This training serves as a comprehensive, hands-on introduction into Linux kernel exploitation. Built for technical professionals transitioning from user space to kernel space, the course focuses on demystifying low-level system internals, CPU execution modes, and foundational kernel exploitation concepts.
The course delivers an advanced deep dive into the underlying architecture required to understand kernel space:
- Hardware & Memory Architecture: Master low-level concepts including segmentation, paging, CPU privilege rings, and memory translation.
- Kernel Internals & Execution: Understand process address spaces, system calls, and core kernel data structures.
- Foundational Exploitation: Learn how kernel vulnerabilities occur and how to control basic execution flow using a custom-built, vulnerable kernel module.
- Primitive Mechanics: Understand the fundamental theory behind arbitrary read, write, and execution primitives in a clean, controlled environment.
- Kernel Defenses: Analyze modern kernel mitigations—including SMEP, SMAP, and KASLR—and the general strategies used to bypass them.
Our Methodology
We focus on teaching deep fundamentals clearly. By using a specialized kernel module rather than complex, real-world memory allocators, we eliminate setup friction so you can focus entirely on understanding computer architecture fundamentals, modern Linux kernel implementation and features, and generic exploitation techniques used in real-world exploits.
Our training also features discussions on the history of vulnerability research, real-world exploits developed by our team—including the unique techniques, tricks, and challenges we encountered—along with key contributions from renowned researchers in the field.
Dates
September 6 – 30, 2027
Modality
Online
Duration
48 hours (12 sessions)
Schedule
Classes will be held on Mondays, Wednesdays, and Thursdays from 7:00 PM to 11:00 PM (GMT-3). All sessions are conducted live and recorded. Class recordings are usually made available within 24 hours.
Capacity
10
Seats Available
10
Language
English
Architecture
x86 and AMD64
Materials provided
- Presentation Slides: Comprehensive deck covering detailed explanations and technical references across all training modules.
- Complementary Material (PDF): Supplementary reading materials designed to reinforce core fundamentals and bridge foundational gaps.
- Pre-Configured Virtual Machine: Fully configured lab VM ready for immediate vulnerability research and exploit development.
- On-Demand Class Recordings: High-definition recordings of every live session, made available within 24 hours.
- Certificate of Completion: An official verifiable certificate validating your completion of 48 hours of advanced training.
Training Environment
- Supported OS: Linux (Recommended), macOS, or Windows.
- Minimum Specs: 16 GB RAM, 100 GB free disk space, and reliable high-speed internet.
Prerequisites & Requirements
- Linux Proficiency: Comfortable operating, building, and navigating Linux systems via CLI.
- Low-Level Programming: Basic knowledge of C and Assembly (x86 / AMD64).
- OS Internals: Basic understanding of operating system concepts, computer architectures, and memory management (heap/stack structures).
- Debugging Tools: Experience analyzing binaries with tools like GDB.
The training is tailored to match the class’s overall background and experience. This is your chance to expand your knowledge and take your career to the next level.
Target Audience
- Security Researchers & Engineers: Vulnerability researchers, exploit developers, reverse engineers, and malware analysts looking to extend their skill set into the kernel realm.
- Offensive Security Practitioners: Senior red teamers, penetration testers, and threat hunters needing a deep understanding of low-level OS internals and bypass techniques.
- Specialized Investigators: Digital forensics and incident response (DFIR) specialists, government/defense contractors, and law enforcement cyber-crime agents analyzing low-level threats.
- Systems & Embedded Developers: Operating system developers, kernel engineers, firmware engineers, and embedded system developers seeking to build more secure code and understand offensive attack vectors.
- Advanced Computer Science Students: Graduate or final-year students specializing in systems programming, OS architecture, or offensive cybersecurity with strong C/Assembly fundamentals.
Why Join This Training?
- Master Cutting-Edge Techniques: Learn up-to-date exploitation techniques covering modern Linux kernel vulnerabilities, computer architecture, and mitigation bypasses.
- 100% Practical & Lab-Driven: Spend your time building functional exploits and diving deep into a modern version of the Linux kernel.
- Learn from Active Industry Researchers: Gain direct insights, methodology, and tricks of the trade from instructors actively discovering zero-days in production kernels.
- Complex Concepts, Demystified: Digest deep low-level topics (architecture, memory management, root-cause analysis) through structured, clear, and jargon-free instruction.
- 6 Months of Extended Post-Course Support: Get your questions answered as you review recordings, complete labs, or apply techniques in your career long after the class ends.
- Exclusive Mailing List: Join a private discussion group with instructors and fellow researchers to collaborate, share research, and network.
Syllabus*
- Module 01 – Computer Architecture & Hardware Fundamentals
- Brief history of the x86 architecture
- Segmentation and Paging
- AMD64
- Module 02 – Research & Lab Environment Setup
- Linux and its ecosystem
- Obtaining kernel source code and binary with symbols
- Linux kernel building
- Module 03 – Kernel Debugging
- Setting up kernel debugging with VMware
- Linux kernel debugging python script
- Crash utility
- Automating GDB with gdbscript and Python
- Module 04 – Linux Kernel Subsystems & Internals
- Virtual memory map
- Physmap, struct page, and per-CPU variables
- Execution context
- System calls
- Subsystems
- Core kernel structures
- Kernel API
- Module 05 – Kernel Vulnerability Exploitation & Primitives
- Introduction to Vulnerable Modules (NULL ptr deref and Use-After-Free)
- Arbitrary read
- Arbitrary write
- Arbitrary execution
- Module 06 – Security Mitigations & Bypass Techniques
- Return-Oriented Programming (ROP)
- Supervisor Mode Execution Prevention (SMEP)
- Supervisor Mode Access Prevention (SMAP)
- Kernel Address Space Layout Randomization (KASLR)
- Module 07 – Modern Trends, Zero-Day Research & Conclusion
* Syllabus subject to minor updates without prior notice.
By the end of this training, you will be able to:
- Identify and exploit vulnerabilities in the Linux kernel and custom modules.
- Perform root cause analysis and evaluate vulnerabilities based on impact and criticality.
- Develop custom proofs of concept (PoCs) and functional kernel exploits.
- Identify, analyze, and bypass modern kernel security mitigations.
Investment
All prices are in USD ($). Seats are strictly allocated on a first-come, first-served basis.
| Tier | Price | Deadline / Availability |
| Super Early Bird | $1,500.00 | Until Dec 31, 2026 (4 seats left) |
| First Batch | $2,000.00 | Until Mar 31, 2027 |
| Second Batch | $2,250.00 | Until Jun 30, 2027 |
| Third Batch | $2,500.00 | Until Aug 31, 2027 |
If paying via Wise, please email your transfer receipt to info@allelesecurity.com so we can manually confirm your seat.
Need a corporate invoice before paying? Contact us.
Instructor
Anderson Nascimento
Director and Principal Security Researcher at Allele Security Intelligence. As a professional researcher, he has over 15 years of experience delivering high-level research to international clients and companies. He has authored and publicly released proofs of concept for identified vulnerabilities in the Linux and FreeBSD kernels. He possesses strong expertise in x86 and AMD64 computer architectures, operating systems, and particularly Linux kernel attack and defense.
Visit our research page and GitHub to check out some of our published work.