CYBER OFFENSE AND DEFENSE

Course Information

Lecturer: Mario Alviano

Assistant: Pierpaolo Sestito

Office hours: consult my homepage

Microsoft Teams: for code and link search on this page

Notice Board

23/09/2026 09:00: Schedule is online. No lecture on Tuesday 8 December 2026.

Promo Videos (most recent up)

Pills (most recent up)

Dates and Deadlines

Lectures

Thursday and Friday in room MT10

1. Introduction ⌛⌛⌛

2. XPath + Exercises ⌛⌛

3. SQL injection (SQLi) + Exercises ⌛⌛⌛

4. Exercises ⌛⌛

5. Authentication + Business logic vulnerabilities ⌛⌛⌛

6. Exercises ⌛⌛

7. Information disclosure + Directory traversal + Command injection + File upload vulnerabilities ⌛⌛⌛

8. Exercises ⌛⌛

9. Access control + Server-side request forgery (SSRF) ⌛⌛⌛

10. Exercises ⌛⌛

11. XXE injection + Exercises ⌛⌛⌛

12. Exercises ⌛⌛

13. Cross-site scripting (XSS) ⌛⌛⌛

14. Exercises ⌛⌛

15. Cross-site request forgery (CSRF) + Cross-origin resource sharing (CORS) ⌛⌛⌛

16. Exercises ⌛⌛

17. Clickjacking + Insecure deserialization ⌛⌛⌛

18. Exercises + Student Project ⌛⌛

19. Server-side template injection + OAuth authentication + JWT attacks ⌛⌛⌛

20. Exercises + Student Project ⌛⌛

21. Student Project ⌛⌛⌛

22. Student Project ⌛⌛

23. Student Project ⌛⌛

24. Student Project Showcase + Exam Simulation ⌛⌛⌛

Teaching Material

Books

• Computer Security: Principles and Practice, Global Edition - Stallings William and Brown Lawrie - Pearson

  • Sicurezza dei computer e delle reti - Stallings William – Pearson

  • Crittografia - Stallings William – Pearson

• Kali Linux Penetration Testing Bible - Gus Khawaja – Wiley

• Bug Bounty Bootcamp – Vickie Li – No Starch Press

Links

• https://portswigger.net/web-security/learning-path

• https://www.zaproxy.org/

• https://github.com/Textualize/rich

• https://typer.tiangolo.com/

• Basics

  • https://www.w3schools.com/python/

  • https://www.w3schools.com/sql/default.asp

  • https://www.w3schools.com/js/default.asp

  • https://www.w3schools.com/php/default.asp

Exams

Dates will be added to the calendar when available