MSc: Offensive Technologies - Revision history

R.sirgalina at 08:57, 29 August 2022

2022-08-29T08:57:26Z

R.sirgalina: /* Course Sections */

2022-07-13T07:19:48Z

Course Sections

← Older revision		Revision as of 07:19, 13 July 2022
Line 208:		Line 208:
	=== Section 2 ===		=== Section 2 ===

−	====Section title: ~~Malware Analysis~~====	+	====Section title:====
		+	Malware Analysis

	====Topics covered in this section:====		====Topics covered in this section:====
Line 267:		Line 268:
	=== Section 3 ===		=== Section 3 ===

−	====Section title: ~~Mobile Security~~====	+	====Section title:====
		+	Mobile Security

	====Topics covered in this section:====		====Topics covered in this section:====
Line 325:		Line 327:
	=== Section 4 ===		=== Section 4 ===

−	====Section title: ~~Network and Web Security~~====	+	====Section title:====
		+	Network and Web Security

	====Topics covered in this section:====		====Topics covered in this section:====

R.sirgalina: /* Course Sections */

2022-07-13T07:18:38Z

Course Sections

← Older revision		Revision as of 07:18, 13 July 2022
Line 160:		Line 160:
	* Fuzzing security testing		* Fuzzing security testing

−	~~'''~~What forms of evaluation were used to test students’ performance in this section?~~'''~~	+	====What forms of evaluation were used to test students’ performance in this section?====

	{\| class="wikitable" style="text-align:center"		{\| class="wikitable" style="text-align:center"
Line 208:		Line 208:
	=== Section 2 ===		=== Section 2 ===

−	~~'''~~Section title: Malware Analysis~~'''~~	+	====Section title: Malware Analysis====

−	~~'''~~Topics covered in this section:~~'''~~	+	====Topics covered in this section:====

	* Malware evasion techniques		* Malware evasion techniques
Line 218:		Line 218:
	* Professional malware analysis frameworks and tools		* Professional malware analysis frameworks and tools

−	~~'''~~What forms of evaluation were used to test students’ performance in this section?~~'''~~	+	====What forms of evaluation were used to test students’ performance in this section?====

	{\| class="wikitable" style="text-align:center"		{\| class="wikitable" style="text-align:center"
Line 249:		Line 249:
	\|}		\|}

−	~~'''~~Typical questions for ongoing performance evaluation within this section~~'''~~	+	====Typical questions for ongoing performance evaluation within this section====

	* For a given malicious application try to find useful artifacts, for example, find encryption key, C&C server, find commands that server can send		* For a given malicious application try to find useful artifacts, for example, find encryption key, C&C server, find commands that server can send
Line 255:		Line 255:
	* what are the most commonly used evasion and injection in malware and how can you detect it?		* what are the most commonly used evasion and injection in malware and how can you detect it?

−	~~'''~~Typical questions for seminar classes (labs) within this section~~'''~~	+	====Typical questions for seminar classes (labs) within this section====

	* For a given malicious application try to find the evasion and injection techniques that are used by that application		* For a given malicious application try to find the evasion and injection techniques that are used by that application
Line 261:		Line 261:
	* Setup an isolated analytic Virtual Machine and test it against Virtual Machine detection tools		* Setup an isolated analytic Virtual Machine and test it against Virtual Machine detection tools

−	~~'''~~Test questions for final assessment in this section~~'''~~	+	====Test questions for final assessment in this section====

	As above		As above
Line 267:		Line 267:
	=== Section 3 ===		=== Section 3 ===

−	~~'''~~Section title: Mobile Security~~'''~~	+	====Section title: Mobile Security====

−	~~'''~~Topics covered in this section:~~'''~~	+	====Topics covered in this section:====

	* Mobile architecture		* Mobile architecture
Line 276:		Line 276:
	* Professional mobile security testing frameworks and tools		* Professional mobile security testing frameworks and tools

−	~~'''~~What forms of evaluation were used to test students’ performance in this section?~~'''~~	+	====What forms of evaluation were used to test students’ performance in this section?====

	{\| class="wikitable" style="text-align:center"		{\| class="wikitable" style="text-align:center"
Line 307:		Line 307:
	\|}		\|}

−	~~'''~~Typical questions for ongoing performance evaluation within this section~~'''~~	+	====Typical questions for ongoing performance evaluation within this section====

	* What privilege does root or jailbreak gives you? is it mandatory for security testing?		* What privilege does root or jailbreak gives you? is it mandatory for security testing?
Line 313:		Line 313:
	* what is the pros and cons of mobile security testing?		* what is the pros and cons of mobile security testing?

