MSc: Offensive Technologies

Offensive Technologies

• Course name: Offensive Technology
• Course number: ?

Course characteristics

Key concepts of the class

• Software Security
• Malware Analysis
• Mobile Security
• Network and Web Security

What is the purpose of this course?

Offensive Technology introduces methods, tools, and techniques to the students to assess the security of different services, protocols, and applications. The course aims to expose the students to real-world expertise from a security perspective and let them find vulnerabilities in both software and hardware, Also in this course, the students will learn how to analyze a malicious application and how they can understand the behavior of this application and deploy the appropriate defenses against this application. Furthermore, the students will develop projects of their choice to show their skills. In this course, the students will particularly focus on Software Testing, Fuzzing, Malware Analysis, Mobile Security, and Network and Web Security.

Course Objectives Based on Bloom’s Taxonomy

- What should a student remember at the end of the course?

By the end of the course, the students should be able to recognize and define

• Common weaknesses/vulnerabilities in web application
• ASLR, NX, and how are these techniques can help to protect against a malicious attacker
• Fuzzing techniques
• Malware C&C server
• Process injection techniques that are used in malware and how to defend against it
• Mobile security analysis

- What should a student be able to understand at the end of the course?

By the end of the course, the students should be able to describe and explain (with examples)

• Methods and techniques bypass memory mitigation techniques
• Methods and techniques for fuzz testing
• Methods and techniques malware analysis
• Methods and techniques for mobile security testing
• Methods and techniques web penetration testing

- What should a student be able to apply at the end of the course?

• Perform a network discovery
• Detect/exploit common weaknesses/vulnerabilities in web applications.
• Detect vulnerabilities in software.
• Writing an exploit to bypass ASLR and NX protection.
• Perform fuzzing for a specific use case.
• Perform security assessment for mobile application
• Perform security analysis for a malicious application

Course evaluation

Course grade breakdown

		Proposed points
Labs/seminar classes	?	50
Project	?	50

If necessary, please indicate freely your course’s features in terms of students’ performance assessment: The laboratory assessments are particularly taken care of, and the tasks do correspond with the teachings from the lectures.

Grades range

Course grading range

Grade	Default range	Proposed range
A. Excellent	90-100	85-100
B. Good	75-89	70-84
C. Satisfactory	60-74	60-69
D. Poor	0-59	0-59

If necessary, please indicate freely your course’s grading features: The laboratory assignments are mandatory with a required minimum result of 6/10 - including re-takes - to complete the course. As a consequence, the grades are generally pretty high and therefore the grading ranges are scaled up.

Resources and reference material

• Mike O’Leary, Cyber Operations, Second Edition, Apress, 2019
• Ric Messier, Penetration Testing Basics: A Quick-Start Guide to Breaking into Systems, Apress, 2016
• Michal Zalewsk, The Tangled Web, No Starch Press, 2011
• Jon Erickson, Hacking: The Art of Exploitation, 2nd Edition, No StarchPress, 2008
• The Fuzzing Bookhttps://www.fuzzingbook.org
• Wil Allsopp, Advanced Penetration Testing: Hacking the World’s most secure Networks, Wiley, 2017
• Dafydd Stuttard, The Web Application Hacker’s Handbook: Finding and exploiting Security Flaws, 2nd edition, Wiley, 2011
• Rafay Baloch, Ethical Hacking and Penetration Testing Guide, AuerbachPublications, 2014

Course Sections

Course Sections

Section	Section Title	Teaching Hours
1	Physical & Software Security	12
2	Malware Analysis	4
3	Mobile Security	4
4	Network and Web Security	4
5	Labs	40
6	Project	24

Section 1

Section title: Software Security

Topics covered in this section:

• Buffer overflow vulnerability
• Format string vulnerability
• ASLR defensive technique
• NX defensive technique
• Fuzzing security testing

What forms of evaluation were used to test students’ performance in this section?

Form	Yes/No
Development of individual parts of software product code	0
Homework and group projects	1
Midterm evaluation	0
Testing (written or computer based)	1
Reports	1
Essays	0
Oral polls	0
Discussions	1

Typical questions for ongoing performance evaluation within this section

• What are the pros and cons of using ASLR? does it affect the performance?
• What is the required information to be able to identify a remote libc version?
• What are the pros and cons of writing your own fuzzer?

Typical questions for seminar classes (labs) within this section

• Write an exploit for a given binary, also try to bypass the mitigation techniques
• Implement a fuzzer for a specific use-case

Test questions for final assessment in this section

As above

Section 2

Section title: Malware Analysis

Topics covered in this section:

• Malware evasion techniques
• Malware injection techniques
• Malware artifacts
• Virtual Machine environment hardening
• Professional malware analysis frameworks and tools

What forms of evaluation were used to test students’ performance in this section?

Form	Yes/No
Development of individual parts of software product code	0
Homework and group projects	1
Midterm evaluation	0
Testing (written or computer based)	1
Reports	1
Essays	0
Oral polls	0
Discussions	1

Typical questions for ongoing performance evaluation within this section

• For a given malicious application try to find useful artifacts, for example, find encryption key, C&C server, find commands that server can send
• while setup an isolated analytic Virtual Machine, What are the required steps for hardening?
• what are the most commonly used evasion and injection in malware and how can you detect it?

Typical questions for seminar classes (labs) within this section

• For a given malicious application try to find the evasion and injection techniques that are used by that application
• For a given malicious application try to write detection rules to be able to defend against it
• Setup an isolated analytic Virtual Machine and test it against Virtual Machine detection tools

Test questions for final assessment in this section

As above

Section 3

Section title: Mobile Security

Topics covered in this section:

• Mobile architecture
• Mobile security testing
• Detection of mobile malware
• Professional mobile security testing frameworks and tools

What forms of evaluation were used to test students’ performance in this section?

Form	Yes/No
Development of individual parts of software product code	0
Homework and group projects	1
Midterm evaluation	0
Testing (written or computer based)	1
Reports	1
Essays	0
Oral polls	0
Discussions	1

Typical questions for ongoing performance evaluation within this section

• What privilege does root or jailbreak gives you? is it mandatory for security testing?
• What is the difference from the security perspective between some version of an old mobile operation system
• what is the pros and cons of mobile security testing?

Typical questions for seminar classes (labs) within this section

• For a given malicious application try to find the evasion and injection techniques that are used by that application
• Setup an automated mobile security testing solution and test a given application
• try to bypass some of the security mechanisms that are enabled either on the application or on the operating system level

Test questions for final assessment in this section

As above

Section 4

Section title: Network and Web Security

Topics covered in this section:

• Injection Flows
• Cookies Flows
• Server Misconfiguration
• Network Misconfiguration

What forms of evaluation were used to test students’ performance in this section?

Form	Yes/No
Development of individual parts of software product code	0
Homework and group projects	1
Midterm evaluation	0
Testing (written or computer based)	1
Reports	1
Essays	0
Oral polls	0
Discussions	1

Typical questions for ongoing performance evaluation within this section

• What is the difference between boolean-based and time-based SQL injection?
• Can regex matching protect against Directory Traversal attack?
• Does the Same Origin Policy apply to the localStorage inside the browser?

Typical questions for seminar classes (labs) within this section

• Vulnerability analysis and exploitation for a given web application
• Write and deploy WAF rules to mitigate a specific web attack

Test questions for final assessment in this section

As above