Lehekülje ITX8063 lähteteksti vaatamine

<h1>Information Systems Hacking Attacks and Defence</h1>

= Course Description =
* Schedule 
** The course will be conducted on the second half of Autumn semester of 2010/2011
** First lecture/lab on '''26th of October'''

* EAP: 3.00

* Course Objectives and Organization
** Main objective is to give a good technical overview of different attack methods and vulnerabilities the attackers are exploiting to compromise IT systems.
** We will not use strong academic approach. Rather, we will focus on the current problems and practical issues of IT security.
** There will be less lectures and more hands-on work and demo's on lab systems
** The labs are built around Capture The Flag Exercises
**# We set up purposely vulnerable systems
**# Student's job is to identify vulnerabilities, gain access somehow and find the flag from the systems
**# First one gets the most points
**# Afterwards: securing and patching the systems

* Instructors
** Responsible: Kaur Kasak, kaur.kasak(at)gmail.com, +372 52 17 946
** There will be several instructors for this course (most of them from Estonian Cyber Defence League): Mehis Hakkaja, Kalev Kuusik, Andri Rebane, Roman Palik, Kuido Külm, Tarko Tikan, Tiit Hallas
** Our aim is get presentations from persons who have strong real-world experience

* Contents
** In general courses will be structured around typical attack phases. Going from Layer L2 to L7.
** The course is still under development and the exact contents depend on the instructors we are able to motivate to participate
** More active students will have opportunity to make presentations

* Prerequisites
** Experience in administrating Linux and Windows based systems
** Understanding of main networking protocols (IP, TCP, UDP, ICMP, ARP, DNS, HTTP)
** Some experience with web technologies and relational databases (HTML, PHP, MySQL, Javascript)
** Programming skills in any standard high-level language

* General List of Topics
*# Introduction. Demo of the main phases of a penetration test
*# Reconnaissance and Scanning
*# Password and Brute-Force Attacks
*# Man-In The Middle Attacks
*# Attacks and Defence of Network Infrastructure
*# Exploitation
*# Web Application Security
*# Maintaining Access and Hiding Tracks

= Schedule =

* Starting from the second half of the semester
* Tuesdays, 17:00-20:15
** 17:00-17:40 IT-137A: 
** 17:45-20:00 IT-213B 

== I: 26 Oct ==
* [[Pilt:Administrative.Notes.pdf|Administrative Notes]]
* Attack Methodology and Demos (Mehis Hakkaja)
* [[Pilt:Scanning.pdf|Network Scanning (Kaur Kasak)]]

== II: 02 Nov ==

* [[Pilt:Password.And.Brute.Force.Attacks.pdf|Password and Brute-Force Attacks (Andri Rebane)]] 
* [[Pilt:Password.And.Brute-Force.Attacks.pdf|Password and Brute-Force Attacks (Kaur Kasak)]] 
* [[Practical exercises]]
* [[Lab Setup]]

== III: 09 Nov ==

* Attacks and Defence of Network Infrastructure
** 17:00-18:30 Attacks and Defence in LAN (Kalev Kuusik)
** 18:30-20:00 How internet works. How IPs are allocated. How to attack "BGP". IPv6 - 96 more bits. (Tarko Tikan). http://tarko.ircnet.ee/temp/BGPtalk.pdf

* Admin Issues:
** There are still topics available for presentations on Web Application Security (Up to 15 points). Propose your own topic or review the list [[Pilt:Administrative.Notes.pdf|here]]
** Next time there will be individual work but no lectures!
** Grading of Practical Assignments

== IV: 16 Nov ==

* No lectures - solving practical exercises in Lab and writing the report
* Instructions will be provided NLT 14 Nov 2010

== V: 23 Nov==

* Exploitation (Roman Palik)
* Practical exercises

== VI: 30 Nov==
* Web Application Security I
** Introduction. Attacking Authentication and Session Management. SQL injection
** Cross-Site Scripting (Arnis Paršovs)
** Practical exercises

== VII: 7 Dec==
* Web Application Security (Kuido Külm)
* Practical exercises

== VIII: 14 Dec==
* Maintaining Access and Hiding Tracks (Tiit Hallas)
* Practical exercises

= Grade assignment =
* 35p - Practical Exercises
** It is important how many Tasks you have completed in the end of the semester. If you have completed all the tasks, you will get 35 
** The results on the scoreboard are important only to identify first 5
** Points for practical exercises: (nr of tasks completed/total nr of tasks) * 35p

* 15p - Written Assignment - report about the specific practical tasks
* 50p - Written Exam 

* Bonus:
** 50p - 5 most successful CTF participants
** Up to 15p for Presentation on Web Application security