140+ free security awareness and application security exercises. Fully white-labeled, no strings attached
This content describes a freely available collection of over 140 security awareness and application security exercises. These exercises are designed for interactive learning, covering topics such as phishing, GDPR compliance, OWASP Top 10 vulnerabilities, and secure application development. The materials are provided as white-labeled SCORM packages under a Creative Commons license, allowing self-hosting and customization without branding or paywalls. The resource is intended for educational and training purposes and does not represent a security vulnerability or threat.
AI Analysis
Technical Summary
The resource offers a comprehensive library of interactive security awareness and application security exercises, including scenarios on phishing, GDPR, AI compliance, and OWASP Top 10 vulnerabilities for web and API security. Exercises simulate real-world attack and defense scenarios, enabling learners to identify, trace, and remediate security issues. The content is distributed as SCORM 1.2 packages under a CC BY-NC 4.0 license, allowing integration into various learning management systems or self-hosting. This initiative aims to enhance security training without introducing any inherent security risks or vulnerabilities.
Potential Impact
There is no direct security impact or vulnerability associated with this content. It serves as an educational tool to improve security awareness and application security skills. No exploitation or threat is described.
Mitigation Recommendations
No mitigation or remediation is required as this is not a security threat or vulnerability. The content is safe to use as a training resource.
140+ free security awareness and application security exercises. Fully white-labeled, no strings attached
Description
This content describes a freely available collection of over 140 security awareness and application security exercises. These exercises are designed for interactive learning, covering topics such as phishing, GDPR compliance, OWASP Top 10 vulnerabilities, and secure application development. The materials are provided as white-labeled SCORM packages under a Creative Commons license, allowing self-hosting and customization without branding or paywalls. The resource is intended for educational and training purposes and does not represent a security vulnerability or threat.
Reddit Discussion
Disclosure: I work on the commercial platform these were built with. The exercise preview links point to that domain. The SCORM packages themselves are fully white-labeled — no logos, no backlinks, no sign-up, no paywall. Grab them from GitHub and self-host if you'd rather not touch our site.
Also, the post was admin-approved, a huge "thank you" to them!
-----------------
Hey r/cybersecurity,
I'm a cybersec engineer with an L&D background. For the last year been working on a library of ~140 free interactive exercises dedicated to teaching people how to build secure applications, recognize phishing and use AI in a safe way. Exercises are split across two Github repos, all packaged as SCORM .zip files under CC BY-NC 4.0 license.
Security awareness (130+ exercises)
Each one drops the learner into a first-person 3D office and makes them act: answer the phone, read the email, click the thing, live with it. Every exercise ends with a quiz at a 100% pass threshold.
Course packages in the repo:
- OWASP Top 10 for LLM Applications (10) — prompt injection hidden in uploaded documents, sensitive data categories that should never enter a prompt, system prompt extraction against a live chatbot, RAG pipeline access-control failures, denial-of-wallet against an unprotected AI API
- OWASP Top 10 for Agentic Applications (10) — goal hijacking via poisoned email, agent memory poisoning, agent-to-agent message spoofing, multi-agent cascading failure, detecting a rogue agent that looks like it's working fine
- EU AI Act Compliance (16) — Article 4 literacy, risk-tier classification, prohibited practices, FRIAs, GPAI obligations, penalty structure
- GDPR Compliance (11) — the 72-hour breach clock, fraudulent DSARs used as social engineering, Article 30 RoPA building, Schrems II transfer assessments, PII redaction that actually removes the data
- Phishing & Impersonation (13) — vishing, smishing, BEC, QR phishing, callback/TOAD, double-barrel, deepfake whaling on a live video call
- Device Security (8) — ransomware in real time, USB drop / Rubber Ducky, EDR alert triage, file extension tricks
- Passwords & Account Security (7), Web & Browser Safety (6), Safe Communication & Sharing (6), Workplace Security (5), Security Policies & Your Role (5), Protecting Sensitive Information (4), plus Incident Reporting, Remote/Home Office, and Real-World Incidents (the MGM/Scattered Spider helpdesk call, a OneNote-based BEC chain)
Application security (40+ exercises)
Built on an exploit, trace and remediate loop. You run the attack against a deliberately vulnerable app, trace how the bug got introduced, then write the fix. Remediation examples are given in JavaScript, TypeScript, Java, C#, Python, Scala, PHP, Ruby, Go, and Kotlin.
- OWASP Top 10 for Web (22) — SQLi, DOM/reflected/stored XSS, SSRF to the cloud metadata endpoint, XXE, CSRF, session fixation, host header injection, weak randomness (recovering Math.random() state to predict a reset token), IDOR from both sides
- OWASP API Security Top 10 (10) — BOLA, broken function-level auth, mass assignment, excessive data exposure, improper inventory management (hitting a retired v1 that skips v2's controls), CORS misconfiguration
- Git & Repository Security (8) — secrets recovered from the commit that removed them, exposed .git directories, commit author spoofing, branch protection bypass, CI/CD secret exposure in build logs, spotting a backdoor in a friendly-looking PR
Two ways to use it
Web view — run exercises in a browser, good for workshops or sharing with students and colleagues.
GitHub — every exercise is a SCORM 1.2 .zip. Import into Moodle, TalentLMS, Cornerstone, SuccessFactors, or anything SCORM-compliant, or preview on SCORM Cloud first. The repo root holds full course packages; the Individual Exercises folder has standalone modules if you want to build your own curriculum.
Security awareness: https://github.com/ransomleak/training-security-awareness
Application security: https://github.com/ransomleak/training-application-security
Web view: https://learning.ransomleak.com/
Will appreciate your stars! 🙏
License: CC BY-NC 4.0. Use, adapt, and redistribute with attribution for any non-commercial purpose — internal training, workshops, university courses. Reselling or redistributing it as a standalone product isn't permitted.
Happy to answer questions or take criticism on the exercises. If this gets traction I'll keep adding to it — drop topic requests in the comments. OWASP Top 10 for Cloud is already in the works.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The resource offers a comprehensive library of interactive security awareness and application security exercises, including scenarios on phishing, GDPR, AI compliance, and OWASP Top 10 vulnerabilities for web and API security. Exercises simulate real-world attack and defense scenarios, enabling learners to identify, trace, and remediate security issues. The content is distributed as SCORM 1.2 packages under a CC BY-NC 4.0 license, allowing integration into various learning management systems or self-hosting. This initiative aims to enhance security training without introducing any inherent security risks or vulnerabilities.
Potential Impact
There is no direct security impact or vulnerability associated with this content. It serves as an educational tool to improve security awareness and application security skills. No exploitation or threat is described.
Defensive Guidance
No mitigation or remediation is required as this is not a security threat or vulnerability. The content is safe to use as a training resource.
Technical Details
- Source Type
- Subreddit
- cybersecurity
- Reddit Score
- 0
- Discussion Level
- minimal
- Content Source
- reddit_link_post
- Post Type
- link
- Domain
- null
- Newsworthiness Assessment
- {"score":27,"reasons":["external_link","established_author","very_recent"],"isNewsworthy":true,"foundNewsworthy":[],"foundNonNewsworthy":[]}
- Has External Source
- true
- Trusted Domain
- false
Threat ID: 6a886995acd9273b494e390f
Added to database: 08/21/2026, 15:07:01 UTC
Last enriched: 08/21/2026, 15:07:10 UTC
Last updated: 08/21/2026, 19:51:58 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.