Private corporate batches, live online cohorts and 1-on-1 mentoring in high-speed crawling and dictionary-driven reconnaissance of web applications you are responsible for — taught by a practitioner who runs it in production.
20 years across DevOps, SRE and Security · 10,000+ engineers trained · Trained teams at JPMorgan Chase, Verizon, Nokia and the World Bank
Principal DevOps Engineer & Architect
Rajesh teaches Skipfish as a defensive attack-surface discovery tool for estates you own, starting with authorisation and scope before a single request is sent. Sessions cover building it from source, dictionary strategy and the wordlist decisions that determine whether the brute-force phase finds real content or wastes a night, crawl scope with include and exclude rules, request-rate and connection limits that keep a fragile environment alive, authenticated crawling and form handling, and manual verification of every finding before it becomes a ticket. The tool's unmaintained status and its blind spots — JavaScript, single-page applications, token-based flows, modern API schemas — are stated plainly and used to position it correctly inside a maintained toolchain.
Twenty years across DevOps, SRE and Security, in principal and architect roles at PayPay, SoftwareAG, ServiceNow, JDA Software, Intuit, Adobe and others. He has trained engineers at JPMorgan Chase, Verizon, Nokia, the World Bank, VMware, Oracle, Mercedes-Benz and Airbus — more than 10,000 people personally. He teaches what he runs, not what he reads.
You are booked with a named engineer, and that is who turns up. Marketplaces and larger providers rotate whoever is free, so the person who sold you the agenda is rarely the person teaching it.
The same trainer is available for the next engagement, which matters when a team builds on what it learned last time.
Your batch is assigned a named trainer before it starts, and that is who teaches it. See the full faculty.
Engagements are matched on the tool, not the calendar. For Skipfish that means a trainer who has run it in production — high-speed crawling and dictionary-driven reconnaissance of web applications you are responsible for — rather than whoever is free that week. You are told who is teaching before you commit, and that person is on the discovery call that shapes the agenda.
Where a batch is large enough to need a second trainer, the pairing is declared up front. The lead trainer stays accountable for the syllabus and the assessment either way.
Principal DevOps Engineer & Architect
Twenty years across DevOps, SRE and Security in principal and architect roles at PayPay, SoftwareAG, ServiceNow, JDA Software, Intuit, Adobe, IBM/Emptoris, Ness, MindTree and Accenture. He has trained more than 10,000 engineers personally, at organisations including JPMorgan Chase, Verizon, Nokia, the World Bank, VMware, Oracle, Mercedes-Benz and Airbus. He teaches what he runs, not what he reads.
Teams of 8–30
Custom agenda, your timezone, onsite or online, NDA-friendly.
Request a quoteIndividual engineers
A private instructor and a curriculum built around your goal.
₹99,999Individuals who want peers
Scheduled batch, max 8 to 10 hours of live instruction.
₹34,999A private batch starts with a discovery call. We look at the stack you actually run — the CI system, the cloud, the constraints — and map the agenda onto it, so examples use your topology rather than a generic one.
Delivery is onsite at your premises, live online, or hybrid, scheduled around your release calendar rather than ours. Batches run 8 to 30 engineers.
Every attendee leaves with recordings, slides, lab repositories and a completion certificate. You receive an attendance and assessment report. Invoicing supports PO and GST.
Talk to us about a private Skipfish batchSkipfish is an active web application reconnaissance tool. Written in C for throughput, it crawls a target recursively, follows links and forms, and combines that crawl with dictionary-driven probing of paths, filenames and extensions to build an interactive sitemap of everything the application exposes. On top of that map it runs a set of security checks — injection probing, directory traversal and file disclosure attempts, differential comparisons that detect when a response changed in a way it should not have — and produces an HTML report grouped by severity.
Two design decisions define it. The first is speed: Skipfish is engineered to sustain very high request rates against a target on a fast link, which makes it practical to enumerate a large application quickly, and equally makes it capable of overwhelming a service that was never load tested. The second is its differential approach. Rather than relying only on fixed signatures, it compares responses across crafted variations to infer behaviour, which reduces some categories of false positive that pattern-matching scanners produce.
