Web and Cloud Security

Instructor: Wu-chang Feng
Class: EB 92, T/Th 8:00am-9:50am
Office hours: time
Contact and discussion: TA: Anadi Shakya
  • E-mail (for GitLab): ashakya@pdx.edu (ashakya2)
  • DM pdx-cs.slack.com: @Anadi Shakya
  • Office hours: Mondays 10am-noon in Fishbowl (Outside FAB 120)
Resources
Course Description
This course covers web and cloud systems and how they can be subverted. The class will focus on the highest risk vulnerabilities, give students practical experience in how they work, and study how they can be prevented. The class will consist mostly of laboratory exercises focused on developing student skills in performing penetration testing.

Schedule

Week Topic Assignments Due (Tue)
1 Course overview, Web Basics
Web Programming
 1.1
1.2
2 Authentication, Session Management
Broken Authentication
 1.3, 1.4 (HW #1)
3 Broken Access Control Unvalidated Redirects/Forwards, File upload, File includes
SSRF, XML External Entities (XXE)
 2.1
2.2, 2.3 		Lab notebook #1, HW #1
4 HTTPS, Sensitive Data Exposure
Command, Code injection, SQL injection 		3.1
 Lab notebook #2
5 Blind SQL injection
Cross-site Scripting (XSS) 		3.2 (HW #2)
4.1 		Lab notebook #3 (3.1)
6 Content Security Policy (CSP), Cross-Origin Resource Sharing (CORS)
Cross-site Request Forgery (CSRF), Clickjacking, Web Cache Poisoning
 4.2
5.1, 5.2
 HW #2 (3.2)
7 Insecure Deserialization, Web Sockets
Request Smuggling, Misconfiguration, Insufficient Logging, APIs
 5.3, 5.4, 5.5
 Lab notebook #4
8 Tools (wfuzz, xsstrike, commix, nmap, metasploit, sqlmap)
Cloud overview, Cloud security (GCP)
 6.1, 6.2, 6.3, 6.4, 6.5
 Lab notebook #5
9 Cloud vulnerabilities
Cloud security (AWS), AWS CloudGoat iam_privesc_by_rollback, cloud_breach_s3 (in class only)
7.1, 7.2, 7.3
8.1, 8.2, 8.3, 8.4
 Lab notebook #6
10 Infrastructure/Security as Code, Terraform, AWS CloudGoat ec2_ssrf, rce_web_app (in class only), AWS Serverless Goat Cyber Kill Chain, Mitre Attack Framework, AWS CloudGoat rce_web_app
Mitre Attack Navigator, Defenses, AWS CloudGoat levels 		Lab notebook #7
Finals Lab notebook #8

Assignments

Labs and notebook
Lab assignments will be given each class covering the course material. You will maintain and turn in lab notebooks documenting your completion of each exercise. The notebook should include answers to any questions posed and screenshots requested that include your OdinID within them including a final screenshot of each solved level that contains the URL of the level instance. Notebooks should be exported as a PDF file and include a table of contents generated by Google Docs. Submission will be done via adding, committing and pushing the file to your private git repository. Use the following naming convention to submit your notebooks.
  • notebooks/<notebook_number>.pdf e.g. notebooks/1.pdf
The notebook will be graded based upon the following rubric:
  • Completeness
  • Inclusion of answers to questions asked
  • Inclusion of OdinID or project identifier in screenshots
Lab assignments will be given each class covering the course material. You will perform each one, while maintaining a lab notebook in a Google Doc that documents your progress via screenshots with your OdinID in them. The notebook should also include answers to any questions in the labs. 
Homework programs
Homework programming assignments are to be submitted via GitLab. Specific criteria and a grading rubric for each program is included in the assignment writeup.

Course objectives

  • Learn the basics of web clients, servers, protocols, and programming
  • Understand common, high-risk web and cloud vulnerabilities

  • Practice ethical hacking to demonstrate how web and cloud vulnerabilities may be leveraged
  • Develop penetration testing skills

Policies

Grading Late assignments will docked 20%, but may be turned in at any time before finals week. Late work will not be graded until the end of finals week.
Attendance 5%
Programs 30%
Lab Notebooks 65%
Attendance
In-person attendance is graded. Due to their nature, several lab exercises will only be offered during class.
Academic misconduct
  • Includes allowing another student to copy your work unless specifically allowed by the instructor.
  • Includes copying blocks of code from external sources without proper attribution
  • Results in a grade of 0 for the assignment or exam.
  • Results in the initiation of disciplinary action at the university level.