SPRITZ_PLAYGROUND are informal meetings organized by our CTF team spritzers. We meet every week on Thursday afternoon, we discuss one or more topics from introduction to expert level!
Meetings will require no previous knowledge but of previous lessons. No resources other than a laptop and a few free programs are required - we'll make it clear when announcing the meeting.
Attendance and participation to the course will award 2 ECTS for M.Sc. students in Computer Science. More information on how credits are obtained will be given at the first meeting.
The meetings will be held in Italian.
Throughout the events we will use a scoreboard to host exercises: playground.spritze.rs
| Date | Hours | Location | Category | Subject |
|---|---|---|---|---|
| 28 February 2019 | 16.30 - 18.30 | Lum250 | WEB |
Introduction to the course. Structure of a web application: web servers, CGI, proxies, life cycle. SSRF. |
| 4 March 2019 | 16.30 - 18.30 | Lum250 | REVERSE |
Introduction to the x86 ISA. Introduction to ELF. Introduction to tools, CFGs. Simple crackmes. |
| 11 March 2019 | 16.30 - 18.30 | Lum250 | PWN |
x86 address space layout basics. Data-oriented buffer overflows. Stack overflows under executable stack. |
| 18 March 2019 | 16.30 - 18.30 | Lum250 | CRYPTO |
Classical ciphers: Caesars, affine ciphers, Vigenere. OTP, OTP reuse, crib dragging. Repeating key XOR. Hashing. (CS)PRNG. |
| 25 March 2019 | 16.30 - 18.30 | P200 | WEB |
DBMS fundamentals, Interaction web application - DBMS. SQLi. |
| 1 April 2019 | 16.30 - 18.30 | Lum250 | FORENSICS |
Network packet analysis. Open-source intelligence. |
| 8 April 2019 | 16.30 - 18.30 | Lum250 | HARDENING |
Firewall. WAF: Web Application Firewall. |
| 15 April 2019 | 16.30 - 18.30 | Lum250 | CRYPTO |
Symmetric: DES, 3DES, AES, RC4. Modes of operation. CMAC, HMAC, length extension attack. Asymmetric: DH, ElGamal, RSA. Cube root attack, LSB, secure padding. Signatures: RSA, (EC)DSA. |
| 29 April 2019 | 16.30 - 18.30 | Lum250 | WEB |
Intro to client-side scripting languages. XSS vulnerabilities. |
| 6 May 2019 | 16.30 - 18.30 | Lum250 | REVERSE |
UPX packing. Introduction to C++ reversing. Crackmes with crypto. |
| 13 May 2019 | 16.30 - 18.30 | Lum250 | PWN |
GOT/PLT and GOT hijacking. Mitigations: stack canaries, ASLR, W^X, RELRO. Code reuse under W^X: stack overflows w/ ROP, PC control to ROP w/ stack pivoting. |
| 20 May 2019 | 16.30 - 18.30 | Lum250 | PWN |
Basic non-metadata-oriented heap exploitation (use-after-free, double-free). Type confusion. Virtual table hijacking (w/ stack pivoting + ROP). |
| 28 May 2019 | 16.30 - 18.30 | Lum250 | HARDENING |
Sandbox and Isolation. Docker. Cloud Security. |
| 3 June 2019 | 16.30 - 18.30 | Lum250 | CTF |