@Kubernetes Security Best Practices](https://www.aquasec.com/cloud-native-academy/kubernetes-in-production/kubernetes-security-best-practices-10-steps-to-securing-k8s/)
+- [@article@Kubernetes Security Best Practices](https://www.aquasec.com/cloud-native-academy/kubernetes-in-production/kubernetes-security-best-practices-10-steps-to-securing-k8s/)
+- [@course@Container Security Labs: Privileged Containers, Daemon Exposure, Image Layers](https://ransomleak.com/catalogue/cloud-security/)
@@ -5,4 +5,5 @@ Image security is a crucial aspect of deploying Docker containers in your enviro
 Visit the following resources to learn more:

 - [@official@Docker Content Trust](https://docs.docker.com/engine/security/trust/content_trust/)
- [@official@Docker Hub](https://hub.docker.com/)
+- [@official@Docker Hub](https://hub.docker.com/)
+- [@course@Secrets in Image Layers: Hands-on Exercise](https://ransomleak.com/exercises/secrets-in-image-layers/)
@@ -5,4 +5,5 @@ Runtime security in Docker focuses on ensuring the safety and integrity of conta
 Visit the following resources to learn more:

 - [@official@Docker Security](https://docs.docker.com/engine/security/)
- [@official@Docker Security Best Practices](https://docs.docker.com/build/building/best-practices/)
+- [@official@Docker Security Best Practices](https://docs.docker.com/build/building/best-practices/)
+- [@course@Privileged Containers: Hands-on Escape Exercise](https://ransomleak.com/exercises/privileged-containers/)
@@ -4,4 +4,5 @@ Third-party images are pre-built Docker container images that are available on D

 Visit the following resources to learn more:

- [@official@Docker Hub Registry](https://hub.docker.com/)
+- [@official@Docker Hub Registry](https://hub.docker.com/)
+- [@course@Malicious Base Images: Hands-on Exercise](https://ransomleak.com/exercises/malicious-base-images/)
@@ -6,4 +6,5 @@ Visit the following resources to learn more:

 - [@official@GitHub security features](https://docs.github.com/en/code-security/getting-started/github-security-features)
 - [@official@Dependabot Quick-start Guide](https://docs.github.com/en/code-security/getting-started/dependabot-quickstart-guide)
- [@official@About user alerts](https://docs.github.com/en/code-security/secret-scanning/managing-alerts-from-secret-scanning/about-alerts#about-user-alerts)
+- [@official@About user alerts](https://docs.github.com/en/code-security/secret-scanning/managing-alerts-from-secret-scanning/about-alerts#about-user-alerts)
+- [@course@Git and Repository Security: Hands-on Labs](https://ransomleak.com/catalogue/git-security/)
@@ -6,4 +6,5 @@ Visit the following resources to learn more:

 - [@official@Using secrets in GitHub Actions](https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions)
 - [@official@Store information in variables](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/store-information-in-variables)
+- [@course@CI/CD Secret Exposure: Hands-on Exercise](https://ransomleak.com/exercises/cicd-secret-exposure/)
 - [@video@Secrets and Environment Variables in your GitHub Action](https://www.youtube.com/watch?v=dPLPSaFqJmY)
@@ -6,4 +6,5 @@ Visit the following resources to learn more:

 - [@official@Mitigate jailbreaks and prompt injections - Anthropic](https://platform.claude.com/docs/en/test-and-evaluate/strengthen-guardrails/mitigate-jailbreaks)
 - [@official@LLM01:2025 Prompt Injection - OWASP](https://genai.owasp.org/llmrisk/llm01-prompt-injection/)
+- [@course@Prompt Injection: Hands-on Exercise Against a Live Assistant](https://ransomleak.com/exercises/clawdbot-prompt-injection/)
 - [@video@What Is a Prompt Injection Attack?](https://www.youtube.com/watch?v=jrHRe9lSqqA)