The lab offers practical exercises and follow-up materials to complement the topics presented during the Introduction to Security [184.783] course.

The aim is to provide hands-on experience in the sort of attacks and protections found in the real world. More specifically, students will be given access to a safe environment where to interact with realistic applications containing ad-hoc vulnerabilities. They will learn how to discover and take advantage of the identified threats from an attacker's standpoint and how to avoid common pitfalls during the development process.

System Security

• Buffer/stack overflow
• Circumventing overflow mitigation techniques
• Return-oriented programming (ROP)

Web Security

• SQL injections
• Blind SQL injections
• Cross-site scripting and mitigation bypass
• Cross-site request forgery

Cryptography

• Classic ciphers
• Security of RSA
• Exploitation of insecure cryptographic constructions

Practical projects mostly focused on implementing attacks introduced during the course.

ECTS Breakdown

• 8h lecture
• 67h self-study and projects development