ITX8063 2012

Course Description

• Schedule
  • The course will be conducted on the second half of Autumn semester of 2012/2013
  • First will be held on 30th of October in room TBC

• EAP: 3.00

• Course Objectives and Organization
  • Main objective is to give a good technical overview of different attack methods and vulnerabilities the attackers are exploiting to compromise IT systems. Malware in general is out of the scope as this topic will be covered in detail in specific course.
  • We will not use strong academic approach. Rather, we will focus on the current problems and practical issues of IT security.
  • There will a lot of hands-on work on lab systems
  • The labs are mainly built around Capture The Flag Exercises
    1. We set up purposely vulnerable systems
    2. Student's job is to identify vulnerabilities, gain access somehow and find the flag from the systems
    3. First one gets the most points

• Instructors
  • Course coordinator: Kaur Kasak, kaur.kasak(at)gmail.com, +372 52 17 946
  • There will be several instructors for this course: TBC
  • Our aim is get presentations from persons who have strong real-world experience

• Prerequisites
  • Experience in administrating Linux and Windows based systems. For lab-work, BackTrack5 based virtual machines
  • Understanding of main networking protocols (IP, TCP, UDP, ICMP, ARP, DNS, HTTP)
  • Some experience with web technologies and relational databases (HTML, PHP, MySQL, Javascript)
  • Programming skills in any standard high-level language

• General List of Topics
  • TBC

Communication

• Course coordinator contacts: Kaur Kasak, kaur.kasak (at) gmail.com, +372 52 17 946, skype: kaur.kasak
• E-mail list
  • ?

Schedule

• Starting from the second half of the semester
• Tuesdays, 17:45-21:00, III-310, IT-213A, IT-213B
• NB! Check the exact location for every single lecture/lab!

30.10 I

4*45 min

• Introduction. Demos (Mehis Hakkaja)
• III-310

04.12 VI

• Web-App Security I

11.12 VII

• Web-App Security II

18.12 VIII

• Web-App Security III

• 1. Web Application Security I (Jaanus, Elar, Mait)
     • Introduction to web application technologies
     • Web Application Pen-Testing Tools
     • Web Application Mapping and Reconnaissance
     • Authentication and Authorization
     • Session Management

• 1. Web Application Security II (Jaanus, Elar, Mait)
     • Injection (code, OS command, SQL, log injection)
     • Direct Object Reference
     • XSS
     • CSRF

• 1. Web Application Security III (Jaanus, Elar, Mait)
     • Special Functionalities (password recovery, default pwd generation).
     • Business Logic Flaws
     • Resource Intensive Queries
     • Error Handling and Logging
     • Rich Internet Applications (Flash, Silverlight,...)

Grade assignment

• Practical tasks and lab report (scoreboard results and notes about solving the tasks): TBC
  • Max TBC p for Accomplished Tasks
  • Max TBC p for Lab Report
• Written exam (closed-book) TBC p
• Bonus
  • Capture the Flag Exercises:
  • Practical Homework (web exploit analysis): TBC p

Exam and Results

Results

• Results