UMBRA Academy
Exploiting alone teaches half the lesson. At UMBRA Academy you exploit the flaw in a real, vulnerable application and then fix the code — with the fix graded by automated tests, in the language you use at work.
Exploit the flaw. Then fix the code.
Create an account, pick a plan and start with the simplest lab in the catalog. Each one takes under an hour. The platform is currently in Portuguese.
Four stages in every lab
Every flaw in the catalog goes through the same four stages, and the last one is the stage most training leaves out: actually fixing the code.
- Content — how the flaw works, explained from scratch, with OWASP and MITRE references and the tools of the trade.
- Warm-up quiz — five questions; get three right and the lab opens.
- Exploitation — an application that looks like a real system, in an isolated container of your own that starts in seconds and opens in the browser.
- Fix — you patch the code in the editor, and automated tests tell you whether the fix works, and whether it works in the right place.
The catalog
One lab for each flaw that shows up most often in penetration tests. The fix can be written in Python, JavaScript, PHP, Java or C#, and each language keeps its own score.
- SQL and command injection, XSS, XXE, SSTI and SSRF.
- Path traversal, file upload and caching.
- Access control, authentication and JWT.
- Business logic.
For companies
For development teams, security teams and the whole company. Access is licensed: the manager assigns seats, tracks who completed and has the report ready when the auditor asks.
Beyond the labs, UMBRA builds custom courses around what your team needs — your systems, tools and policies. They run on the same platform, with lessons, assessment, certificate and manager tracking.
What you receive
- Access to the lab catalog for the plan period, with new labs included at no extra cost.
- Code fixes graded instantly, in five languages.
- A certificate anyone can verify through a public link.
- For companies: a manager dashboard and a completion report exportable to CSV — who completed, who is pending and when each training expires.
Who it is for
- Developers who want to understand the flaws that show up in pentests and stop reintroducing them.
- AppSec teams that need practice in both exploitation and remediation, not just one of the two.
- Companies that need to demonstrate continuous secure development training for audit or compliance.
- Professionals who want to practice offensive security in legal, isolated environments.
Frequently asked
- Do I need to install anything?
- No. The lab runs on UMBRA servers and opens in the browser. Tools such as Burp Suite help, and the content shows how to use them, but they are optional.
- Is prior knowledge required?
- It helps to be able to read code in at least one language, since the fix asks you to change it. The content for each flaw explains the mechanism first, from scratch.
- How does payment work?
- Each plan is a one-time charge for the chosen period, paid by Pix, boleto or card, and it does not renew automatically. For companies, pricing depends on headcount and products, and we reply with a proposal.
Find out before they do.
Scoped in a week. NDA first. We reply within 24 business hours.
Request an engagement