Course Overview
This course is aimed at people interested in software security, reverse engineering, and low-level software. Students explore the foundations of software security, including important vulnerabilities and the attacks that exploit them — such as buffer overflows, SQL injection, and session hijacking — and the defenses that prevent or mitigate them, including advanced testing and program-analysis techniques.
Expected Background
- Basic programming and systematic debugging skills.
- Working proficiency in C (pointers, arrays, loops, functions, memory behavior).
- Comfort with Unix/Linux, the shell, and
gdbor comparable tools. - Familiarity with Intel x86/IA-32 assembly and basic computer architecture.
- Basic web/networking concepts (HTML, HTTP, TCP, client/server).
Prerequisites: CSC 231 or CSC 242; and CSC 302.
Textbook & Tools
Required textbook: None. Reference books:
- Bryant & O’Hallaron, Computer Systems: A Programmer’s Perspective, 3rd Ed.
- Kaspersky, Hacker Disassembling Uncovered, 2nd Ed.
- Eilam, Reversing: Secrets of Reverse Engineering, 1st Ed.
Scripting in Python / pwntools. Hands-on work uses the WolfCTF browser-terminal environment.
Slides & Schedule
| # | Date | Topic | Slides | Supporting Materials |
|---|---|---|---|---|
| 1 | Aug 25, 2026 | Introduction; software-security model; the AI moment in security; classic overflow | Class01.pdf | Syllabus (PDF) · Lecture video: Introduction |
| 2 | Sep 1, 2026 | Software-security model (CIA, vulnerabilities); IA-32/x86 registers; byte ordering | Class02.pdf | Lecture video: IA-32 registers & byte ordering · little_endian.c · WolfCTF portal guide |
| 3 | Sep 3, 2026 | x86 assembly (mov, arithmetic, cmp/jmp); the stack (push/pop, call/ret, frames); gdb workflow | Class03.pdf | Lecture video: x86 assembly · asmreview.asm · asmreview2.asm · WolfCTF portal guide · Quiz 1 next class. |
| 4 | Sep 8, 2026 | Calling conventions (cdecl); stack frames; prologue / epilogue in detail; frame construction in gdb | Class04.pdf | Lecture video: stack & stack frame · stack_frame.c (the StackFrame.c on the slides) · stack.asm · stack.py · Quiz 1 (first 12 min: registers, byte order, reading x86) |
| 5 | Sep 10, 2026 | Reading compiler-generated code; frame inspection in gdb (info frame, bt, finish); hands-on binary analysis | Class05.pdf | Lecture video: stack frame · stack_frame.c · stack.asm · stack.py · Bring your laptop; WolfCTF browser terminal for the in-class GDB practice · Lab 1 is live — due Thu Sep 24, 11:59 PM Eastern. Report & D2L guide. |
| Lab 1 | Sep 11, 2026 | Stack and Stack Frame — GDB + GEF analysis in WolfCTF | Lab 1 handout | Open Lab 1 in WolfCTF · Required report & D2L guide Due Thu Sep 24, 2026, 11:59 PM Eastern · 5 points · Individual PDF report |
| 6 | Sep 15, 2026 | System calls: user/kernel boundary; Linux i386 ABI; write and execve; tracing with strace and GDB + GEF | Class06.pdf | Editable slides (PPTX) · Week 4 classroom code · Build & GEF instructions Run the demos in your WolfCTF terminal. Adapted from the course archive, Chapter 6. Continue Lab 1; due Sep 24. |
| 7 | Sep 17, 2026 | Shellcode: position-independent code; jump–call–pop; extracting bytes; memory permissions and GEF tracing | Class07.pdf | Editable slides (PPTX) · Week 4 classroom code · Build & GEF instructions Run the demos in your WolfCTF terminal. Adapted from the course archive, Chapter 6. Continue Lab 1; due Sep 24. |
| 8 | Sep 22, 2026 | Stack overflow: the missing bounds check; finding the exact offset with a cyclic pattern; hijacking the return address to call code that already exists in the binary | Class08.pdf | Editable slides (PPTX) · Week 5 classroom code · Build & GEF instructions Run the demos in your WolfCTF terminal. Adapted from the course archive, Chapter 7. Quiz 2 this week. |
