ITX8063

Course Description

• Schedule
  • The course will be conducted on the second half of Autumn semester of 2010/2011
  • First lecture/lab on 26th of October

• EAP: 3.00

• Course Objectives and Organization
  • Main objective is to give a good technical overview of different attack methods and vulnerabilities the attackers are exploiting to compromise IT systems.
  • We will not use strong academic approach. Rather, we will focus on the current problems and practical issues of IT security.
  • There will be less lectures and more hands-on work and demo's on lab systems
  • The labs are built around Capture The Flag Exercises
    1. We set up purposely vulnerable systems
    2. Student's job is to identify vulnerabilities, gain access somehow and find the flag from the systems
    3. First one gets the most points
    4. Afterwards: securing and patching the systems

• Instructors
  • Responsible: Kaur Kasak, kaur.kasak(at)gmail.com, +372 52 17 946
  • There will be several instructors for this course (most of them from Estonian Cyber Defence League): Mehis Hakkaja, Kalev Kuusik, Andri Rebane, Roman Palik, Kuido Külm, Tarko Tikan, Tiit Hallas
  • Our aim is get presentations from persons who have strong real-world experience

• Contents
  • In general courses will be structured around typical attack phases. Going from Layer L2 to L7.
  • The course is still under development and the exact contents depend on the instructors we are able to motivate to participate
  • More active students will have opportunity to make presentations

• Prerequisites
  • Experience in administrating Linux and Windows based systems
  • Understanding of main networking protocols (IP, TCP, UDP, ICMP, ARP, DNS, HTTP)
  • Some experience with web technologies and relational databases (HTML, PHP, MySQL, Javascript)
  • Programming skills in any standard high-level language

• General List of Topics
  1. Introduction. Demo of the main phases of a penetration test
  2. Reconnaissance and Scanning
  3. Password and Brute-Force Attacks
  4. Man-In The Middle Attacks
  5. Attacks and Defence of Network Infrastructure
  6. Exploitation
  7. Web Application Security
  8. Attacks Against Mobile Platforms?
  9. Maintaining Access and Hiding Tracks

Schedule

• Starting from the second half of the semester
• Tuesdays, 17:00-20:15
  • 17:00-17:40 IT-137A: if required, we will stay longer in IT-137A to finish the lecture
  • 17:45-20:00 IT-213B

I: 26 Oct

• Attack Methodology and Demo (Mehis Hakkaja)
• Scanning
• Lab setup?

II: 02 Nov

• Password and Brute-Force Attacks (Andri Rebane)
• Practical exercises

III: 09 Nov

• Attacks and Defence of Network Infrastructure
  • 17:00-18:30 Attacks and Defence in LAN (Kalev Kuusik)
  • 18:45-20:15 How internet works. How IPs are allocated. How to attack "BGP". IPv6 - 96 more bits. Etc (Tarko Tikan)

IV: 16 Nov

• No lectures - independent work on VM analysis

V: 23 Nov

• Exploitation (Roman Palik)
• Practical exercises

VI: 30 Nov

• Web Application Security (Kuido Külm)
• Practical exercises

VII: 7 Dec

• Web Application Security
• Practical exercises

VIII: 14 Dec

• Maintaining Access and Hiding Tracks (Tiit Hallas)
• Practical exercises

Grade assignment

Preliminary Plans:

• 35p - Practical Exercises
• 15p - Written Assignment (Report of VM image analysis)
• 50p - Written Exam

• Bonus:
  • 50p - 3-5 most successful CTF participants
  • Up to 15p for Presentation on Web Application security