Certified and Clueless · the DARE framework

Knowing a vulnerability is not the same as understanding it.

DARE is a training design constraint I built for the gap between the two. A learner deconstructs a system, attacks it, watches a patched version stop the same attack cold, then switches sides to see their own attack from the defender's screen. That last part is the one most training skips.

Deconstruct · Attack · Remediate · Exchange
session --live
How a session runs

Four stages, one loop, no shortcuts.

D

Deconstruct

Before anyone touches a keyboard, I make sure the learner can say, in plain language, what the system in front of them is doing. A whiteboard sketch, a live walk-through, whatever makes the shape of it visible. If the concept underneath the attack is not solid, nothing that follows will stick.

A

Attack

I demonstrate the attack once, narrating what I am doing and why. Then the learner runs it again on their own, same target. Then they run it on a target I have not shown them, different enough that copying my steps will not work. That third step is where I find out whether they understood stage one.

R

Remediate

The learner runs the exact same attack against a patched version of the same application, one change made and nothing else. When it fails, I say it out loud. Failure here means the application is doing its job, and a pentester who never fails isn't testing anything.

E

Exchange

This is the stage most people skip when they are short on time, and the one I refuse to cut. I hand the learner the logs their own attack generated and ask them to look before I explain anything. Most of them go quiet for a second. That's the moment the whole framework is built around.

For trainers running their own sessions

Everything I use to plan a DARE session, free to take.