AssemblyThis page contains the material of undergraduate course Sicurezza held by Prof. Riccardo Focardi. Course is taught in Italian but this page and all the material is in English.
IMPORTANT NOTE: In this course you will learn attack techniques. Remember that trying attacks on real systems is against law and you might be prosecuted. Always do experiments with test hosts and users.
Exam and optional assignments (challenges)
The exam consists of a written test that aims at verifying the knowledge of the different topics of the course. Assignments are optional and consist of a problem (challenge) to solve, giving an extra score with respect to the the mark of the written test.
Textbooks
Course is strongly based on on-line material since there exists no textbook covering practical security in a satisfactory way. All slides, links and extra material will be made available in this page. For program exploitation it is possible to refer to the (not so recent) book: J. Erickson, Hacking, the art of exploitation, No starch press, 2008.
Useful links
- Linux testbed (Linux host for lab exercises)
- Virtual meeting point is Slack! Find more information in the official moodle page of the course.
Program and on-line material
Background e TOOLS
- [18/09/2024] Introduction and Unix shell (slides, Bandit wargame)
- [19/09/2024] Stream editor and regular expressions (slides, sed manual, files for exercises, solutions)
- [25/09/2024] Introduction to Python (slides, official tutorial, solutions)
- [26/09/2024] Lab: interacting with programs (lab)
Program analysis
- [02/10/2024] Assembly x86-64 (slides)
- [03/10/2024] Program analysis (slides, gdb docker profile)
- [09/10/2024] Challenge 1: Program Analysis (challenge)
Program exploitation
- [10/10/2024] Buffer overflow (slides, exercise solution)
- [16/10/2024] Stack overflow (slides)
- [17/10/2024] Lab on stack protector (lab)
- [23/10/2024] Format strings (slides)
- [24/10/2024] Secure coding (slides)
- [30/10/2024] Challenge 2: Program Exploitation (challenge) Bring your laptops!
System and network security
- [31/10/2024] Identification (slides)
- [06/11/2024] Unix access control (slides)
- [07/11/2024] Challenge 3: Identification (challenge)
- [13/11/2024] Firewalls – netfilter (slides)
web security (server)
- [14/11/2024] Web attacks – server side (slides)
- [20/11/2024] Web attacks and defences – server side (slides)
- [27/11/2024] Lab on server side web attacks (on-line lab)
- [28/11/2024] Side channels (Blind SQLi) (slides)
- [04/12/2024] Challenge 4: SQL injections (challenge)
WEB SECURITY (client)
- [05/12/2024] Client side web security (slides)
- [11/12/2024] Client side attacks (XSS and CSRF) (slides, examples)