Cyber Security Laboratory is where we turn security concepts into careful, hands-on practice.
We will learn through authorized CTF challenges, local experiments, and short writeups that explain the evidence behind each result.
Credits: Adapted for IERG 4851 from the instructor-provided 01-01 Overview deck and the IERG4851 2026-T1 course package. Reference structure: Professor Zhou's Software Security material and ZJU CTF101 Labs.
Yajin Zhou works on security problems where software, systems, and real-world incentives meet.
How we locate vulnerabilities and build effective defenses.
Security for AI, AI for security, blockchain systems, and smart contracts.
Understanding cybercrime that leverages cryptocurrencies and digital infrastructure.
Security is not only a list of bugs. It is a way of thinking about how a system can behave when someone looks for an unexpected path.
Ask what inputs, assumptions, permissions, or states a system may have missed. This is how we discover what needs protection.
We study attacks to understand failure modes. The goal is not to attack for its own sake; it is to design, build, and maintain systems with stronger security properties.
The central idea of this course is simple: learn offense to build defense.
Study common vulnerabilities and attacks in a safe laboratory. Read the code, inputs, memory, and assumptions that make an attack possible.
Turn every observed failure mode into a design or implementation lesson: what should have been checked, isolated, validated, or protected?
Read the system and its assumptions.
Learn how a weakness is exposed.
Choose a practical protection.
Make secure choices from the start.
You do not need to arrive as a CTF expert. Curiosity and patience matter more. These foundations will help us move faster.
Read basic C and become comfortable seeing how a program becomes machine instructions.
Processes, files, permissions, memory, and the command line are recurring ideas.
Know the basic client-server model and how requests move across a network.
The course website is the public index for the schedule and browser-based slides.
yajin.org/teaching/IERG4851/2026/
Open the weekly outline to find each lecture's slides.
Course announcements and discussion are on Blackboard. Check it regularly, and always read the task instructions before you begin a lab.
Office: SHB 714
Available Friday 11:20-12:30, or make an appointment through email.
We move through one CTF category at a time, starting with the Pwn foundations that support later binary and systems work.
CTF foundations, memory, the stack, shellcode, mitigations, format strings, heap, and kernel-security context.
Client and backend security, then static and dynamic reverse engineering.
Cryptography, followed by two Misc sessions on forensics and an AI/Web3 taster.
100%
Each lab is a core part of the course assessment.
For each lab, we will have a bonus assignment.
Again, do not directly use AI to generate the answer. We will ask students to explain the detailed steps to solve the challenge.
We do not have the final exams.
A submission is strongest when another person can follow your reasoning without guessing what happened.
The task goal, relevant evidence, the commands or method you used, the result, and a brief security explanation.
Use the deadline, format, and submission policy stated for that specific exercise. Ask before assuming an exception or late-submission rule.
Use these resources to explore security topics and CTF learning material beyond the classroom.
AI can make the learning curve much less steep. Use it as a patient tutor and a thinking partner, not as a substitute for evidence.
Ask for a plain-language explanation of an assembly instruction, an ELF header field, a GDB error, or a security concept. Request a small, harmless example.
Give AI the facts you observed and ask which local tool could answer the next question. Keep the task goal and authorized boundary in the prompt.
AI can be confidently wrong. Run the check yourself, inspect the output, and be able to explain every command and conclusion in your writeup.
Security learning is collaborative, but submitted work must show your own understanding.
Compare interpretations, ask questions, and help each other understand a concept or tool.
Do not directly copy code, exploit payloads, answers, or writeups from another student or an unapproved source.
Your health matters more than this course. Security problems can be frustrating, and struggling alone rarely helps.
Reach out when a task, workload, or foundation becomes difficult. We can help make a realistic study plan.
If the course is not the right fit, discuss options early rather than carrying avoidable stress through the term.
Security techniques can be useful or harmful. In this course, every practical action stays inside the laboratory and CTF environments we provide.
It is acceptable to analyze your own systems or a target you have explicit permission to test. Accessing someone else's system without permission is unethical and can be a serious crime.