It is important to be honest about the tool's status. Skipfish has not seen active upstream development for a long time; its check set predates most modern application architectures, it does not execute JavaScript, and it has no understanding of single-page applications, token-based authentication flows or API schemas. It remains useful for exactly one thing done very well — fast, thorough content and attack-surface discovery against your own estate — and it belongs in front of a maintained dynamic scanner and manual testing rather than in place of them.
Attack surface discovery has become the harder half of application security. Organisations no longer have one application on one host; they have dozens of services, forgotten staging deployments, legacy admin panels behind a load balancer, backup files left in a webroot, and directories that exist because a deployment script once created them. Nobody has a complete inventory, and the exposures that appear in incident reports are consistently things nobody knew were reachable.
Fast enumeration answers that question directly. Being able to point a crawler at a hostname and receive a structured map of every path, parameter and form it can reach — including the ones no link points to — is a defensive capability, and it is one an internal team can run against itself far more often than it can commission a penetration test.
The skill is not in typing the command. It is in scoping so a scan cannot leave the systems you own, choosing and managing dictionaries so the brute-force phase finds real content instead of running for three days, controlling request rate so a production-adjacent environment survives, keeping the crawler out of destructive endpoints, verifying every finding by hand before it becomes a ticket, and knowing precisely which classes of vulnerability the tool cannot see so nobody mistakes a clean report for a secure application.
The framing before the tool. What a web application actually exposes, why unknown content is the recurring root cause in incident reports, how an active reconnaissance scanner differs from a passive one or a full dynamic scanner, and the authorisation and scope discipline that must exist before any request is sent.
Topics: Attack surface: paths, parameters, forms, headers and forgotten content · Passive discovery, active crawling and dictionary brute forcing compared · How a differential security check works and what it avoids · Skipfish against maintained scanners: honest strengths and blind spots · What it cannot see: JavaScript routing, single-page applications, token flows, API schemas · The unmaintained upstream and what that means for check currency · Authorisation, written scope and rules of engagement · Scanning only systems you own or are contracted to test
Getting a working installation and a report you understand. Compiling from source with its dependencies, running a first scan against a deliberately vulnerable target you deployed, and walking the interactive sitemap and severity groupings line by line before scanning anything larger.
Topics: Building from source: dependencies, libidn and common compile failures · Running in a container for repeatability · Output directory conventions and rerun behaviour · A first scan against a target you deployed yourself · The interactive sitemap: nodes, discovered content and parameters · Severity groupings: high, medium, low, informational and internal warnings · Reading the crawl statistics: requests, coverage, duration · Explaining every reported issue rather than accepting the label
The decision that determines whether a scan is useful or a waste of a night. How the bundled wordlists differ, read-only versus learning dictionaries, extension handling, keyword auto-learning, and building an organisation-specific wordlist from your own naming conventions.
Topics: How the brute-force phase actually works · The bundled wordlists compared: minimal, medium, complete, extensions-only · Read-only versus read-write dictionaries and why the distinction exists · Supplementary wordlists and layering them · Extension lists and their multiplicative cost · Keyword auto-learning: when it helps and when it explodes the run time · Disabling directory brute forcing for a crawl-only pass · Building an internal wordlist from your own path and filename conventions · Estimating request count before starting a run
Keeping the scan inside the boundary and the target alive. Include and exclude rules, depth, child and descendant limits, request caps and duration limits, connection and rate controls, timeouts and failure thresholds — plus the endpoints that must never be crawled at all.
Topics: Include and exclude rules and enforcing scope technically · Crawl depth, maximum children and maximum descendants · Total request caps and wall-clock limits · Global connections, per-host connections and request rate · Timeouts, failure thresholds and giving up cleanly · Response size limits and skipping large binaries · Excluding destructive endpoints: logout, delete, purchase, send · Parameter handling and skipping fields that must not be fuzzed · Scanning a production-adjacent environment without causing an incident
Reaching the part of the application that matters, and using the scan defensively. Basic authentication and cookie-based sessions, avoiding the logout link that ends every run early, form auto-completion, custom headers and user agents — then deliberately using the scan to validate that your own WAF, rate limiting and alerting behave as claimed.
