Founding cohort applications open

Deliberate practice for serious low-level security builders.

Real binary exploitation, kernel fuzzing, and pwn practice with direct review on your exploit code and thinking. Structured progression, not endless tutorials.

Free application for motivated builders with C/Python basics. Accepted applicants receive a separate $25/month invite. First invites go out after DEF CON 34 (August 6-9, 2026).

C/Python basics
Skill req
5-10 hrs/week
Weekly cadence
August 2026
Starts
10 seats
Capacity
Challenge Preview: Kernel Buffer Overflow
RegistersLive
RAX0x0000000000000000
RBX0x00007fffffffe310
RIP0x4141414141414141
RSP0x00007fffffffe2a0
RBP0x4242424242424242
Disassemblyvulner_func+42
0x4011d0 push rbp
0x4011d1 mov rbp, rsp
0x4011d4 sub rsp, 0x40
0x4011d8 lea rax, [rbp-0x40]
0x4011dc call gets@plt
0x4011e1 leave
0x4011e2 ret
Stack Visualization
High Address
Saved RIP (0x41414141)
Saved RBP (0x42424242)
BUFFER OVERFLOW IN PROGRESS
A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A A
Low Address
Hex Dump0x7fffffffe2a0
0x0000: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
0x0010: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
0x0020: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
0x0030: 41 41 41 41 41 41 41 41 42 42 42 42 42 42 42 42
0x0040: 41 41 41 41 41 41 41 41 00 00 00 00 00 00 00 00
pwndbg> run $(python -c 'print "A"*72 + "B"*8 + "\\x41"*8')

A serious training program for builders who are ready to do the reps.

Best for

  • You already have basic C or Python fluency and can work from a terminal without hand-holding.
  • You want real binary exploitation, kernel fuzzing, or pwn reps rather than another survey course.
  • You can reliably give 5 to 10 hours each week to solving, submitting, and iterating.

Not for

  • Total beginners who have never programmed.
  • Passive course consumers who mainly want videos or a certificate.
  • Anyone looking for instant access to every tier without reviewed progression.

What you actually do every week.

Warm-up

Open with a fast systems rep

Start the week with a small challenge that sharpens debugging, reversing, or scripting speed.

Main lab

Push one serious exploit or fuzzing task

Work a bounded binary or kernel problem with a concrete objective instead of open-ended browsing.

Submission

Ship the artifact

Submit a PoC, exploit script, reproducer, or notes on the primitive you isolated and the dead ends you hit.

Review

Get annotated feedback and unlock the next level

Review focuses on exploit logic, reliability, dead ends, and what to fix before the next challenge opens.

The process

A clear weekly loop from challenge selection to reviewed submission.

You choose a track, work the challenge, submit your artifact, get annotated feedback, and move forward only when the work is ready.

Placement 01 / 5

Start with the right track

Start from Foundations, Binary Exploitation, Kernel Fuzzing, or Kernel Pwn based on current reps.

  • CTF Foundations
  • Binary Exploitation
  • Kernel Fuzzing
  • Kernel Pwn
Pick the lane that matches your current reps, not your ego.
01

Step 01

Choose track

Start from Foundations, Binary Exploitation, Kernel Fuzzing, or Kernel Pwn based on current reps.

02

Step 02

Solve challenge

Attempt a bounded challenge with the right level of difficulty instead of getting lost in an endless platform catalog.

03

Step 03

Submit PoC / exploit

Ship the code, notes, and reasoning so the review is about your actual work product.

04

Step 04

Get annotated review

Mentor feedback calls out primitives, exploit reliability, blind spots, and stronger next steps.

05

Step 05

Unlock next level

Progression compounds only after the current solve is stable and your reasoning is clean.

Why this is different

Different from HTB, TryHackMe, or long video playlists for one reason: reviewed work.

Area Videos Open platforms Hackers School
Unit of progress Watching explanations and taking notes. Self-directed challenge volume. Reviewed exploits, PoCs, reproducers, and writeups.
Feedback loop Mostly one-way. Mostly self-serve unless you find help yourself. Direct comments on your code, primitives, and dead ends.
Difficulty control Flat curriculum or playlist order. You choose, which often means bad sequencing. Track placement plus structured progression.
Why pay Library access. Breadth and box count. Reviewed work and deliberate practice design.
Pricing

A small founding cohort with a clear application path.

The founding cohort is capped because review quality matters. Seats stay limited so members actually get thoughtful feedback on their work.

  • Submit a free application through secure Polar checkout.
  • Applications are reviewed against your background, current track, and mentor capacity.
  • Accepted applicants receive a separate invite to join at $25/month. First invites go out in August 2026, immediately after DEF CON 34, with founding pricing reserved for the first 10 accepted members.

Why paid

Reviews are the product

The cohort is paid because feedback, progression, and challenge sequencing are manual work.

Why paid

Scarcity is operational, not cosmetic

Seat caps exist so review quality does not collapse under too many simultaneous submissions.

Why paid

Access is staged on purpose

Small invite batches keep the cohort useful while new tracks and review workflows open carefully.

Founding cohort Final 10 seats
$25 /month
Invite Season August 2026
Review Cadence Reviewed weekly
  • Curated access to every track released during the founding cohort window.
  • Manual exploit or reproducer review on each submitted artifact.
  • Feedback on primitives, dead ends, and reliability mistakes.
  • Private builder community and cohort debriefs.
  • Founding pricing locked for the first 10 accepted members.
See pricing and how it works Apply now

FAQ

Common questions before you apply.

Open full FAQ

fit

Who is this actually for?

+

Hackers School is for motivated builders with C or Python basics who want serious low-level security reps. The ideal member can give 5 to 10 hours each week to solving, writing, and iterating.

fit

Is this for total beginners?

+

No. Foundations is the shallowest track, but it still assumes you can already write small scripts and work comfortably in Linux.

process

What do I do every week?

+

You warm up on a smaller systems challenge, work one serious lab, submit a PoC or exploit artifact, and get annotated feedback before the next level unlocks.

process

How do application and admission work?

+

Applications run through a free Polar checkout. Fit and track placement are reviewed weekly, and accepted builders receive a separate $25/month cohort invite. First invites go out in August 2026, just after DEF CON 34, inside the 10-seat founding cohort.

Apply before the first 10 seats fill.

This is for builders who want serious low-level practice and direct feedback. First invites go out in August 2026.