Vulnerability and Attack Labs
People learn from mistakes. In security education, we study mistakes
that lead to software vulnerabilities. Studying mistakes from the
past not only help students understand why systems are vulnerable, why
a "seemly-benign" mistake can turn into a disaster, and
why many security mechanisms are needed. More importantly,
it also helps students learn the common patterns of vulnerabilities,
so they can avoid making similar mistakes in the future.
Moreover, using vulnerabilities as case studies,
students can learn the principles of secure design, secure programming,
and security testing.
(1) Software in general
- Set-UID Lab:
exploit the vulnerabilities of the privileged Set-UID programs.
-
Buffer Overflow Vulnerability Lab:
exploit the buffer overflow vulnerability using the shell-code approach.
-
Return-to-libc Attack Lab:
exploit the buffer-overflow vulnerabilities using the return-to-libc attack.
-
Format String Vulnerability Lab:
exploit the format string vulnerability.
-
Race Condition Vulnerability Lab:
exploit the race condition vulnerability.
- Chroot Sandbox Vulnerability Lab:
explore how the chroot sandbox can be broken.
(2) Network Protocols
- TCP/IP Attack Lab: exploit the vulnerabilities
of the TCP/IP protocols.
- DNS Pharming Attack Lab
(New):
exploit the vulnerabilities of the DNS protocol to
launch Pharming attacks.
(3) Web Applications
-
Cross-site Scripting Attack Lab
exploiting cross-site scripting vulnerabilities.
-
Cross-site Request Forgery Attack Lab
(New):
exploiting cross-site request forgery vulnerabilities.
-
SQL-Injection Attack Lab
(New):
experience the SQL-Injection attacks
Design/Implementation Labs
The objective of the design/implementation labs is to
provide students with opportunities to apply security principles
in
designing and implementing systems.
They help students achieve learning by system development.
- Capability Lab: design and implement
a capability-based access control system for Minix (this is a comprehensive project).
- Role-Based Access Control (RBAC) Lab -- Minix Version
design and implement an integrated access control system for Minix
that uses both capability-based and role-based access control
mechanisms. Students need to modify Minix kernel to implement both capability
and RBAC (this is a comprehensive project for access control).
- Role-Based Access Control (RBAC) Lab --
Linux Version
(new):
design and implement a RBAC access control system for Fedora Linux
based on the POSIX 1.e capability in Fedora. This lab takes advantage of
Linux Security Module (LSM), so there is no need to modify or recompile
Linux kernenl (this is a comprehensive project for access control).
- Encrypted File System Lab
(Recently Revised):
design and implement an encrypted file system for Minix (a comprehensive project).
- Set-RandomUID Lab: design and
implement a simple sandbox for Minix.
- IPSec Lab:
implement the IPSec protocol (simplified) for Minix (a comprehensive
project).
- Firewall Lab
(New):
implement a simple firewall (called minifirewall) for Minix.
- Address Space Layout Randomization (ASLR) Lab
(New):
randomize stack and heap in Minix to improve security.
Exploration Labs
The objective of the exploration labs is two-fold: the first is
to enhance students' learning via observation, playing and exploration, so
they can see what security principles ``feel'' like in a real system;
the second objective is
to provide students with opportunities to apply security principles
in
analyzing and evaluating systems.
The exploration labs provide a feasible means by which the students have
"a direct encounter with the phenomena being studied rather than merely thinking
about the encounter, or only considering the possibility of doing something
about it".
- Set-UID Lab:
explore the Set-UID
mechanism and the vulnerabilities of Set-UID programs.
-
Linux Capability Exploration Lab
(new): explore the capability access
control in Linux.
- Web Browser Access Control Lab: Exploring the access control mechanism in
web browsers.
- Pluggable Authentication Modules (PAM) Lab:
explore a flexible authentication technique.
- SYN Cookies Lab:
explore the SYN Cookies mechanism in Linux.
- Linux Security Module (LSM) Exploration Lab: explore the LSM and see
how it can be used to extend and change Linux's access control.
- RBAC Exploration Lab (under development)
- Mandatory Access Control (MAC) Exploration Lab (under development)
- Encrypted File System Exploration Lab (under development)
- IPSec and VPN (Virtual Private Network) Exploration Lab (under development)
- Intel 80386 Protection Mode Exploration Lab (under development)
Other Labs that we plan to develop
- Access Control List Lab
- Reference Monitor Lab:
explore the reference monitor of Minix.
- Mandatory Access Control Lab (Simplified from SELinux)
- Jail Sandbox Lab (Simplified from FreeBSD).
- Sniffer Lab
- Firewall Lab
- Routing Security Lab
- Intrusion Detection Lab
- Kerberos Lab