資安攻防演練 Information Security: A Hands-on Approach

課程資訊 Course Information

• Instructor: Po-Wen Chi 紀博文

  • Office: 514

  • Phone: 02-7749-6684

  • Email: neokent@gapps.ntnu.edu.tw

• TA: TBD

• Time: Mon 9:10-12:10

• Classroom: B102

• This is an online course for the first two weeks (9/27,10/4). We will use Google Meet as the platform.

  • 資安攻防演練

  • 視訊通話連結：https://meet.google.com/mpi-rgxy-sma

• Goals:

  • Students can learn how the computer and the network work in detail and see why there are some problems in the original design.

  • Students can learn how the information attack really works through hands-on experiments and see how to fix these problems.

Prerequisites

• Computer Programming: C, Python

• Computer Architecture

• Assembly

• Operating System

• Computer Networking

• Introduction to Information Security

Almost every course ... Are you serious?

Well ... That is true. If you do not know how your computer works, it is impossible for you to protect it.

Of course, I will cover some backgrounds when introducing these attacks. So do not worry.

Textbook and Lab Site

Though having the textbook is not mandatory, but I think this is a good book and is nice to have.

• Computer & Internet Security: A Hands-on Approach, Second Edition
  ISBN: 978-1733003926 (hardcover) and 978-1733003933 (paperback)

  • Author: Wenliang Du

  • Amazon

  • 博客來

  • 天瓏書局

• SEED Labs

  • https://seedsecuritylabs.org/

Syllabus

1. Introduction to this course.

2. Set-UID Programs.

   1. showid.c

   2. catall.c

   3. cap_leak.c

3. Environment Variables and Attack.

   1. exp.zip

4. Shellshock Attack.

   1. bash-4.2.tar.gz

5. Buffer Overflow Attack.

   1. stack.c

   2. exploit.py

6. Return-to-libc Attack and ROP.

   1. exploit.py

   2. stack_rop.c

   3. chain_noargs.py

   4. chain_witharg.py

   5. chain_printf.py

7. Format String Vulnerability.

   1. vul.c

   2. fmtvul.c

8. Cross Site Request Forgery.

9. Cross-Site Scripting Attack.

10. SQL Injection.

11. Firewall.

12. VPN.

    1. exp.zip

Homework

1. HW01

   • Due: 2021.10.18 AM11:59

   • ping.c

2. HW02

   • Due: 2021.11.01 AM11:59

3. HW03

   • Due: 2021.11.22 AM11:59

4. HW04

   • Due: 2021.12.06 AM11:59

5. HW05

   • Due: 2021.12.20 AM11:59

6. HW06

   • Due: 2022.01.03 AM11:59

7. HW07

   • Due: 2022.01.24 AM11:59

   • 作業上的日期我懶得改了

8. Final

Grading

1. Experiment Reports: 70 pts

2. Final: 30 pts

3. Bonus: 5 pts

   1. Deadline: 2022.01.24 AM 11:59