−	~~'''~~Typical questions for seminar classes (labs) within this section~~'''~~	+	====Typical questions for seminar classes (labs) within this section====

	* For a given malicious application try to find the evasion and injection techniques that are used by that application		* For a given malicious application try to find the evasion and injection techniques that are used by that application
Line 319:		Line 319:
	* try to bypass some of the security mechanisms that are enabled either on the application or on the operating system level		* try to bypass some of the security mechanisms that are enabled either on the application or on the operating system level

−	~~'''~~Test questions for final assessment in this section~~'''~~	+	====Test questions for final assessment in this section====

	As above		As above
Line 325:		Line 325:
	=== Section 4 ===		=== Section 4 ===

−	~~'''~~Section title: Network and Web Security~~'''~~	+	====Section title: Network and Web Security====

−	~~'''~~Topics covered in this section:~~'''~~	+	====Topics covered in this section:====

	* Injection Flows		* Injection Flows
Line 334:		Line 334:
	* Network Misconfiguration		* Network Misconfiguration

−	~~'''~~What forms of evaluation were used to test students’ performance in this section?~~'''~~	+	====What forms of evaluation were used to test students’ performance in this section?====

	{\| class="wikitable" style="text-align:center"		{\| class="wikitable" style="text-align:center"
Line 365:		Line 365:
	\|}		\|}

−	~~'''~~Typical questions for ongoing performance evaluation within this section~~'''~~	+	====Typical questions for ongoing performance evaluation within this section====

	* What is the difference between boolean-based and time-based SQL injection?		* What is the difference between boolean-based and time-based SQL injection?
Line 371:		Line 371:
	* Does the Same Origin Policy apply to the localStorage inside the browser?		* Does the Same Origin Policy apply to the localStorage inside the browser?

−	~~'''~~Typical questions for seminar classes (labs) within this section~~'''~~	+	====Typical questions for seminar classes (labs) within this section====

	* Vulnerability analysis and exploitation for a given web application		* Vulnerability analysis and exploitation for a given web application
	* Write and deploy WAF rules to mitigate a specific web attack		* Write and deploy WAF rules to mitigate a specific web attack

−	~~'''~~Test questions for final assessment in this section~~'''~~	+	====Test questions for final assessment in this section====

	As above		As above

R.sirgalina: /* Course Sections */

2022-07-13T07:16:05Z

Course Sections

← Older revision		Revision as of 07:16, 13 July 2022
Line 149:		Line 149:
	=== Section 1 ===		=== Section 1 ===

−	~~'''~~Section title: ~~Software~~ ~~Security'''~~	+	==== Section title: ====
		+	Software Security

−	~~'''~~Topics covered in this section:~~'''~~	+	==== Topics covered in this section: ====

	* Buffer overflow vulnerability		* Buffer overflow vulnerability
Line 190:		Line 191:
	\|}		\|}

−	~~'''~~Typical questions for ongoing performance evaluation within this section~~'''~~	+	==== Typical questions for ongoing performance evaluation within this section ====

	* What are the pros and cons of using ASLR? does it affect the performance?		* What are the pros and cons of using ASLR? does it affect the performance?
Line 196:		Line 197:
	* What are the pros and cons of writing your own fuzzer?		* What are the pros and cons of writing your own fuzzer?

−	~~'''~~Typical questions for seminar classes (labs) within this section~~'''~~	+	==== Typical questions for seminar classes (labs) within this section ====

	* Write an exploit for a given binary, also try to bypass the mitigation techniques		* Write an exploit for a given binary, also try to bypass the mitigation techniques
	* Implement a fuzzer for a specific use-case		* Implement a fuzzer for a specific use-case

−	~~'''~~Test questions for final assessment in this section~~'''~~	+	==== Test questions for final assessment in this section ====

	As above		As above

M.petrishchev at 08:05, 26 April 2022

2022-04-26T08:05:50Z

← Older revision		Revision as of 08:05, 26 April 2022
Line 24:		Line 24:


−	=== Course Objectives Based on Bloom’s Taxonomy ===	+	== Course Objectives Based on Bloom’s Taxonomy ==

−	==== - What should a student remember at the end of the course? ====	+	==== What should a student remember at the end of the course? ====