Topics: HTTP basic authentication and credential handling · Cookie-based session crawling and session lifetime · Keeping the crawler away from logout and session-invalidating routes · Form auto-completion and supplying sane field values · Host header, custom headers and user agent control · Browser behaviour profiles and their effect on crawling · Testing your own WAF and rate limiting deliberately · Coordinating with the team that owns detection and alerting · Recording evidence that a control detected or blocked the activity
Turning a report into decisions and fitting it into a maintained workflow. Manual verification, the false-positive patterns this class of tool produces, contextual severity, writing findings a developer can act on, and combining Skipfish discovery with maintained dynamic scanners, template-based scanners and manual testing.
Topics: Verifying a finding by hand before it becomes a ticket · Common false positives and why differential checks still produce them · Distinguishing information disclosure from exploitable exposure · Contextual severity: internet-facing versus internal, authenticated versus anonymous · Writing a finding a developer can reproduce without asking a question · Feeding discovered content into a maintained dynamic scanner · Combining with template-based scanning and manual testing · Comparing runs over time to surface newly exposed content · Scheduling reconnaissance as a recurring internal control with clear ownership
We rebuild the agenda around the tools you actually run.
Request a custom agendaStand up a deliberately vulnerable application, run a full Skipfish crawl against it and account for every entry in the resulting report.
Compare wordlist strategies on the same target, estimate request counts before running, and build an internal list from your own naming conventions.
Configure include and exclude rules, depth and descendant limits so the crawl provably stays inside an agreed host and path boundary.
Retune a scan that previously overwhelmed a target, using connection, rate and timeout controls, and prove response times stayed healthy.
Run an authenticated scan against your own protected environment and record which requests were blocked, which alerted and which passed silently.
Build a scheduled discovery control with scope proof, dictionary profile, verified findings, run-over-run diffing and named ownership per finding class.
Billed yearly at ₹9,996
Max 8 to 10 hours of live instruction
Full program, private instructor
8–30 engineers · custom agenda · onsite or online · PO and GST invoicing
Refunds. If we cancel or postpone a cohort, you get a full refund within 15 days. There is no money-back guarantee otherwise.
Terms. Course material remains licensed to the attendee. Read the terms.
Your data. We don't share it with third parties. Privacy policy.
Certificate of completion
Rajesh is a very good trainer I have experienced in DevSecOps training. The number of contents in different topics he has posted on the DevOpsSchool public website are amazing and user friendly for beginners and experienced professionals.
Great learning experience from a very knowledgeable instructor with well-prepared course notes. The lab exercises on AWS instance work well to learn the hands-on side of the course.
The trainer (Rajesh) provided very good sessions on SRE profession. Not only hands-on learning on the tools but also SRE mindset.
Very good training session. Well explained from the basics to the complex concepts. Also tried to cover practicals and demos within the 3 hour sessions. The learning content and videos are of a great deal of help.
Basics explanation was exemplary from Rajesh where he dealt with complicated topics to be simple. Great learning stuff personally for me.
Very detailed explanation and has lots of patience in attending the questionnaire. Thanks again for your wonderful sessions.
| What matters | YouTube + blogs | Generic online course | Freelance marketplace | DevOpsSchool |
|---|---|---|---|---|
| Named practitioner | No | Rarely | Varies per booking | Yes — same trainer each time |
| Production experience | Unknown | Unknown | Unverified | 20 years, named employers |
| Custom agenda | No | No | Sometimes | Built from your stack |
| Onsite delivery | No | No | Sometimes | Yes |
| Lab environment | None | Sandbox that expires | Varies | Your own cloud — skill goes with you |
| Assessment | None | Quiz | Rarely | Assignments + capstone per module |
| Per-attendee certificates | No | Sometimes | Rarely | Yes |
| Corporate invoicing | No | Limited | Varies | PO and GST |
| Post-training support | None | Forum, time-limited | None | Lifetime forum access |
Tell us the team, the stack and the timeline. You'll get a straight answer, not a sales sequence.
Talk to an advisorPrefer to call or email?
More ways to reach us on the contact page.