| 9 | Sep 24, 2026 | Return-to-shellcode: injecting the Class 7 execve shellcode into the overflow buffer, a NOP sled for landing an approximate address, and running an interactive shell | Class09.pdf | Editable slides (PPTX) · Week 5 classroom code · Build & GEF instructions Run the demos in your WolfCTF terminal. Adapted from the course archive, Chapter 8. Lab 2 (Stack Overflow) opens after this class. |
| Lab 2 | Sep 22, 2026 | Stack Overflow — return-address hijack in WolfCTF | Class08.pdf | Open Lab 2 in WolfCTF · Required report & D2L guide Due Thu Oct 8, 2026, 11:59 PM Eastern · 5 points · Individual PDF report |
| 10 | Sep 29, 2026 | Return-oriented Programming (ROP) (1): once NX/DEP marks the stack non-executable, the Class 9 injected-shellcode trick dies — so instead of bringing new code we reuse code already mapped executable, chaining short "gadgets" that each end in "ret" and returning through the program's own functions | Class10.pdf | rop.c · rop.py · overflow.c · rop2.py · rop2.c (target for rop2.py) · ROPgadget (gadget finder) · Lecture video Live demo: Open the ROP (ret2func chaining) demo in WolfCTF — a one-click GDB + GEF terminal with rop.c pre-built (NX on); chains the program's own functions to pop a shell. Adapted from the course archive, Chapter 9. |
| 11 | Oct 1, 2026 | Return-oriented Programming (ROP) (2): from hand-picked gadgets to a full chain — using ROPgadget to dump every "...; ret" sequence, writing "/bin/sh" into memory a few bytes at a time, and staging registers to fire an execve syscall entirely out of borrowed code | Class11.pdf | rop.c · rop.py · rop2.c · rop2.py · ROPgadget (gadget finder) · Lecture video Live demo: Open the pure-gadget execve-chain demo in WolfCTF — a one-click terminal with rop2.c pre-built; dumps gadgets with ROPgadget, writes /bin/sh into memory a few bytes at a time, and fires execve entirely out of borrowed code. Hands-on continuation of Class 10, Chapter 10. |
| — | Oct 6, 2026 | Class cancelled (instructor sick) — work on Lab 2 and review earlier classes for Thursday's quiz | Open Lab 2 in WolfCTF (due Thu Oct 8, 11:59 PM Eastern) · Report & D2L guide · Practice Quiz 2 — Review (Classes 1–11) · Quiz at the start of class on Thu Oct 8 | |
| Web | Oct 8, 2026 | Web security: SQL injection, session management, XSS (reflected and stored), and CSRF. Online lecture and hands-on practice; the quiz is online during class time. | Online class — replaces the in-person meeting. Web-security video lecture · Slides (Ch 11, PDF). Practice exercises: Open the Web Security practice lab in WolfCTF — four classic attacks (SQL injection, weak sessions, XSS, CSRF) on one disposable target; capture a flag for each. Ungraded; walkthrough is inside the lab. Quiz 2: open Quiz 2 here — online during class time, 2:00–3:15 PM. The link goes live at 2:00 PM; up to 30 minutes extra, final submission by 3:45 PM. | |
| 12 | Oct 15, 2026 | Return-to-libc: forge a call frame that jumps straight into a whole libc function (system) — no injected code, so NX is bypassed; then defeat ASLR by leaking a real libc address at runtime and rebasing. Includes ELF sections, dynamic linking, and a PLT/GOT intro. | Class12.pdf | Editable slides (PPTX) · Live demo: Open the ret2libc demo in WolfCTF — one-click GDB + GEF terminal with ret2lib.c pre-built (NX on, -no-pie); forge the call frame and pop a shell. Adapted from the course archive, Chapter 12. |
| 13 | Oct 20, 2026 | PLT, GOT & return-to-plt: how a no-PIE binary resolves libc calls through the PLT/GOT (lazy binding), and why that lets you return into system@plt using the binary's own fixed stubs — bypassing ASLR/NX with no libc leak. | Class13.pdf | Editable slides (PPTX) · Live demo: Open the ret2plt demo in WolfCTF — ret2plt built -no-pie, NX on, ASLR on; return into system@plt with no libc leak. Adapted from the course archive, Chapter 14. |