	By the end of the course, the students should be able to recognize and define		By the end of the course, the students should be able to recognize and define
Line 37:		Line 37:
	* Mobile security analysis		* Mobile security analysis

−	==== - What should a student be able to understand at the end of the course? ====	+	==== What should a student be able to understand at the end of the course? ====

	By the end of the course, the students should be able to describe and explain (with examples)		By the end of the course, the students should be able to describe and explain (with examples)
Line 47:		Line 47:
	* Methods and techniques web penetration testing		* Methods and techniques web penetration testing

−	==== - What should a student be able to apply at the end of the course? ====	+	==== What should a student be able to apply at the end of the course? ====

	* Perform a network discovery		* Perform a network discovery

R.akhmetzyanov: /* Prerequisites */

2022-04-22T13:33:48Z

Prerequisites

← Older revision		Revision as of 13:33, 22 April 2022
Line 19:		Line 19:
	== Prerequisites ==		== Prerequisites ==
	* The course has been designed to be self-included as much as possible. The successful completion will depend on prerequisite courses such as:		* The course has been designed to be self-included as much as possible. The successful completion will depend on prerequisite courses such as:
−	* [https://eduwiki.innopolis.university/index.php/MSc:Advanced_Security CSE522 — Advanced Security]	+	* [https://eduwiki.innopolis.university/index.php/MSc:Advanced_Security CSE522 - Advanced Security]
	* Essential skills		* Essential skills
	* Classical Internet Applications		* Classical Internet Applications

M.petrishchev: M.petrishchev moved page MSc:Offensive Technologies to MSc: Offensive Technologies

2022-04-15T08:38:34Z

M.petrishchev moved page MSc:Offensive Technologies to MSc: Offensive Technologies

← Older revision	Revision as of 08:38, 15 April 2022
(No difference)

M.petrishchev: /* Prerequisites */

2022-04-14T21:22:35Z

Prerequisites

← Older revision		Revision as of 21:22, 14 April 2022
Line 19:		Line 19:
	== Prerequisites ==		== Prerequisites ==
	* The course has been designed to be self-included as much as possible. The successful completion will depend on prerequisite courses such as:		* The course has been designed to be self-included as much as possible. The successful completion will depend on prerequisite courses such as:
		+	* [https://eduwiki.innopolis.university/index.php/MSc:Advanced_Security CSE522 — Advanced Security]
−	* Advanced Security
	* Essential skills		* Essential skills
	* Classical Internet Applications		* Classical Internet Applications

M.petrishchev at 06:46, 14 April 2022

2022-04-14T06:46:54Z

← Older revision		Revision as of 06:46, 14 April 2022
Line 16:		Line 16:

	Offensive Technology introduces methods, tools, and techniques to the students to assess the security of different services, protocols, and applications. The course aims to expose the students to real-world expertise from a security perspective and let them find vulnerabilities in both software and hardware, Also in this course, the students will learn how to analyze a malicious application and how they can understand the behavior of this application and deploy the appropriate defenses against this application. Furthermore, the students will develop projects of their choice to show their skills. In this course, the students will particularly focus on Software Testing, Fuzzing, Malware Analysis, Mobile Security, and Network and Web Security.		Offensive Technology introduces methods, tools, and techniques to the students to assess the security of different services, protocols, and applications. The course aims to expose the students to real-world expertise from a security perspective and let them find vulnerabilities in both software and hardware, Also in this course, the students will learn how to analyze a malicious application and how they can understand the behavior of this application and deploy the appropriate defenses against this application. Furthermore, the students will develop projects of their choice to show their skills. In this course, the students will particularly focus on Software Testing, Fuzzing, Malware Analysis, Mobile Security, and Network and Web Security.
		+
		+	== Prerequisites ==
		+	* The course has been designed to be self-included as much as possible. The successful completion will depend on prerequisite courses such as:
		+	* Advanced Security
		+	* Essential skills
		+	* Classical Internet Applications
		+

	=== Course Objectives Based on Bloom’s Taxonomy ===		=== Course Objectives Based on Bloom’s Taxonomy ===

M.petrishchev: M.petrishchev moved page MSc:OffensiveTechnologies.S22 to MSc:Offensive Technologies

2022-04-10T12:35:08Z

M.petrishchev moved page MSc:OffensiveTechnologies.S22 to MSc:Offensive Technologies

← Older revision	Revision as of 12:35, 10 April 2022
(No difference)