< Back to catalog

Secure coding in C# with Claude Code (desktop applications)

CYDCsDsk3dClaude
3 days
On-site or online
Hands-on
C#
Developer
Instructor-led
Pricing Inquiry Download PDF
labs

30 Labs

case_study

15 Case Studies

Platform

Claude Code, Desktop, Generative AI

Audience

C# developers using Claude Code

Preparedness

General C# development

Standards and references

CWE and Fortify Taxonomy

Group size

12 participants

Outline

  • Coding responsibly with Claude Code
  • Input validation
  • Security features
  • Denial of service
  • Using vulnerable components
  • Cryptography for developers
  • Common software security weaknesses
  • Wrap up

What you will learn

  • Understanding the essentials of responsible AI
  • Getting familiar with essential cyber security concepts
  • Input validation approaches and principles
  • Identify vulnerabilities and their consequences
  • Learn the security best practices in C#
  • Correctly implementing various security features
  • Managing vulnerabilities in third party components
  • Understanding how cryptography supports security
  • Learning how to use cryptographic APIs correctly in C#
  • All this put into the context of Claude Code

Description

Claude Code is transforming the way developers interact with software projects, enabling AI-assisted development directly within the development environment. Its ability to understand codebases, modify files, run commands, and assist with complex development tasks can significantly improve developer productivity. At the same time, giving an AI tool a deeper role in the development process introduces important security and quality considerations, requiring developers to use it responsibly.

This course provides a comprehensive insight into the responsible use of Claude Code for secure software development. Participants explore how AI-assisted development can affect security-critical areas such as authentication, authorization, cryptography, input validation, and secure handling of sensitive data. The curriculum also examines how Claude Code approaches secure coding practices and common vulnerabilities from the OWASP Top Ten, including path traversal, SQL injection, and cross-site scripting.

Through hands-on exercises and experimentation with Claude Code, participants gain a practical understanding of both its capabilities and limitations. They learn how to critically review AI-generated and AI-modified code, identify security weaknesses that may be introduced or overlooked, and use AI assistance without surrendering control over important development and security decisions. Real-world case studies illustrate the potential consequences of insecure AI-assisted development and the dual role of AI as both a powerful development resource and a potential security risk.

By the end of the course, developers will be equipped with the knowledge and practical skills to use Claude Code responsibly throughout the software development lifecycle, taking advantage of AI-assisted development while maintaining appropriate security, code quality, and developer oversight.

