ITX8063 2012

Course Description

• Schedule
  • The course will be conducted on the second half of Autumn semester of 2012/2013
  • First will be held on 30th of October in room III-310

• EAP: 3.00

• Course Objectives and Organization
  • Main objective is to give a good technical overview of different attack methods and vulnerabilities the attackers are exploiting to compromise IT systems. Malware in general is out of the scope as this topic will be covered in detail in specific course.
  • We will not use strong academic approach. Rather, we will focus on the current problems and practical issues of IT security.
  • There will a lot of hands-on work on lab systems
  • The labs are mainly built around Capture The Flag Exercises
    1. We set up purposely vulnerable systems
    2. Student's job is to identify vulnerabilities, gain access somehow and find the flag from the systems
    3. First ones get the most points

• Instructors
  • Course coordinator: Kaur Kasak, kaur.kasak(at)gmail.com, +372 52 17 946
  • There will be several instructors for this course:
    1. Team from Clarified Security: Mehis Hakkaja, Mait Peekma, Jaanus Kääp, Elar Lang
    2. Others: Roman Palik, Tarko Tikan
  • Our aim is get presentations from persons who have strong real-world experience

• Prerequisites
  • Experience in administrating Linux and Windows based systems. For lab-work, BackTrack5 based virtual machines
  • Understanding of main networking protocols (IP, TCP, UDP, ICMP, ARP, DNS, HTTP)
  • Some experience with web technologies and relational databases (HTML, PHP, MySQL, Javascript)
  • Programming skills in any standard high-level language

Communication

• Course coordinator contacts: Kaur Kasak, kaur.kasak (at) gmail.com, +372 52 17 946, skype: kaur.kasak
• E-mail list (Google Group)
  • itx8063-2012[=at=]googlegroups.com
  • Everyone has to join to get announcements
  • Group Manager is Sten: estonien[=at=]gmail.com

Schedule

• Starting from the second half of the semester
• Tuesdays, 17:45-21:00, III-310, IT-213A, IT-213B
• NB! Check the exact location for every single lecture/lab!

30.10 I

• Location: III-310 (for the whole evening)
• Topics:
  • Administrative Information
  • Introduction and Demos (Mehis)
  • Pen-Testing Wireless Networks (intro). Description of Homework (Mait)

06.11 II

• Location: III-310 (for the whole evening)
• Administrative Info
  • Homework
  • VPN to Lab
  • TODO for next time

• TODO by 13.11.2012:
  • Get VPN access working ITX8063_2012_Labs
  • Access materials in lab http://192.168.136.5/files
  • Review the following slides
    • 02-1.Attack.Phases.pdf
    • 02-2.Reconnaissance.pdf
    • 02-3.Scanning.and.Enumeration.pdf
    • 02-4.Password.and.Brute-Force.Attacks.pdf

• Topics:
  • Network infrastructure attacks and defence (MAC flooding, ARP spoofing, ICMP redirection, IP spoofing and fragmentation, VLAN hopping, leaking data over CDP, port security, DHCP snooping and dynamic ARP inspection, private VLANs, 802.1x) (Roman)
  • Mail security: SMTP overview, grey-listing, SPF, DKIM (Roman)
  • DNS security: DNS overview, cache poisoning, DNSSec (Roman)

13.11 III

• Location:
  • III-310 17:45 - 19:15
  • IT-213A, IT-213B 19:30 - 21:00

• Topics:
  • Mail Security continued (Roman)
  • DNS Security (Roman)
  • Exercises on MiTM attacks and DNS
  • ITX8063_2012_Labs

20.11 IV

• Location:
  • III-310 17:45 - 21:00
• Topics:
  • Problems with the first labs:
    1. Description of first scanning exercise was wrong - TCP port 25 was missing from the list you should send probes
    2. DNS Task 1 had initially wrong "correct answer"
    3. MiTM machines were not available due to wrong virtual network interface mappings
    4. Access from IT-213A and IT-213B does not work. But seems to be working from IT-213E, IT-213I(?)
    5. Less than 50% of the tasks has been activated so far - please start working!
  • Other Lab issues
    1. Use hints
    2. Lab Report
  • DNSSec continued (Roman Palik)
  • Exploitation intro (Roman Palik)
  • We will go to the computer class only in case there will be enough time
  • New missions will be activated after the lecture approx 22:00

27.11 V

• Location: 17:45-19:15 III-310
  • Attacks and Defence of WAN networks. BGP. IPv6 (Tarko)
  • Security of mobile devices management (Mina)

04.12 VI

• Location:
• Topics: Web Application Security I (Jaanus, Elar, Mait)
  • Introduction to web application technologies
  • Web Application Pen-Testing Tools
  • Web Application Mapping and Reconnaissance
  • Authentication and Authorization
  • Session Management

11.12 VII

• Location:
• Topics: Web Application Security II (Jaanus, Elar, Mait)
  • Injection (code, OS command, SQL, log)
  • Direct Object Reference
  • XSS
  • CSRF

18.12 VIII

• Location:
• Topics: Web Application Security III (Jaanus, Elar, Mait)
  • Special Functionalities (password recovery, default password generation)
  • Business Logic Flaws
  • Resource Intensive Queries
  • Error Handling and Logging
  • Rich Internet Applications (Flash, Silverlight,...)

Homework and Labs

• ITX8063_2012_Homework
• ITX8063_2012_Labs

Grade assignment

• 100% = 100 points
• Practical tasks and lab report (scoreboard results and notes about solving the tasks): 40p
  • Max 20p for Accomplished Tasks
  • Max 20p for Lab Report
• Written exam (closed-book) 60p
• Bonus
  • Capture the Flag Exercises Top 5: 90p
  • Practical Homework: 10p

Exam and Results

Time

1. Friday, 21 Dec 2012 (location and time TBD)
2. TBD
3. TBD

Results

• Results