Resources
None of this is required. It's here for when a lecture moves faster than you'd like, or a lab isn't clicking.
Books
Computer Security and the Internet: Tools and Jewels
Free PDF. The closest thing this course has to a textbook — match chapters to modules.
Security Engineering (3rd ed.)
Free online. Broader and more opinionated; excellent for the why.
Free practice labs
If a topic isn't landing, these are the fastest way to build reps. Ranked roughly by how directly they map onto our assignments.
| Lab | Maps to | What it is |
|---|---|---|
| SEED Labs | Modules 1, 2 | Free, self-contained labs on overflows, web, and networking. The closest match to this course's material. |
| ROP Emporium | Module 1 | Eight ROP challenges of increasing difficulty. Do these before A3 if the chain isn't clicking. |
| pwn.college | Module 1 | ASU's full exploitation curriculum, browser-based, free. Enormous. |
| RPISEC — Modern Binary Exploitation | Module 1 | A full university course's worth of exploitation labs, free on GitHub. |
| PortSwigger — Web Security Academy | Module 2 | Free labs on XSS, CSRF, SQLi. Directly relevant to A4. |
| PortSwigger — Web LLM attacks | Module 4 | Seven free labs on prompt injection against real apps. Good warm-up for A6. |
| GPT Prompt Attack | Module 4 | Code golf for prompt injection: the shortest input that leaks the key. |
| Prompt Airlines | Module 4 | Wiz's prompt-injection CTF. Free. |
Tools worth learning
gdb + pwndbg
The debugger, plus the plugin that makes it usable.
pwntools
Python exploit development library. Worth learning properly for A2–A3.
ROPgadget
Finds gadgets. Already on the course VM.
Ghidra
NSA's decompiler. Not required, but useful for A1.
Compiler Explorer
Paste C, see the assembly. The fastest way to build intuition for Module 1.
Ollama
Runs a local model on your laptop. Required for the A6 bonus.
Everything here is AI-OK to use however you like — it's practice, not graded. The AI policy only governs what you submit and what happens in the room.