The course will give hands-on experience on the most important techniques used in the exploitation of software and hardware vulnerabilities, and the countermeasures adopted to mitigate such attacks. Topics include:
- OS (unix/linux): suid/sgid binaries, environment variables, symlink attacks, sandboxing via containers and/or Virtual Machines;
- programming: stack and heap overflow, format string vulnerabilities,integer overflow, shellcodes and Return Oriented Programming, side-channels, NX, W^X, ASLR and PIE, binary reversing
- hardware: Rowhammer, Meltdown, Spectre and their mitigations
- network: network scanning, service scanning, fuzzing
- web applications: mapping, authentication vulnerabilities, login bruteforcing, session management vulnerabilities, session hijacking, SQL injection, LDAP injection, cross-site scripting