資安攻防演練 Information Security: A Hands-on Approach

課程資訊 Course Information

• Instructor: Po-Wen Chi 紀博文

  • Office: 514 

  • Phone: 02-7749-6684

  • Email: neokent@gapps.ntnu.edu.tw

• TA: 彭建霖 wl03452329@gmail.com

• Time: Mon 9:10-12:10

• Classroom: B101

• Goals:

  • Students can learn how the computer and the network work in detail and see why there are some problems in the original design.

  • Students can learn how the information attack really works through hands-on experiments and see how to fix these problems.

Prerequisites

• Computer Programming: C, Python

• Computer Architecture

• Assembly

• Operating System

• Computer Networking

• Introduction to Information Security

Almost every course ... Are you serious?

Well ... That is true. If you do not know how your computer works, it is impossible for you to protect it.

Of course, I will cover some backgrounds when introducing these attacks. So do not worry.

Textbook and Lab Site

Though having the textbook is not mandatory, but I think this is a good book and is nice to have.

• Computer & Internet Security: A Hands-on Approach 3rd ed
  ISBN: 978-1733003940

  • Author: Wenliang Du

• SEED Labs

  • https://seedsecuritylabs.org/

Syllabus

1. Introduction to this course.

2. Set-UID Programs.

   1. showid.c

   2. catall.c

   3. cap_leak.c

3. Environment Variables and Attack.

   1. exp.zip

4. Shellshock Attack.

   1. bash-4.2.tar.gz

5. Buffer Overflow Attack.

   1. stack.c

   2. exploit.py

6. Return-to-libc Attack and ROP.

   1. exploit.py

   2. stack_rop.c

   3. chain_noargs.py

   4. chain_witharg.py

   5. chain_printf.py

7. Format String Vulnerability.

   1. vul.c

   2. fmtvul.c

8. Cross Site Request Forgery.

9. Cross-Site Scripting Attack.

10. SQL Injection.

11. Firewall.

12. VPN.

    1. exp.zip

Homework

1. HW01

   • Due: 2022.09.25 PM 11:59

2. HW02

   • Due: 2022.10.10 PM 11:59

3. HW03

   • Due: 2022.11.06 PM 11:59

4. HW04

   • Due: 2022.11.27 PM11:59

5. HW05

   • Due: 2022.12.11 PM11:59

6. HW06

   • Due: 2022.12.28 PM11:59

   • Due: 2022.12.31 12:05

7. HW07 (Canceled)

   • Due: TBD

Grading

1. Experiment Reports: 70 pts --> 60 pts

2. Final: 30 pts --> 40 pts

3. Bonus: TBD