Table of contents

  • Coding responsibly with Claude Code
  • Input validation
    • Input validation principles
    • Denylists and allowlists
    • What to validate – the attack surface
    • Where to validate – defense in depth
    • When to validate – validation vs transformations
    • Injection
      • Code injection
        • OS command injection
          • Lab – Command injection
          • OS command injection best practices
          • Avoiding command injection with the right APIs
          • Lab – Command injection best practices
          • Lab – Experimenting with command injection in Claude Code
          • Case study – Command injection in Ruckus
    • Integer handling problems
      • Representing signed numbers
      • Integer visualization
      • Integer overflow
      • Lab – Integer overflow
      • Signed / unsigned confusion
      • Case study – The Stockholm Stock Exchange
      • Lab – Signed / unsigned confusion
      • Lab – Experimenting with signed / unsigned confusion in Claude Code
      • Integer truncation
      • Best practices
        • Upcasting
        • Precondition testing
        • Postcondition testing
        • Integer handling in C#
        • Lab – Checked arithmetics
        • Lab – Experimenting with integer overflow in Claude Code
    • Files and streams
      • Path traversal
      • Lab – Path traversal
      • Additional challenges in Windows
      • Case study – File spoofing in WinRAR
      • Path traversal best practices
      • Lab – Path canonicalization
      • Lab – Experimenting with path traversal in Claude Code
  • Input validation
    • Unsafe reflection
      • Reflection without validation
      • Lab – Unsafe reflection
      • Lab – Experimenting with unsafe reflection in Claude Code
    • Unsafe native code
      • Native code dependence
      • Lab – Unsafe native code
      • Best practices for dealing with native code
  • Security features
    • Authentication
      • Authentication basics
      • Multi-factor authentication (MFA)
      • Case study – The InfinityGauntlet attack
      • Time-based One Time Passwords (TOTP)
      • Password management
      • Storing account passwords
      • Password in transit
      • Lab – Is just hashing passwords enough?
      • Dictionary attacks and brute forcing
      • Salting
      • Adaptive hash functions for password storage
      • Lab – Using adaptive hash functions in C#
      • Lab – Experimenting with adaptive hash functions in Claude Code
      • Case study – Veeam missing authentication and cleartext password storage
      • Password policy
        • NIST authenticator requirements for memorized secrets
        • Password database migration
        • Hard coded passwords
        • Best practices
        • Lab – Hardcoded password
        • Protecting sensitive information in memory
          • Challenges in protecting memory
          • Case study – Microsoft secret key theft via dump files
          • Storing sensitive data in memory
          • Case study – KeePass password leakage via strings
    • Information exposure
      • Exposure through extracted data and aggregation
      • Case study – Strava data exposure
    • Platform security
      • .NET platform security
        • Protecting .NET code and applications
          • Code signing
  • Denial of service
    • Flooding
    • Resource exhaustion
    • Algorithmic complexity issues
      • Regular expression denial of service (ReDoS)
        • Lab – ReDoS
        • Lab – Experimenting with ReDoS in Claude Code
        • Dealing with ReDoS
  • Using vulnerable components
    • Case study – The Polyfill.io supply chain attack
    • Vulnerability management
      • Lab – Finding vulnerabilities in third-party components
    • Security of AI generated code
      • Practical attacks against code generation tools
      • Dependency hallucination via generative AI
      • Case study – Agentic coding and code security (mid-2025 onward)
  • Cryptography for developers
    • Cryptography basics
    • Crypto APIs in C#
    • Elementary algorithms
      • Hashing
        • Hashing basics
        • Hashing in C#
        • Lab – Hashing in C#
      • Random number generation
        • Pseudo random number generators (PRNGs)
        • Cryptographically secure PRNGs
        • Weak PRNGs
        • Using random numbers in C#
        • Lab – Using random numbers in C#
        • Case study – Equifax credit account freeze
    • Confidentiality protection
      • Symmetric encryption
        • Block ciphers
        • Modes of operation
        • Modes of operation and IV – best practices
        • Symmetric encryption in C#
        • Lab – Symmetric encryption in C#
        • Case study – Padding oracle used in RCE against Citrix ShareFile
      • Asymmetric encryption
        • The RSA algorithm
          • RSA in C#
      • Combining symmetric and asymmetric algorithms
      • Key exchange and agreement
        • Key exchange
        • Diffie-Hellman key agreement algorithm
    • Integrity protection
      • Message Authentication Code (MAC)
        • Calculating HMAC in C#
        • Lab – Calculating MAC in C#
      • Digital signature
        • Digital signature with RSA
        • Elliptic Curve Cryptography
          • ECC basics
          • Digital signature with ECC
        • Digital signature in C#
          • Lab – Digital signature with ECDSA in C#
  • Common software security weaknesses
    • Code quality
      • Code quality and security
      • Data handling
        • Initialization and cleanup
          • Class initialization cycles
          • Lab – Initialization cycles
      • Object oriented programming pitfalls
        • Inheritance and overriding
        • Mutability
          • Lab – Mutable object
      • Serialization
        • Serialization and deserialization challenges
        • Integrity – deserializing untrusted streams
        • Integrity – deserialization best practices
        • Look ahead deserialization
        • Property Oriented Programming (POP)
          • Creating a POP payload
          • Lab – Creating a POP payload
          • Lab – Using the POP payload
          • Case study – Deserialization RCE in Veeam
  • Wrap up
    • Secure coding principles
      • Principles of robust programming by Matt Bishop
      • Secure design principles of Saltzer and Schroeder
    • And now what?
      • Software security sources and further reading
      • .NET and C# resources
      • Generative AI – Resources and additional guidance

Pricing

3 days Session Price

2250 EUR / person

  • Live, instructor led classroom training
  • Discussion and insight into the hacker’s mindset
  • Hands-on practice using case studies based on high-profile hacks and live lab exercises
Inquiry
Customized course

Tailor a course to your preferences

  • Send us a brief description of your business’s training needs
  • Include your contact information
  • One of our colleagues will be in touch to schedule a free consultation about training requirements
Inquiry

Inquiry

Interested in the trainings but still have some questions? Curious about how you can customize a training for your team? Send us a message and a team member will be in touch within 24 hours.

This field is required

This field is required

Send us your phone number if you prefer to discuss further on a call

This field is required

This field is required

This field is required

This field is required