In the How to Create a Course article, we briefly touched on creating custom Course modules as an option, aside from using pre-configured modules and templates.

Creating a custom Course module can help you focus on specific key weaknesses discovered using our tournaments and assessments, or by using other security tools your company has access to.

You can also more readily customize the content for certain developer groups as well as define the type of vulnerability or activity types for developers to undertake.

This article describes how to create a module. 

Pre-requisites

When creating or editing Course content, select the required language, and click + Add vulnerability module to start building the course module. If you haven't yet created a Course, please see the How to Create a Course article.

There are two ways to add a module;

• Creating a new module from scratch - This gives finite control over the vulnerability category, sub-category, type of activity, difficulty, playing stage, hints, and unlock conditions.
  (Note: An unlock condition prevents the module from being played until a prerequisite module is completed first. This helps guide the developers through the required learning activities.)
  
  
• Search for a vulnerability module - This makes it easy to select predefined modules for the chosen language.
  
  Note: This option excludes modules that have already been added.

Create a New Module From Scratch

Step 1.

Enter the name and description for the new module and, if required, add an unlock condition.

Note: This option will be disabled if no other modules are available.

Scroll down to the Activities section and click the + button to start adding activities.

Step 2

Clicking the + button to add an activity will bring up a separate window that gives you the option to choose from five different types of activities:

• Video - Demonstrates foundational concepts
• Challenge - Practical code with a choice of interactive playing stages and difficulties. Challenges can be played with hints or no hints. A challenge can also be set up as a checkpoint. Checkpoints are special challenges that are played with no hints and can be used to unlock module content when successfully completed;
• Walkthrough - Walkthrough activity guides the developer step-by-step on how vulnerabilities manifest in a real-world application, providing context and helping developers experience the impact of vulnerable code.
• Mission - Mission activity is for developers, with security ambitions, to practice their offensive skills, in an immersive simulation where they can experience the impact of poor coding practices.
• Custom - An option to add tailor-made messages and or instructions to any Course module

Adding a Video

Select the Video option and then choose a Topic for the video. There are two topics to choose from:

• Security Foundations
• Security Vulnerabilities
  
  
  
  
  Security Foundations videos can be selected in relation to Application Security Concepts or Web App Security 101. Select a category and then choose the appropriate video you want to add.
  
  You can also choose a specific security vulnerability to target. Select Security Vulnerabilities as the topic and then select the appropriate category and sub-category.
  
  

Click Apply changes to continue.

Adding a Challenge

Select the Challenge option. You'll be prompted to choose a vulnerability category, subcategory, and the desired difficulty level.

Tip: Difficulty is a great way to cater for the different levels of experience across your team. 

Stage(s) allows you to choose how the challenge will be played;

1. Identify -- Builds awareness in recognizing vulnerabilities and how they work
2. Locate -- Levels up skills in finding vulnerabilities during code-review
3. Fix -- Understand how to mitigate and solve the vulnerability
4. Identify & Fix -- Combines identify and fix
5. Locate & Fix -- Combines locate and fix

Lastly, decide whether or not to enable hints. 



To Add a Checkpoint, toggle the checkpoint button. Please note that hints are disabled for Checkpoints.

Once you're ready, click Apply changes to continue.

Adding a Walkthrough 

Select the Mission option, you will be prompted to select the mission type; choose Walkthrough then choose a vulnerability category, subcategory.

Check all vulnerabilities covered in Walkthrough  Here

Note: In the Walkthrough, hints are always enabled, and the difficulty level is always set to 'Single difficulty'.

Click Apply changes to continue.

Adding a Mission

Select the Mission option. You will be prompted to select the mission type; choose Mission then choose a vulnerability category, subcategory, and the desired difficulty level.

There are 3 different difficulty levels available for Missions:

• Easy: There is one vulnerability in the code that is also highlighted in the code snippet.
• Medium: There is one vulnerability in the code, but it isn't highlighted in the code snippet.
• Hard: There are several vulnerabilities in the code, but none of them are highlighted in the code snippet.

Click Apply changes to continue.

Adding a Custom Message 

Select the Custom option. You will be prompted to enter a title and body for your custom message.

A custom activity can be added at the start, middle, or as the last activity in the course as part of any module. It can also be added to existing modules and course content.

For example, a course can be created based on a template (e.g. OWASP Top 10) and then modified to add custom activities.

Tip: Messages can contain hyperlinks to supporting documents and videos. This allows company admins or team managers to include links to their own client-hosted proprietary documents and procedures.

Note: Tick the "requires users to confirm they have completed this activity" checkbox for any activity that's mandatory for developers to complete.

Search for a Vulnerability Module

Step 1.

From the Add vulnerability module window, select the Search for a vulnerability module option.

Search for the desired vulnerability category and choose an option from the results displayed. 

Note: If a module for your searched vulnerabilities isn't listed, try using the ‘Create a new module from scratch’ option.