Midterm — Written Exam
Covers Weeks 1–6
Format
- Duration: 120 minutes
- Closed book unless stated otherwise
- 100 pts, 4 sections: A Concepts (30) · B Spot the Vuln (20) · C Applied SQL Injection (30) · D Design (20)
What's assessed
- A — Concepts (30): CIA triad, STRIDE modeling, SAST/DAST/SCA/fuzzing, hashing vs. encryption vs. encoding, trust boundaries, least privilege / fail closed
- B — Spot the Vuln (20): find & name the flaw + CWE in a code snippet
- C — Applied SQL Injection (30): given a vulnerable endpoint, write the payload and the reasoning — auth bypass, cross-DB fingerprinting, schema/table dump. No fix credit here — that's Section D's job
- D — Design (20): SQLi defenses (incl. the fix Section C doesn't grade); design a secure password-reset flow
Tips
- Read the code carefully before answering "spot the vuln"
- For Section C: write the actual payload, not a description of one — plus the one-line reasoning. No fix credit in C; don't spend exam time writing one there
- Name the fix, not just the bug, for B and D
- Map every finding to a CWE / OWASP category
Good luck
Week 9: hands-on CTF practical