How we learn
Observe the supplied artefact, form a hypothesis, test it in the authorized environment, and explain the result.
Course overview
A hands-on introduction to cyber security through authorized Capture The Flag challenges and laboratory exercises.
In-class practice
Short practical exercises build confidence with tools, program behaviour, and security reasoning.
Course rule
Work only on files, binaries, and systems explicitly provided for this course or a CTF event.
Teaching Assistant
Teaching Assistant
Zhentao XIE
Office: SHB 725 & 726
Weekly outline
Tentative. Topics and materials may be adjusted as the course progresses. New slides will appear in the lecture materials list.
| Week | Date | Topic | Slides |
|---|---|---|---|
| 1 | Sep 11 | Course Introduction & In-class Quiz; lab environment setup | 00 · Course Overview 01 · Introduction to CTF 01-06 · Exercise Readmes Ungraded report: Blackboard, 17 Sep 23:59 |
| 2 | Sep 18 | Pwn 1 — Memory, the Stack & Buffer Overflow | To be posted |
| 3 | Sep 25 | Pwn 2 — Shellcode & Control-flow Hijack (ret2win / ret2shellcode) | To be posted |
| 4 | Oct 2 | Pwn 3 — Mitigations & ROP (NX/Canary/ASLR, ret2libc) | To be posted |
| 5 | Oct 9 | Pwn 4 — Format String & Heap (+ integer overflow) | To be posted |
| 6 | Oct 16 | Pwn 5 — Kernel Exploitation (Linux kernel, Kernel ROP) | To be posted |
| 7 | Oct 23 | Web 1 — Client-side Attacks (XSS, CSRF) | To be posted |
| 8 | Oct 30 | Web 2 — Backend Vulnerabilities (SQLi, SSRF, upload, cmd injection) | To be posted |
| 9 | Nov 6 | Reverse 1 — RE Basics (Ghidra, static/dynamic) | To be posted |
| 10 | Nov 13 | Reverse 2 — Advanced RE (VM reversing, anti-debug, obfuscation) | To be posted |
| 11 | Nov 20 | Crypto — Classical, Symmetric & RSA/Asymmetric | To be posted |
| 12 | Nov 27 | Misc — Forensics + AI/Web3 taster | To be posted |
| 13 | Dec 4 | Misc 2 — Forensics + AI/Web3 taster (continued) | To be posted |