In short 1. Demo the attack 2. Discuss the code 3. Wash, rinse and repeat.
An open mind and a sense of humour.