BeeraSafe

Academy

Learn security by doing it.

Two foundations tracks plus a vulnerability library — readings, quizzes, and simulated labs that run entirely in your browser. Free with a BeeraSafe account.

Start learning free Verify a certificate

01

Two tracks, one order

Offense first so defense makes sense: you cannot triage an attack you have never walked through. Each track ends in a timed exam and a verifiable certificate.

Beginner

Offensive Foundations

Think like a tester: scope, recon, probing, and reporting that holds up.

6 lessons · 2 labs · 2 quizzes · ~78 min

Open track
Beginner

Defensive Foundations

Triage, hunt, detect, and respond with evidence you can defend.

6 lessons · 2 labs · 2 quizzes · ~78 min

Open track

02

Vulnerability library

One flaw at a time: how it works, a simulated lab to prove it, and a quiz to keep it. Every topic earns its own certificate.

SQL InjectionBreak out of the query, read what you should not, then fix it with parameters.Cross-Site ScriptingReflected, stored, DOM: where input becomes script, and how encoding stops it.Cross-Site Request ForgeryRide the victim's session: why ambient authority needs tokens.OS Command InjectionWhen user input reaches a shell: separators, exfiltration, and the fix.Server-Side Request ForgeryMake the server fetch for you: internal services, metadata, and egress control.Path TraversalDot-dot-slash past the intended directory, and the allowlists that stop it.Broken Access ControlIDOR and missing checks: asking for someone else's objects by number.Authentication FlawsSpraying, lockouts, and reset tokens: where login logic breaks.HTTP Request SmugglingTwo servers, two framings, one hidden request in the gap.Server-Side Template InjectionWhen your words become the template's code.JWT AttacksTrusting tokens: alg confusion, none, and weak secrets.Prototype PollutionMerging __proto__ poisons every object. Guard the keys.

03

Labs that cannot reach us

Practice infrastructure is the most abused part of any security school. Academy has none — by construction, not by policy.

Simulated, not connected

Every lab terminal runs in your browser against canned data. No lab traffic touches BeeraSafe infrastructure, and no lesson points at a real host.

Earned, not clicked

Quizzes re-grade and lab transcripts re-simulate on the server. Certificates go to learners who did the work.

Verifiable

Each certificate carries a code employers check at academy/verify.