Salvador Mendoza · Security research training
Learn security from real transactions and real systems
The payment systems course is the training I teach at Black Hat USA, extended with the material that did not fit in the room. It is built on real transactions, captured from real cards and sanitized so they can be published. More courses are being written.
The courses
Each one is written for the same reader: someone who knows security and wants to know this field at the level where new findings are made. Each runs through the same four levels, and each opens for enrollment when its first module is written and can be read free. One payment buys a course for life, with every update and new research module that follows.
Open for enrollment
Payment Systems: Magstripe, Tokenization, NFC and EMV
The 16-hour course taught at Black Hat USA, extended to cover what changed since.
22 modules · 31 hours
See the syllabus →In preparation
AI for Security Automation
Building and attacking LLM systems, from someone who runs them in production.
8 modules · 15 hours
What the payment systems course contains
- Modules written
- 22
- Hours, as taught
- 31
- Diagrams
- 187
- Graded exercises
- 54
- Cited sources
- 32
What one payment crosses
A single tap runs through four technologies. Each has its own failure modes, and each still carries the one before it. That accumulation is where most of the interesting work is, and it is what the payment systems course is organized around.
01
The magnetic stripe
Seventy-year-old plaintext, unsigned and trivially copied. It is still encoded on most cards, and still carried inside the chip as track 2 equivalent data. "We moved to chip" did not delete the stripe. It duplicated it.
02
The chip
Contact EMV: command APDUs, a certificate chain rooted in a key the terminal already holds, and an application cryptogram only the issuer can check. Most of what a terminal decides, it decides alone.
03
Contactless
NFC, competing kernels that read the same tag differently, and the qualifier bytes that settle whether a reader ever asks for a PIN. Two of those bits are attacker-reachable in published work.
04
Tokens and newer rails
Wallets, network tokens that are real card numbers by another name, phones acting as terminals, and account-to-account payments where the cryptography holds and the fraud moved above it.
Four levels, one path
Every course runs through the same four levels. Each level has its own entry assumption and its own exit test.
Level 1
Foundations
“I know security. I don't know payments.”
Level 2
Practitioner
“I can read a trace. Now interpret it.”
Level 3
Operator
“Show me the attack, end to end.”
Level 4
Researcher
“I want to find something new.”
Open to everyone
Four things on this site need no account and no purchase. They are how most researchers arrive, and they are the fastest way to judge a course before paying for it.
APDU workbench
Step through a real transaction one command at a time, every field named and every status word explained.
APDU decoder
Paste your own APDU or hex dump and read it. It runs in your browser, and nothing you paste is uploaded.
Capture corpus
The sanitized captures everything here is built on, from real cards and real terminals.
Setup guides
Which reader to buy, how to get a first read from a card, and what to do with a capture.
Open for enrollment
Payment Systems: Magstripe, Tokenization, NFC and EMV
22 modules · 31 hours · four levels
Every module is built on captured traffic from real cards and real terminals, sanitized before it was ever stored. Most of the course is text and graded exercises you can practice against those captures. You read the actual bytes, decode them in the workbench beside the text, and where a step can be reproduced on real hardware, the module tells you which tool does it and how, so you can extract, emulate or replay it yourself on a card you own.
- One payment, one course
- The price buys this course, not a subscription. There is nothing to renew and nothing to cancel.
- Access for life
- Every module, capture, exercise and lab in the course stays open to you for as long as the course exists.
- Updates and new research included
- When a module is revised or a new research strand lands in this course, it is yours at no further cost. The price you paid is the last one you pay for it.
Where to start
New to payment security
Begin with the setup guides: getting a reader working, sending a first APDU, and what to do with a capture of a real card. Then read module 1, which is free and opens on a device you can build for the price of lunch. No hardware is needed for the first several modules.
Read the guides →Already working in this field
Start at the references and pick the paper you have not read. Then go straight to the module that walks it at protocol level: the exact bits, the status words, the setups, and what each group could and could not ground. The workbench and the corpus need no account.
See the references →About this data
These captures were recorded from real cards and then sanitized. Card numbers sit on published test ranges, track data was rebuilt to match, and certificates were replaced. No live cardholder data is served here.