Skip to main content

All weeks · Overview · Mock CTF

Week 7 · Lecture slides

Week 7

Contents8 sections

Reflection & Review

Pre-Midterm · Weeks 1–6

Goal today

  • Consolidate Weeks 1–6
  • 🎯 Security Jeopardy team quiz-show
  • 🧪 Mock CTF in the midterm format
  • Build your one-page cheat sheet

Map of the half

A revision map of weeks 1 to 6: untrusted input crosses a trust boundary toward a sink, and every week places its control exactly at that crossing. Week 1 threat modeling: draw the DFD, run STRIDE at each crossing. Week 2 SDLC/tooling: Semgrep, Gitleaks, DAST and fuzzing catch what rides through commit/build/run unseen. Week 3 crypto: argon2id + AES-GCM with the key from the environment, not MD5/ECB with a fixed key. Week 4 injection: a parameterized query, no shell, an allow-list on the host. Week 5 XSS/CSRF: contextual encoding, a strict CSP, SameSite plus a real CSRF token. Week 6 auth: deny by default, a server-side owner check, and verifying the JWT's algorithm and signature.

🎯 Security Jeopardy

Categories × point values:

Threat ModelingToolingCryptoInjectionXSSAuth

🧪 Mock CTF

Same format as Week 9, 6 challenges, ~150 min:

  • Injection (SQLi / command)
  • XSS (stored only — reflected/DOM aren't in this mock)
  • Auth / IDOR / JWT
  • Crypto (crack a hash — the ECB oracle is a Week 3 lab task, not part of this mock)

No surprises on exam day.

Common mistakes to avoid

  • Confusing encoding vs encryption vs hashing
  • "Validated input" ≠ safe → still parameterize
  • Authentication without authorization
  • Trusting client-side checks

Deliverable

A one-page cheat sheet (your own) — may be allowed in the exam at instructor's discretion.

Midterm next week

Wk 8 = written · Wk 9 = hands-on CTF · covers Weeks 1–6

All weeks in Software Security