| 14 | Oct 22, 2026 | GOT overwrite (ret2got): a GOT entry is writable and resolved at runtime, so a write-what-where primitive can repoint a function's GOT slot at system — turning the next library call into system("/bin/sh"). Two-stage: leak libc, then overwrite. | Class14.pdf | Editable slides (PPTX) · Live demo: Open the GOT-overwrite demo in WolfCTF — bypassGOT built -no-pie, NX on, ASLR on; leak libc then overwrite a GOT slot with &system. Adapted from the course archive, Chapter 15. |
| 15 | Oct 27, 2026 | Multi-stage exploitation: chain read/write primitives in one process so the randomized libc base survives between stages. Stage 1 leaks a real libc address through write@GOT; stage 2 drops "/bin/sh" into the fixed .bss and overwrites write@GOT with &system; stage 3 fires the PLT stub as system("/bin/sh"). The payoff of NX + ASLR + no-PIE together. | Class15.pdf | Editable slides (PPTX) · Week 10 lab handout · Week 10 code (tar.gz) · Live demo: Open the Multi-Stage Exploit box in WolfCTF — a one-click GDB + GEF terminal with multi_stage.c pre-built (NX on, dynamic). Stage 1 leaks libc through write@GOT; it loops back into the vulnerable function; stage 2 lands a ret2libc system("/bin/sh") — offset, PLT/GOT and libc offsets all derived live. cat DEMO-GUIDE.txt inside for the walkthrough. Adapted from the course archive, Chapter 16. |
| Lab 3 | Oct 27, 2026 | Multi-Stage Exploits — leak libc, overwrite the GOT, and spawn a shell under NX + ASLR, in WolfCTF | Lab 3 handout | Open your WolfCTF lab terminal · Lab 3 code · Required report & D2L guide Due Thu Nov 6, 2026, 11:59 PM Eastern · 5 points · Individual PDF report |
| 16 | Oct 29, 2026 | Stack canaries (StackGuard) and format-string bugs. Part 1: a canary sits between the locals and the saved return address and is checked on return — recover it byte by byte against a forking server (every child shares the parent's canary) and still reach win(). Part 2: printf(user_input) walks the stack — leak it with %x/%s and get an arbitrary write with %n. Closes the memory-corruption arc before the heap. | Class16.pdf | Editable slides (PPTX) · Week 10 lab handout · Week 10 code (tar.gz) · Live demos: Stack Guard (canary) box — brute-forces the canary byte by byte against the forking server and jumps to getflag(), in both 32- and 64-bit. Format String box — leaks the stack with %x/%N$x, then overwrites a global with %n ("Winner!"). Each box ships a DEMO-GUIDE.txt. Adapted from the course archive, Chapter 17. |
Assignments & Deadlines
| Assignment | Released | Due (Eastern Time) | Points | Materials |
|---|---|---|---|---|
| Lab 1 — Stack and Stack Frame Individual GDB + GEF analysis in WolfCTF | Sep 11, 2026 | Thu Sep 24, 2026 11:59 PM | 5 | Instructions Handout PDF Open lab |
Start here: Sign in to WolfCTF and open the browser terminal.
Answer Q1–Q5 with evidence from your own session. Submit Lastname_Firstname_Lab1.pdf through D2L.
Read before writing: Report structure, page format, screenshots/diagrams, rubric, and D2L instructions · Download report outline.
| Assignment | Released | Due (Eastern Time) | Points | Materials |
|---|---|---|---|---|
| Lab 2 — Stack Overflow Return-address hijack in WolfCTF (GDB + GEF) | Sep 22, 2026 | Thu Oct 8, 2026 11:59 PM | 5 | Open lab Report & D2L guide |
Lab 2 instructions: Sign in to WolfCTF and open the Stack Overflow lab. Copy the starter files, personalize lab2.c (set the buffer size to the last two digits of your student ID, and replace the placeholder name in hacked() with your own), then use a cyclic pattern in GDB/GEF to find the exact offset to the return address and redirect execution to hacked(). Submit a PDF report through D2L.
Tutorials & Supporting Materials
- Lecture videos are linked per class in the schedule above (MoozLab).
- Example code from each class is linked in its schedule row.
- WolfCTF portal guide — account setup, browser terminal, saving evidence, and troubleshooting. Portal: portal.wolfctf.com.
- How to write a lab report and submit to D2L — required sections, formatting, screenshots, diagrams, grading, and submission confirmation.
- Lab 1 report outline · Lab 1 instructions · lab1.c.