Vulnerability of the Day

Vulnerability of the Day is a pedagogically-curated collection of vulnerability demonstrations for undergraduate software engineering students. The goal is to teach students how to avoid simple coding mistakes by providing concise code examples. Key characteristics are:

• 10 minutes long or less
• Can be understood by a third-year college student in a software engineering course
• Socially-relevant examples
• Can be run on a Linux console, using make
• Simple, concise, but also not contrived.
• Real-world CVEs (with source code patches linked) are a big plus

Code Formatting Guidelines

• All source code must be "projector-friendly", meaning that the vast majority of the demo code should be readable at:
  • 90 characters wide
  • 48 lines long
• Having the entire program be under 48 lines is not hard rule (e.g. import statements are not super important), but the instructor should be able to show the main body, including comments, on a 4:3 projector screen with 18 point Lucida Console font in Vim with line numbers set.

Building Demos

Each VotD must have a Makefile that can run on Linux, with the following targets make, make exploit, and make compile. The default is make exploit. Here's a skeleton Makefile:

# Sample Makefile for VotD

exploit: compile
	java BankAccount
	java GetPatient

compile: 
	javac *.java

The one exception are web-based vulnerabilities (e.g. XSS), which require different building guidelines (TBD)

Layout

a-votd-dir/
    www/ - webpage descriptions of each vulnerability. See the www/Readme.markdown for more details
    demos/ - code examples for each vulnerabilitiy 
    instructors/ - notes for instructors in each vulnerability  

Building an Individual VotD

Details are TBD, but here's what I'm thinking. Sometimes a prof might want to just demo one VotD to the class. So they might do something like:

make integer-overflow

and it:

• Copies the code sample
• Makes an individual webpage for that VotD
• Optionally copies the instructor notes
• Zips it up and the webpage links to the zip

Or, maybe:

make website votds.txt

and it reads the text file for the votds, builds the webpage, and copies instructor notes for each day.

And, maybe:

make new a-new-votd

and that makes a new set of directories for a votd