| Semester | Winter 2023 |
| Course type | Practical Course/ Lab |
| Lecturer | Jun.-Prof. Dr. Wressnegger, KITCTF |
| Audience | Informatik Master & Bachelor |
| Credits | 4 ECTS |
| Room | 148 and -120, Building 50.34 |
| Language | English and/or German |
| Link | https://campus.kit.edu/campus/all/event.asp?gguid=0x5100486A93464FA7B0E81A3F76FB9CC6 |
| Registration | https://ilias.studium.kit.edu/goto.php?target=crs_2233969&client_id=produktiv |
In this practical course, you work on finding 0-day vulnerabilities in real-world software. You practically learn about exploitation techniques, bug-bounty programs, and vulnerability disclosure. Students will engage in collaborative vulnerability research investigating the security of pre-defined software targets. However, instead of working in a controlled/staged setup with toy vulnerabilities, you will analyze real-world software found in production with an undefined number of vulnerabilities.
You will report your findings in the scope of the vendor's bug-bounty programs or similar disclosure procedures, striving to have a CVE number assigned to the found vulnerability.
| Date | Step |
| Thu, 2. Nov, 15:45–17:15 | Kick-off Meeting |
| Thu, 2. Nov, 19:00 | What are CTFs? & Web Security |
| Thu, 9. Nov, 19:00 | Reverse Engineering |
| Thu, 16. Nov, 19:00 | Binary Exploitation |
| Thu, 23. Nov, 19:00 | Cryptography |
| ... | TBA |
| Thu, 23. Nov, 19:00 | Cryptography |
| Thu, | Hand-in Write-up and PoC |
| Thu, | Presentation at final colloquium |
You need to have successfully passed the following courses: