Instructor: Wu-chang Feng (wuchang)
Class: VSC 105, MW 2:00pm-3:50pm
Office hours: time
Contact and discussion:

• DM @wuchang pdx-cs.slack.com
• Post on channel #cs495
• In-class questions/feedback anonymously sayat.me

TA: Alex Hodges (hodgesa)

• DM @Alex Hodges pdx-cs.slack.com:
• Office hours: Mondays 9-11am Fishbowl (Outside FAB 120)

Resources

• Course slides on PSU Google Drive
• Python tutorial screencast
• Lecture screencasts
• Course student reviews
• Google's write-up

Course Description
This course covers web and cloud systems and how they can be subverted. The class will focus on the highest risk vulnerabilities, give students practical experience in how they work, and study how they can be prevented. The class will consist mostly of laboratory exercises focused on developing student skills in performing penetration testing.

Labs and notebook
Lab assignments will be given each class covering the course material. You will maintain and turn in lab notebooks documenting your completion of each exercise. The notebook should include answers to any questions posed and screenshots requested that include your OdinID within them including a final screenshot of each solved level that contains the URL of the level instance. Notebooks should be exported as a PDF file and include a table of contents generated by Google Docs. Submission will be done via adding, committing and pushing the file to your private git repository. Use the following naming convention to submit your notebooks.

• notebooks/Labs<notebook_number>.pdf e.g. notebooks/Labs1.pdf
  

The notebook will be graded based upon the following rubric:

• Completeness
• Inclusion of answers to questions asked
• Inclusion of OdinID or project identifier in screenshots

Lab assignments will be given each class covering the course material. You will perform each one, while maintaining a lab notebook in a Google Doc that documents your progress via screenshots with your OdinID in them. The notebook should also include answers to any questions in the labs. 

Homework programs
Homework programming assignments are to be submitted via GitLab. Specific criteria and a grading rubric for each program is included in the assignment writeup.

Final project
You will attempt to solve a sequence of levels from PortSwigger's Web Security Academy site that are taken from a set provided by the instructor. You will then perform a screencast walkthrough of the levels you solved.

Always turn in what you have done on-time. Late work will be docked 20%, but may be turned in at any time before finals week. If you submit any late work, it will be graded during finals week. Late work must be placed in the late directory in your GitLab repository and named according to the lab number. Use the following naming convention for late work: late/LabsX.pdf. For example, a late addendum to Labs1.pdf should be submitted as late/Labs1.pdf.

• Learn the basics of web clients, servers, protocols, and programming
• Understand common, high-risk web and cloud vulnerabilities
  
  

• Practice ethical hacking to demonstrate how web and cloud vulnerabilities may be leveraged
• Develop penetration testing skills

Grading

Attendance	5%
Programs	20%
Lab notebooks	55%
Final project	20%

Attendance and participation
Attendance is required and will be taken each class. Due to their nature, several lab exercises will only be offered during class. Two absences are allowed with no deduction regardless of the reason. You do not need to notify the instructor. Participation in the Slack channel is encouraged. You are expected to follow this code of conduct when communicating.

Academic misconduct

• Includes allowing another student to copy your work unless specifically allowed by the instructor.
• Includes copying blocks of code from external sources without proper attribution
• Results in a grade of 0 for the assignment or exam.
• Results in the initiation of disciplinary action at the university level.