Analysis and Exploration of Vulnerabilities 2026/2027

Subject lectured to the 1st year of the Masters in Cybersecurity, providing a view over the issue of vulnerability management, it’s assessment, impact, and then exploration.

This edition will be lectured by professor João Paulo Barraca (email: jpbarraca@ua.pt). Teaching staff will be available by email and Discord. The use of the Discord platform for direct communication is highly recommended. Official course information will be available in this page, while grades will be available through E-learning.

Classes will be lectured in the Portuguese language, unless there is a foreign student attending. In this case English will be used. All lecture notes and laboratory guides will be made available in English. Examinations will be made available in Portuguese, and in English if required for foreign students.

Prospecting students should be aware that this subject some knowledge and comprehension of several topics in the areas of networking, software and operating systems, such as: the Python/C/PHP, Linux console usage (mostly Debian), virtual machines, sockets, HTTP and HTML technologies, and AMD64 assembly. Although lacking specific knowledge is not critical, the contents will expect you to have some base knowledge on those topics.

Rules of Engagement

These rules apply to every lecture, laboratory session and assignment in this course, and they are not negotiable. Violating them is treated as a serious academic offence, independently of any legal consequences your actions may carry.

  • Attack only systems you own, or systems that staff have explicitly given you in writing for a given exercise. This includes the vulnerable environments you run yourself, the course CTF platform within its stated limits, and nothing else.
  • Never point a scanner, an exploit, a fuzzer or a bot at the university network, its services or other students’ machines, and never at a third-party host on the public internet. Not even the ones you are able to break.
  • Vulnerable machines are vulnerable by design. Keep them inside a virtual machine, isolated from the network you work on, do not expose them beyond the interfaces you need, and shut them down when you have finished with them.
  • Do not publish exploits, PoCs, configurations or findings for a target that is still unpatched anywhere, and do not open issues or pull requests against an affected project without agreeing it with staff first. Where you find a flaw nobody has reported, tell staff before you do anything else.
  • Malware and exploit code that circulates in teaching material stays in the lab. Do not move it onto a machine you use for anything else.
  • If a step you have been asked to perform is unclear about what you are allowed to touch, stop and ask. Asking costs nothing; guessing costs a great deal.

Each assignment repeats the constraints that are specific to it, and the assignment text governs in those cases.

Important Dates

  • Assignment 1 - CVE Brief: October 2nd
  • Assignment 2 - Midterm Challenges: session November 20th, writeup November 27th
  • Assignment 3 - Research Project: December 18th

Planning

According to the UA academic schedule, classes will be lectured from September 14th, until December 19th. The subject is composed by a 3 hours of theoretical/practical lectures. It is expected that students spend an additional 2-3 hours per week exploring the concepts presented during the lectures, preparing projects and assignments. It is also expected them to make use of the tutoring times if they have questions or require some assistance. Theoretical classes will present key aspects related with vulnerability management, vulnerability assessment, relevant vulnerabilities in current service architectures (mostly web or REST based), lower level aspects related with stacks, heaps and other vulnerabilities, and then mobile applications.

The topics lectured in each class should be as presented in the following table. Changes may happen, so please check it frequently.

# Date Topic
1 Sep 18 Vulnerabilities
2 Sep 25 Information Leakage
3 Oct 02 Vulnerability Assessment
4 Oct 09 Injection Vulnerabilities: SQLi
5 Oct 16 Injection Vulnerabilities: OS Injection
6 Oct 23 Broken Authentication
7 Oct 30 XSS - Cross Site Scripting
8 Nov 06 XSS - Cross Site Scripting
9 Nov 13 Stack Overflow attacksProject support
10 Nov 20 Midterm CTF
11 Nov 27 ROP and String format attacks
12 Dec 04 Heap based attacks
13 Dec 11 Concurrency
14 Dec 18 Project wrapping up

Software

  • Bettercap: The Swiss Army knife for WiFi, Bluetooth Low Energy, wireless HID hijacking and Ethernet networks reconnaissance and MITM attacks.
  • Wireshark: The most popular packet sniffer application.
  • WebGoat: A deliberately insecure web application maintained by OWASP designed to teach web application security lessons.
  • Kali Linux: A popular Penetration Testing Distribution.
  • John the Ripper: A password Cracker.
  • Hashcat: Advanced Password Recovery tool, especially tailored at OpenCL.
  • nmap: Probably the most famous port scanner and reconnaissance tool.
  • Burp Suite: Vulnerability assessment tool
  • ZAP: Zed Attack Proxy is a vulnerability assessment tool, similar to Burp, but open source.
  • Podman: Container engine used in this course instead of Docker. Daemonless, rootless, and command-line compatible with Docker.
  • GDB: GDB: The GBU Project Debugger
  • Radare2: An open source software framework for reverse engineering and analyzing binaries.
  • ghidra: A software reverse engineering (SRE) framework developed by NSA’s Research Directorate.
  • pwntools: CTF framework and exploit development library
  • sqlmap: Automatic SQL injection and database takeover tool
  • Metasploit: Penetration Testing Framework
  • GDB GEF: GDB Enhanced Features
  • ImHex: A modern hex editor
  • Docker: Containerization platform

Websites

Books

Most books are available through the O’Reilly library, which is available to all students using their University credentials.

Next

Last updated on 18 Sep 2026