This course teaches offensive and attack-analysis techniques so that students can build and defend cryptographic systems correctly. Misusing these techniques is both an academic-integrity violation and, in most jurisdictions, a crime.
Rules
- Only attack approved targets. Use the intentionally vulnerable targets provided in the Docker labs in
labs/in this repository, or systems for which you hold explicit, written authorization (e.g., a signed scope for a bug-bounty program). - Never test third-party systems — including the university network, cloud accounts, other students' machines, or any production service — without written permission.
- Keep exploits in the sandbox. Do not deploy malware, run attacks over the campus network, or exfiltrate real data.
- Practice responsible / coordinated disclosure. If you incidentally discover a real vulnerability, do not exploit it. Report it privately to the owner and to the instructor.
- Handle credentials and secrets safely. Never commit real secrets to Git. Use the provided
.gitignoreand.envpatterns.
Acknowledgment
Every student signs an acknowledgment of this policy in Week 1. Violations are handled under the university's academic-integrity and student-conduct procedures and may carry legal consequences.
Reference
- Responsible disclosure basics: https://cheatsheetseries.owasp.org/cheatsheets/Vulnerability_Disclosure_Cheat_Sheet.html