Week 9 · slides

Week 9

← all weeks · readme · ctf

marp: true theme: default paginate: true header: "Software Security · Week 9 · Midterm"

Week 9

Midterm — Hands-on CTF Practical

Covers Weeks 1–6 · Individual

<!-- Proctor deck. BEFORE class: plant per-student flags (seed_flags.py + the flag-planting notes in exams/week09-…-answers.md), bring up the targets, open CTFd. Confirm everyone's VM/Docker works in the first 5 min. -->

Format

  • Timed, in the sandbox
  • Each solved challenge = a flag = points
  • Partial credit for documented progress

<!-- State the time (150 min) + that flags are per-student (copying is traceable via seed_flags.py verify). Submit via CTFd or the Form. ~2 min. -->

Challenge areas

  • Injection — SQLi / command (DVWA / Juice Shop)
  • XSS — reflected / stored / DOM (Juice Shop)
  • Auth / access — IDOR, weak JWT forgery
  • Crypto — crack a weak hash / break an ECB oracle

<!-- Same areas as the W7 mock — no surprises. Extra challenges available in exams/item-bank.md (CTF pool) if you rotate. -->

Rules

  • Sandbox targets only — ethics policy applies
  • Submit flags + a short note on method per challenge
  • No collaboration

<!-- Stress: attack only provided targets; per-challenge submit flag + 1-line method + mitigation (the method note earns partial credit + supports grading). Then start the clock. -->

Submit your flags

Next: Unit C — Systems & Modern Stack (Week 10, API security)

<!-- Close: collect submissions; grade with the answer key + seed_flags.py verify for copied flags. Preview W10 (APIs). -->