SEC543: AI-Assisted Source Code Analysis and Exploitation for Penetration Testers

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in the hands-on labs. Please arrive with a system meeting all of the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive or critical data. SANS is not responsible for your system or data.

Mandatory System Hardware Requirements

• CPU: 64-bit processor with at least 4 cores. 8 or more cores is recommended.
• RAM: 8 GB minimum. 16 GB or more is recommended so Docker Desktop, your host operating system, and the course containers all run comfortably.
• Storage: 20 GB of free storage minimum. 40 GB or more is recommended.
• Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.

Mandatory Host Configuration and Software Requirements

• Your host operating system must be the latest version of Windows 10, Windows 11, macOS 12 or newer, or a supported x86_64 Linux distribution.
• Fully update your host operating system before class to ensure you have the right drivers and patches installed.
• Install Docker Desktop before class on Windows or macOS. Linux hosts must have a current Docker Engine installation with the Docker Compose plugin.
• Supported Linux classroom hosts are x86_64 Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Debian 12, Kali Rolling, Fedora 43, openSUSE Tumbleweed, Arch Linux, and AlmaLinux 9. Other Linux distributions will likely work, but they are outside the officially supported Linux platforms for this course.
• Apple Silicon Macs are supported, but Rosetta 2 must be installed because the SQL Server container runs as linux/amd64.
• Local Administrator access is required.
• You must be able to disable or adjust endpoint protection if it interferes with Docker networking, bind mounts, or localhost access.
• You must be able to allow outbound HTTPS and localhost port bindings through any host firewall.
• Internet access is required for all labs. The course uses AI model APIs accessed through an instructor-hosted LiteLLM proxy. Corporate proxies that perform TLS inspection may interfere with API authentication, so students may need an exception or a direct connection.
• The course environment uses localhost ports 5106, 5200, and 1433. Make sure those ports are available on your host.

Your course media is delivered by download. The media files for class can be large. Start your course media downloads as soon as you receive the link. You will need the course files immediately on the first day of class.

Your course materials include setup instructions that detail the Docker-based workflow you must complete before class.

Your class uses an electronic workbook for its lab instructions. A second monitor or tablet can be useful for keeping class materials visible while you work on labs.

If you have questions about the laptop specifications, please contact customer service.

• Penetration testers looking to add AI-augmented source code analysis to their methodology
• Red team operators who want to accelerate vulnerability discovery and custom tool development
• Security researchers exploring AI-assisted vulnerability research and bug hunting
• Application security professionals who perform code review or security assessments
• Security consultants and engineers responsible for assessing application security posture

• Printed and digital courseware covering all modules and labs
• Electronic workbook with 10 hands-on labs
• Downloadable course media with the SEC543 launcher, lab assets, and setup instructions
• A Docker-based lab environment that runs locally on your own machine
• Access to the OverflowStock target application for continued practice after the course
• Reusable prompt templates and constraint frameworks for AI-augmented pen tests
• The complete Just-in-Time Toolsmith methodology workflow

• Familiarity with penetration testing concepts and methodology
• Basic understanding of web application architecture (HTTP, APIs, authentication)
• Comfort with command-line interfaces
• Programming experience is not required for this course; the AI handles code comprehension and generation.
• Not a requirement, but this cheat sheet is available as an extra supplemental material for the course.

SEC543 is part of the SANS Offensive Operations learning path, designed to equip penetration testers and red team professionals with modern, AI-augmented techniques for vulnerability discovery and exploitation.

The Offensive Ops learning path develops deep technical expertise in areas such as penetration testing, exploit development, red team operations, and advanced attack techniques. Students progress from foundational offensive security concepts to sophisticated tradecraft used in real-world adversary simulations.

Depending on your current role or future goals, the following courses are natural complements to SEC543 within the Offensive Operations:

• SEC535: Offensive AI – Attack Tools and Techniques – Explore how artificial intelligence is transforming offensive capabilities and adversary tradecraft.
• SEC542: Web App Penetration Testing and Ethical Hacking – Develop expertise in identifying and exploiting web application vulnerabilities.
• SEC560: Enterprise Penetration Testing – Build strong foundational skills in enterprise-level network and infrastructure testing.
• SEC565: Red Team Operations and Adversary Emulation – Learn to simulate real-world adversaries and execute full-scope red team engagements.
• SEC660: Advanced Penetration Testing, Exploit Writing, and Ethical Hacking – Advance into custom exploit development and sophisticated offensive techniques.
• SEC665: Advanced Red Team Operations – Master disciplined operational tradecraft in hardened enterprise and government environments.

AI-assisted penetration testing uses large language models and AI coding agents to augment human security expertise. Rather than replacing pen testers, AI serves as a force multiplier by handling the time-consuming work of reading unfamiliar code, identifying patterns across large codebases, and generating custom tools, while the human operator provides security intuition, directs the analysis, and verifies results. This approach matters because modern applications increasingly rely on complex business logic that automated vulnerability scanners cannot evaluate. Logic flaws, broken access controls, and subtle authorization failures require the kind of semantic understanding that AI models can provide when properly directed. SEC543 teaches the methodology for doing this effectively and safely.

AI is rapidly transforming penetration testing. Security professionals who can effectively direct AI coding agents for source code analysis will find more vulnerabilities, deliver higher-quality assessments, and work more efficiently than those relying solely on traditional tools. SEC543 gives you a repeatable, immediately applicable methodology that differentiates your skillset in a competitive market, whether you work as an in-house pen tester, a security consultant, or an independent researcher.