1. About The School

42 is a private, non-profit and tuition-free computer programming school network with 50+ campuses all over the world.

No diploma is required to enroll. There are no teachers, nor classes (which can be both a good and annoying thing, like when you lack computer networks theory and have to learn it by yourself), the curriculum is based on peer-to-peer learning and hands-on projects.

Below is the project graph.

• Mandatory assignments, also called “inner circle projects”, are represented by the light blue or grey dots you can see on the circles (you start from the center) and require to be done before given deadlines.
• The outer circle projects are optional and enable students to specialize.

Completed projects are displayed in light blue. Some of my mandatory projects are grey either because they were optional (sometimes you had to choose between two projects) or because the curriculum changed.

Student progress evaluation is based on a system of points and levels. On assignment completion, students earn XP points, like in video games. The highest level is 21, even though it is possible to go higher (a few people reached level 24 and beyond).

2. Top Projects

I joined this school (it was free, had to work part-time, no diploma required) knowing I would retrain in information security but wasn’t sure about which job to choose. There was only a few people interested in this career path (maybe this is the reason why I accepted to found a cybersecurity student club, but let’s keep this story for another time). Thus, it was difficult to get feedbacks or lessons learned from other students. The only advice I would get from guys was to “register on Root Me to learn web pentesting”. Years later, I would recommend Portswigger Web Academy instead to aspiring pentesters (and there many are other jobs in infosec besides pentesting).

CTFs helped me a lot figuring out what I liked doing and was naturally good at (best combo when you have to find a job quickly): OSINT. There was plenty of stuff I would have liked to learn but didn’t have time to.

The only cybersecurity-related projects at 42 exist in the curriculum outer circle. However, some mandatory projects are interesting too and can bring a lot of useful knowledge.

1. Inner Circle - Mandatory Projects

ft_transcendence

The last mandatory project. Once completed, students get the Transcender role, gain access to the outer circle, and can start specializing without stressing about deadlines.

At that time, this was the first web development assignment encountered by the students, and not an easy one! In groups of 5, we had to develop a web application in TypeScript with user accounts, instant chat rooms, a Pong game, and so forth.

Since 42 focuses on low-level (C and ASM programming), this was very disturbing at first. But knowing how to build a web application, and therefore how it works, is a very useful skill.

• Skills and knowledge: fullstack web development, web sockets, HTTP requests, SQL, team work.
• Was useful when: had to scrape websites and messaging applications, design an API, use databases, pentest web applications.

Minishell

One of my favorite projects: recode a minimal Bash.

Although not necessary to meet the assignment requirements, I wanted to implement the lexer, parser, and AST trio. This was the first opportunity to use a binary tree! Took me a whole month to understand how it works and how to write it, but this was worth it! I even wrote a debug mode that prints the tree nodes and saves them to a file.

When I started 42, learning programming was so hard. I struggled every day. When I completed Minishell, something changed, like, coding seemed easier, something unlocked. The end of my curriculum was smoother after that.

• Skills and knowledge: how Bash works, POSIX Shell, grammar, lexer, parser, AST, UNIX pipes and processes.
• Was useful when: had to write a parser at work, anytime there is data to parse.
• Repository: 🔗

ft_containers

This one was about recoding the C++98 containers: vector, stack, map, set.

Most people hated this project. It is long, challenging, and at the beginning, you understand nothing. You can’t even read the original C++ containers source code to get some help: it is way too complicated.

It took me three months to complete. Was almost kicked out of school because of the deadline but this is surprisingly one of my favorite projects. I liked researching and trying to understand how an obscure code works (remember being so happy when finding lost resources explaining the Containers behaviors).

This project makes you understand how data structures work!

• Skills and knowledge: C++, data structures, OOP, researching, tenacity.
• Was useful when: had to do research and write projects from scratch with almost no documentation available.
• Repository: 🔗
  (My red-black tree implementation is 1817 lines long! 🫠)

ft_services

This one is about creating and configuring a k8s cluster.

It was removed from the mandatory projects by the school pedagogy team right after I completed it because it was too difficult. What a luck I could do it because it taught me a lot. I could strenghten my Docker knowledge and discover Kubernetes.

• Skills and knowledge: Kubernetes, better understanding of the deployment cycle.
• Was useful when: had to deploy services at work or modify configuration files, could understand the DevOps team (they were surprised!).

2. Outer Circle - Specialization Projects

BADASS (BGP At Doors of Autonomous Systems is Simple)

This project requires to set up a small data center with iBGP using GNS3.

In order to meet the requirements, mastering the theory is mandatory. It takes weeks to understand how BGP works but it is very interesting. This is also the opportunity to practice some system administration commands and tasks.

• Skills and knowledge: network general knowledge, OSI model, BGP, Autonomous Systems.
• Was useful when: had to investigate infrastructures with CTI analysts, had to set IP addresses on devices manually.
• Repository: 🔗

ft_nm

The task is to recode the NM command that displays the symbols of an ELF binary.

Like BADASS, a lot of interesting theory (the ELF structure holds no secret anymore). Coding it is straightforward.

• Skills and knowledge: ELF format.
• Was useful when: started reverse engineering.

libasm

This project is about writing a bunch of libc functions in Assembly.

• Skills and knowledge: ASM, calling conventions and so forth.
• Was useful when: started reverse engineering.

KFS-1 (Kernel From Scratch part 1/10)

A very basic Linux-like Kernel From Scratch project.

Like BADASS and ft_nm, tons of theory. What is interesting here is to continue the KFS project suite as far as you can.

• Skills and knowledge: Linux-like kernel, bootloader, ASM.
• Was useful when: people tried to explain me things.
• Repository: 🔗

3. Graduates Strengths and Weaknesses

Useful skills acquired by 42 students at the end of the mandatory curriculum, if completed with rigor:

• Ability to start projects from scratch;
• Ability to code from loosely defined specs;
• Operational skills for development: know how to use Git (branches, issues, MR), team work, write documentation (at least a README), understand and can participate in application deployment and DevOps tasks, SSH;
• Know how to use Docker and Compose;
• Knowledge of data structures;
• Can create and use virtual machines;
• They read the manual (I remember we were told to rely on the documentation only instead of copy pasting code found online);
• They know how to exit Vim.

The most common weaknesses of 42 students:

• Lack theoretical foundation;
• Lack the ability to explain their choices (if it works, it works);
• Tend to rewrite everything from scratch;
• Despise high-level languages (do you really think writing your web scraper in C is a good idea?);
• Sometimes view technical choices solely from the perspective of which programming language to use.

4. What’s next?

Projects that look interesting:

• Tinky Winkey: Create a service that runs a key logger on Windows.
• Woody Woodpacker: Write a packer in C.
• Famine/Pestilence/War/Death: Write four metamorphic viruses.
• Matt Daemon: Write a server-type daemon.
• ft_shield: Create a daemon and your first basic trojan.
• KFS-2: Next step of the the Kernel From Scratch suite.