WorkbenchStep through a real transaction, one command at a time
DecoderPaste your own APDU or hex dump and read it
Transaction labSecurity status not satisfiedWith the courseDrive a transaction and change it as it moves

Study planWhat you can do with the hardware you have
GuidesWhich device to buy, and getting a first read
ReferencesEvery paper, standard and talk the course cites
Practice VMThe image the practice machine runs on, and its checksum
ResearchSecurity status not satisfiedWith the courseWork that is not in the course yet

CoursesEvery course by level, from the first module to open research

Tools

WorkbenchStep through a real transaction, one command at a time
DecoderPaste your own APDU or hex dump and read it
Transaction labSecurity status not satisfiedWith the courseDrive a transaction and change it as it moves

Resources

Study planWhat you can do with the hardware you have
GuidesWhich device to buy, and getting a first read
ReferencesEvery paper, standard and talk the course cites
Practice VMThe image the practice machine runs on, and its checksum
ResearchSecurity status not satisfiedWith the courseWork that is not in the course yet

For teams and organizations

Training for your team, or an assessment

I teach the payment systems course in person for groups, wherever your team is, and I can bring the hardware. I also test payment systems. Tell me what you need and I will reply by email.

In-person training
The course from this site, taught live to your group, or a version built around what your team works on. The readers, cards and tools can come with me.
Security assessment
A hands-on test of a payment system: ATMs, POS and mPOS terminals, SoftPOS and Tap to Phone, cards, wallets and payment apps, and the backend they talk to.

Leave this field empty

What do you need?

Training for a groupIn person or private, for a team.A security assessmentA penetration test of a payment system.Something elseAnything that fits neither.

CourseNumber of peopleI need you to provide the hardware

What is to be tested?

ATMPOS terminalmPOSSoftPOS or Tap to PhonePayment cards (EMV, contactless)Wallet or payment appPayment backend or HSMSomething else

Your nameOrganizationEmailPhone (optional)CountryCity (optional)Preferred dates (optional)Language

DetailsFor example: the payment systems course in Lima, Peru, for 10 people, in March. Anything about your team's background helps.

What you send is stored so I can answer it, and removed after two years. It is not added to any mailing list.

Prefer email? Write to sal@salmg.net

SMAcademy

Security research training, starting with payment systems.

Salvador Mendoza · salmg.net

Course

Payment systems syllabus
All courses
Training for your team
Research

Tools

Workbench
Decoder
Transaction lab

Resources

Study plan
Guides
References
Practice VM

Partnerships

Mente Labsemail notifications
Atlas Latino

Elsewhere

LinkedInsalmg
Substacknfced
Instagramnfced
X@netxing

Teaching material for security research, starting with payment systems. Every capture published here was sanitized before it was stored. Test only what you own or hold written authorization to test. In most jurisdictions, using a payment credential you are not entitled to use is a criminal offense whatever your intent.

Terms of use
Privacy
Email: sal@salmg.net

In-person training

Security assessment