KOSEN·KMITL — course material

Interactive simulations

Click through how an attack actually works, one step at a time. Each one is also embedded in the worksheet it belongs to; these are the full-size versions. Open to anyone, like the rest of the course material.

Why ECB leaks a picture, and what CBC's XOR costs (Week 3)

open to anyone Read the worksheet it belongs to
Classify the incident: which CIA property took the hit? (Week 1)

open to anyone Read the worksheet it belongs to
One signature, two spellings: (r, s) and (r, n − s) (Cryptography, Week 11)

open to anyone Read the worksheet it belongs to
Draw a card, tie it to your DFD — no printer needed (Week 1)

open to anyone Read the worksheet it belongs to
What actually crashes harness.c, computed live (Week 2)

open to anyone Read the worksheet it belongs to
Does this PR pass the gate? (Week 15)

open to anyone Read the worksheet it belongs to
How AWS actually evaluates a request (Cloud Infrastructure, Lesson 7)

open to anyone Read the worksheet it belongs to
Two findings, one statement: Action vs Resource wildcards (Week 13)

open to anyone Read the worksheet it belongs to
Editing a JWT: base64url is encoding, not sealing (Week 6)

open to anyone Read the worksheet it belongs to
Which fields actually get stored? (Week 10)

open to anyone Read the worksheet it belongs to
The /upload endpoint: same input, opposite outcomes (Week 1)

open to anyone Read the worksheet it belongs to
Three layers, watched one at a time (Week 14)

open to anyone Read the worksheet it belongs to
Which package actually installs? Computed live (Week 12)

open to anyone Read the worksheet it belongs to
How concatenation changes the SQL parse tree (Week 4)

open to anyone Read the worksheet it belongs to
What a stack canary detects and what FORTIFY_SOURCE prevents (Week 11)

open to anyone Read the worksheet it belongs to
Name the threat: STRIDE applied to one endpoint (Week 1)

open to anyone Read the worksheet it belongs to
Which bug is this really? Raw findings, deduplicated (Week 2)

open to anyone Read the worksheet it belongs to
Trust boundaries & threat chaining (Week 1)

open to anyone Read the worksheet it belongs to
One value, four sinks: why escaping is context-dependent (Week 5)

open to anyone Read the worksheet it belongs to

All course material