I recently had the pleasure to enroll and finish CNIT 127 course on exploit development in the Fall of 2018. I hope that the interested individual will find answers to their questions in this review.
samsclass’s CNIT 127 is an introductory course on exploit development. The student journey includes reading Shellcoder’s Handbook, the defacto book on exploit development, watching video lectures hosted on YouTube and conducted by the charismatic and superbly-talented Mr. Sam Bowne (@sambowne)– who’s also the creator of this course–, and finally practicing all what has been learned with lab environments, either hosted online on samsclass.info or a virtualized environment in the student’s host machine.
What attracted me to the course was the fact that this was an actual university course, made by a university professor who’s full-time job is to teach and educate. Another attractive point was the time schedule. I sometimes tend to compress all what I need to achive in a given project into a few tasks and complete them as fast as possible without stopping and smelling the flowers. The nice thing about this course, and the rest of Mr. Bowne’s classes, is that they are based on a university schedule. I couldn’t set a tight schedule to finish things within one month since the projects and the lectures has not been uploaded yet. That was a big plus for me. I believe this is one of the good allures of online classes to many people, certainly for me. I believe they belong to a different class of education than reading a book and following the given exercises.
The student’s journey towards understanding, reading and writing explits will surely involve them in many facets of security engineering. The student will learn how to: - Debug applications - Interact with servers - Understand strings, unicode and how they could get exploited - Understand the layout of stack and heap memory regions
One class a week. The lectures are all hosted on YouTube and the student can join online to attend a live class. Attendance is not mandatory, so students in different timezones, myself included, wouldn’t have an issue.
I think there’s a total of 13 lectures for this semester’s class. Each lecture is around 60-90 minutes long. During the lecture, Mr. Bowne runs one or two Kahoots– a small multiple-choice quiz to test the participants grasp so far. I believe it was a fantastic tool and it certainly helped summarize the different sections during the lecture.
As for the labs, most of them required the installation of a x86 Kali Linux machine and running GCC compiler for a vulnerable snippet of code to which the student will have to exploit. It was actually quite easy to replicate and setup.
Some of “Extra-credit” were hosted online where the student basically has to attack the machine and append a text file to display their name on the scoreboard. These exercises definitely got the competitive spirit in me. I was very happy to have spent those hours scouring through the book to get all the answers right.
As for deadlines, I have to mention that this course is tough. Apart from the extra-credit labs, most of the labs have walkthroughs that are explained, in detail. This doesn’t change the fact that a heap overflow is not a heap overflow that requires a deep study into the memory of the running application.
I have a full-time job and was taking CNIT 123 along with this class in the same semester. I calculated that I spent close to 46+ hours, per month, for 4 months on both courses to finish all the labs, all the extra-credits, all the lectures, and read the Shellcoder’s book. I assure you, you will learn about exploit development after this, but it’s important to know that it is a challenging course, especially if the student is planning to take more than one of Mr. Bowne’s classes. Good luck to those CCSF students :)
The course creator and teacher is Mr. Sam Bowne, renowned security teacher at City College of San Fransisco aand host of samsclass.info.
Mr. Bowne was presenting the topics as if they were personal anecdotes while following a very strict curriculum, the complicated subjects most practioners dread regarding memory layouts and debugger usages were straigtened-out with practical real-life examples. No question was left unanswered. He takes great care in ensuring all the labs are working with the correct versioning for each binary and code snippet. I sincerely consider Mr. Bowne an inspiration and would love to thank him one time in person for the work, professionalism and dilligence that he has put up in those courses and in his teaching. I think those CCSF students are quite lucky to have such a teacher.
Overall I was very pleased with the course content of CNIT 127. I think the best take-away I can get from the course is a proper understanding of debugger usage, memory layouts, and the ability to read and manipulate assembly without sweating too much. I’m very grateful to CCSF and Mr. Bowne for making those CNIT classes. You can recognize quality work when you see it.
As for my score, I finished the following of samsclass.info’s classes:
Yay!! :)