Real-world Vulnerability Discovery

Overview

SemesterSummer 2024
Course typePractical Course/ Lab
LecturerTT.-Prof. Dr. Wressnegger, KITCTF
AudienceInformatik Master & Bachelor
Credits4 ECTS
Room149 and -120, Building 50.34
LanguageEnglish and/or German
Linkhttps://ilias.studium.kit.edu/goto.php?target=crs_2359846&client_id=produktiv
RegistrationTBA

Description

In this practical course, you work on finding 0-day vulnerabilities in real-world software. You practically learn about exploitation techniques, bug-bounty programs, and vulnerability disclosure. Students will engage in collaborative vulnerability research investigating the security of pre-defined software targets. However, instead of working in a controlled/staged setup with toy vulnerabilities, you will analyze real-world software found in production with an undefined number of vulnerabilities.

You will report your findings in the scope of the vendor's bug-bounty programs or similar disclosure procedures, striving to have a CVE number assigned to the found vulnerability.

Schedule

DateStep
Thu, 25. April, 15:45–17:15Kick-off Meeting
Thu, 25. April, 19:00What are CTFs? & Web Security
Thu, 2. May, 19:00Reverse Engineering
Thu, 16. May, 19:00Binary Exploitation
Thu, 6. Jun, 19:00Cryptography
...TBA
Thu, 18. JulHand-in Write-up and PoC
Thu, 25. Jul, 15:45–17:15Presentation at final colloquium

Prerequisites

You should have successfully passed the following courses:

  • Lecture "Informationssicherheit"
  • Practical course "Anwendungssicherheit"