After successful completion of the course, students are able to discover and attack common software security vulnerabilities and to avoid common pitfalls during the development phase. The aim is to provide hands-on experience in the sort of attacks and protections found in the real world. More specifically, students will be given access to a safe environment where to interact with realistic applications containing ad-hoc vulnerabilities. The LVA offers practical exercises and follow-up materials to complement the topics presented during the Introduction to Security (VU) course.

Introduction

• Python and bash scripting
• Tools for binary and web exploit development

System Security

• Buffer/stack overflow
• Circumventing overflow mitigation techniques
• Return-oriented programming (ROP)

Web Security

• Server-side code injection techniques
• Client-side injections and mitigation bypasses
• Cross-site request forgery attacks and countermeasures
• Browser side-channels

Network and Protocol Security

• Cryptographic protocols

Tutorials on practical security topics and project assignments as homework. 

ECTS Breakdown

3 ECTS = 75h

• 8h lecture
• 67h self-study and projects development

Practical assignments mostly focused on implementing attacks introduced during the course.