Skip to content
Exploit Labs
SJD-100 · OSCC-SJD · Build · Foundational

SJD-100: Secure Java Development Essentials - on the way to OSCC-SJD.

SJD-100 covers secure Java development from a developer's perspective: ten modules and roughly 41 hours on input validation, output encoding, cookie and session security, logging and error handling, misconfiguration and secure database access, each with hands-on labs. Not an attack course.

OSCC-SJD certification badge by OffSec
See licences & pricingAsk for guidanceOfficial OffSec course pageOne-pager (PDF)
Certification
OSCC-SJD - OffSec CyberCore Certified - Secure Java Development
Level
Foundational
Discipline
Build
Audience
For security teams

Who this course is for

Java development teams and security champions expected to avoid vulnerabilities rather than pay for them later in a pentest.

Not the right course yet if

  • -Your stack is not Java
  • -You want to attack rather than build securely - go to WEB-200
What you can do afterwards
  • →Spot and replace insecure patterns in your own code
  • →Apply safe defaults for validation, auth and crypto
  • →Understand and fix pentest findings on their merits
Prerequisites
  • ·Practical Java development experience

Not sure whether you meet them? We run a short placement conversation before you buy.

Course content (official scope)

What SJD-100 covers.

  • Injection and input validation
  • Output encoding against XSS
  • Cookie and web session security

Course content, labs and the OSCC-SJD exam are provided by OffSec. Precedence always sits with the official course description. This page reviewed: 2026-08-12.

Labs and format

Course modules with code exercises and guided fixes on vulnerable Java applications.

Exam and credential

Six-hour proctored practical exam: find and fix five vulnerabilities without breaking core functionality, roughly one hour each. No report, results immediately after submission. Passing awards the OSCC-SJD certification, valid for three years.

Buy a licence

The packages that include SJD-100.

Prices in EUR, net, plus statutory VAT. Invoiced through a German entity. Your course is pre-selected at checkout.

CyberCore
€800

Entry route without prior experience.

  • ▸ 365 days of access to the 100-level courses
  • ▸ 2 exam attempts
  • ▸ Proving Grounds Play
Learn Enterprise
€5,500/ seat / year

Several people in a team, with evidenced progression.

  • ▸ The full OffSec catalogue
  • ▸ Learning paths and reporting
  • ▸ Reassignable from 5 seats
Request a team quote
What Exploit Labs adds
  • +A code review session on your own repository
  • +A link back to the findings from your last application pentest

For security teams

Multiple people, role paths, reporting and procurement run through OffSec Learn Enterprise.

See Learn Enterprise

Team capability development

Badges, learning paths and evidence across attack, defend, build and govern.

See the capability map
Where it leads next

Other hackers also bought ... ;)

WEB-200 · OSWA
Foundational Web Application Assessments

People entering application security, developers with a security remit, and testers who want a structured route into web attacks.

Frequently asked

Not sure whether SJD-100 is the right course?

We run a short placement conversation: background, study time, goal. Then we recommend a course and package - even when it is the cheaper one.

Request a placement call Compare all courses
Other OffSec courses
SEC-100 · OSCC-SECPEN-103 · KLCPPEN-200 · OSCPPEN-210 · OSWPWEB-200 · OSWASOC-200 · OSDAIR-200 · OSIRTH-200 · OSTHPEN-300 · OSEPWEB-300 · OSWEEXP-301 · OSEDEXP-401 · OSEEAI-300 · OSAITraining overview