How we learn
Observe the supplied artefact, form a hypothesis, test it in the authorized environment, and explain the result.
Course overview
A hands-on introduction to cyber security through authorized Capture The Flag challenges and laboratory exercises.
In-class practice
Short practical exercises build confidence with tools, program behaviour, and security reasoning.
Course rule
Work only on files, binaries, and systems explicitly provided for this course or a CTF event.
Teaching Assistant
Teaching Assistant
Zhentao XIE
Office: SHB 725 & 726
Weekly outline
Tentative. Topics and materials may be adjusted as the course progresses. New slides will appear in the lecture materials list.
Week 7 (23 Oct) is an in-class CTF. 60 minutes of solving, then 45 minutes in which one or two students walk us through their approach to a challenge. Please plan to attend — attendance counts as one of the factors in the final course evaluation, so if you cannot come, request leave in advance.
| Week | Date | Topic | Slides |
|---|---|---|---|
| 1 | Sep 11 | Course Introduction & In-class Quiz; lab environment setup | 00 · Course Overview 01 · Introduction to CTF 01-06 · Exercise Readmes Ungraded report: Blackboard, 17 Sep 23:59 |
| 2 | Sep 18 | Pwn 1 — Buffer Overflow & ret2libc | 02-01 · Buffer Overflow & ret2libc (PDF) 02 Lab · In-Class Manual Ungraded practice record: Blackboard, Sep 24 23:59 |
| 3 | Sep 25 | Pwn 2 — ret2libc with ASLR & ret2libc 64bit | 03-01 · ret2libc with ASLR, 32-bit (PDF) 03-02 · ret2libc 64-bit (PDF) 03 Lab · In-Class Manual 03 Demo/Lab · Classroom Code |
| 4 | Oct 2 | No class — Academic leave | No lecture |
| 5 | Oct 9 | Pwn 3 — Format String | 05-01 · Format String (PDF) 05 Lab · In-Class Manual |
| 6 | Oct 16 | Pwn 4 — Heap | 06-01 · Heap (PDF) 06 Lab · In-Class Manual |
| 7 | Oct 23 | In-class CTF — 60 min solving, then walk-throughs | In class · no slides |
| 8 | Oct 30 | Pwn 5 — Kernel Exploitation (Linux kernel, Kernel ROP) | To be posted |
| 9 | Nov 6 | Web 1 — Client-side Attacks (XSS, CSRF) | To be posted |
| 10 | Nov 13 | Web 2 — Backend Vulnerabilities (SQLi, SSRF, upload, cmd injection) | To be posted |
| 11 | Nov 20 | Reverse 1 — RE Basics (Ghidra, static/dynamic) | To be posted |
| 12 | Nov 27 | Reverse 2 — Advanced RE (VM reversing, anti-debug, obfuscation) | To be posted |
| 13 | Dec 4 | Crypto — Classical, Symmetric & RSA/Asymmetric | To be posted |
| Make-up | Dec 8 Tue, 1:30 p.m. - 3:15 p.m. | Misc — Forensics + AI/Web3 taster | Make-up session · Venue: SC 139 (Science Centre, Room 139) |