CSCA 5313: Security & Ethical Hacking: Attacking Unix and Windows
ÌýPreview this courseÌýin the non-credit experience today!Ìý
Start working toward program admission and requirements right away.ÌýWork you complete in the non-credit experience will transfer to the for-credit experience when you upgrade and pay tuition. See How It Works for details.
- Course Type: Elective
- Specialization: Security & Ethical Hacking
- Instructors:ÌýDr. Ahmed Hamza
- Prior knowledge needed: An understanding of python programming and networking basics is required. Course assessments are practical work, quizzes and exams.
Course Description
This course explores the science and art of offensive security techniques used in penetration testing of networks and systems. Areas of focus include post-exploitation and exploitation of Unix (esp. Linux) machines/servers, and Windows OS.
A basic review of relevant x86 Assembly language constructs will be given.
Students will utilize scripting and low-level programming and other technical means to execute a variety of attacks in adversarial recon, lateral movement, privilege escalation, and authentication bypass on Unix systems, as well as active exploitation of remote memory corruption attacks on multiple OS. An introduction to general computer memory is given, along with other topics in operating systems, as needed.
Learning Outcomes
- Analyze a complex computing problem and to apply principles of computing and other relevant disciplines to identify solutions.
- Design, implement, and evaluate a computing-based solution to meet a given set of computing requirements in the context of the program’s discipline.
- Communicate effectively in a variety of professional contexts.
- Recognize professional responsibilities and make informed judgments in computing practice based on legal and ethical principles.
- Function effectively as a member or leader of a team engaged in activities appropriate to the program’s discipline.
- Apply computer science theory and software development fundamentals to produce computing-based solutions.Ìý
Course Grading Policy
| Assignment | Percentage of Grade |
|---|---|
| Ungraded Labs | 0% |
| Ethical Hacking Pledge | 5% |
| Graded Assignments | 55% (5 assignments; 11% each) |
| Final Exam | 40% |
Course Content
Duration: 3Ìýhours, 25 minutes
Module 1 provides an introduction to the course, its target systems and setup, and a quick refresher on Linux command line basics and relevant tooling.Ìý
Duration: 3 hours, 51 minutes
In Module 2, we take a deep dive into the basics and more obscure parts of the Unix security model, real and effective IDs for process execution and filesystem access, and setuid binaries. Applying that knowledge with some additional understanding of the shared library loading on Linux, we take a look at evasive privilege escalation in C.
Duration: 6Ìýhours, 46 minutes
In Module 3, we continue privilege escalation, this time with shared library hijacking techniques (function hooks and library load order exploitation). We also take a look at simpler yet equally devastating attacks, using common built-in editor software as an example of hacking by manipulating the user environment.
Duration: 9Ìýhours, 31 minutes
In Module 4, we demonstrate and discuss stealthy lateral movement techniques using built-in Unix Ìýtools, including a rare passphrase cracking opportunity on private keys, and a re-purpose a lot of SSH optimizations and existing tools (forwarding agents and Control Master).Ìý
Duration: 4 hours, 11 minutes
In this final module, we examine computer memory concepts, code execution vulnerabilities in binary programs through memory corruption, and give a refresher on the relevant x86 Assembly instructions for stack overflow primitives. Shellcode and its generation is also introduced.
Duration: 2Ìýhours, 42 minutes
This module contains materials for the proctored final exam for MS-CS degree students. If you've upgraded to the for-credit version of this course, please make sure you review the additional for-credit materials in the Introductory module and anywhere else they may be found.Ìý
Notes
- Page Updates: This page is periodically updated. Course information on the Coursera platform supersedes the information on this page. Click theÌýView on CourseraÌýbuttonÌýabove for the most up-to-date information.