CSE480 Web Security

CSE48001  Special Topic in CSE I  Fall 2026

Web Security

Learn real web attacks by conducting them yourself in weekly hands-on labs. Tuesdays & Thursdays 2:30–3:45 pm, Room 106-T205.

This course introduces various web attacks that trigger various vulnerabilities in target web services. The course also provides a lab session for each week, which helps students practice real attacks in simulated web environments. The goal of the course is to let students learn and understand various web threats via conducting the attacks by themselves.

TimeTuesdays & Thursdays
2:30–3:45 pm
LocationRoom T205, Building 106
Offline course
TextbookAndrew Hoffman,
Web Application Security
Grading (Letter Grade)
Class Participation 10% Lab Sessions 30% Assignments 30% Final Exam 30%
Late Submission Policy

Late submission will be assessed a penalty of 10% per day (we will only accept late submissions of up to 3 days).

Attendance

Attendance is taken at every session through the UNIST Mobile Attendance System. There is no separate attendance score. However, in accordance with UNIST academic regulations, nine or more absences result in an F. Attendance may also be manually re-checked at random; leaving after checking in (a.k.a., 출튀) counts as an immediate F.

If you are unable to attend a class due to unavoidable circumstances (something beyond your control, e.g., reserve forces training or hospital visits), provide supporting documents to Prof. Wi and the absence will be counted as attendance.

Class Participation

We keep a participation score, which accounts for 10% of your final grade. You earn points when (1) you ask a question during class, or (2) the professor acknowledges your contribution. If you did either of these, after the class, claim your points.

Course Staff

Seongil Wi

Instructor

Seongil Wi

Assistant Professor, WebSec Lab / Room 301-8, Building 106

seongil.wi@unist.ac.kr

Mingi Jung

Teaching Assistant

Mingi Jung

Master’s Student, WebSec Lab

wjdaslrl4475@unist.ac.kr

Jaeho Bae

Teaching Assistant

Jaeho Bae

Master’s Student, WebSec Lab

bjho@unist.ac.kr

Lab Sessions

The course has a weekly hands-on lab session where you practice web hacking on what you learned that week. You must solve the challenges within each lab session, and scores are given accordingly.

Lab Homepage

http://10.20.18.55:8280/

Log in with the account your TA sent you by email. To access the site from outside UNIST, turn on the UNIST VPN.

Schedule

Subject to change
Sep 1Tue

IntroductionSlides

Sep 3Thu

Lab #0PreparationLab Homepage

Sep 8Tue

Web Programming BasicSlides

Sep 10Thu

Lab #1HTML, JavaScript, and PHPLab Homepage

Lab #1 due Sep 11

Sep 15Tue

SQL InjectionOnlineSlides

Sep 17Thu

Lab #2SQL InjectionLab Homepage

Assignment 1 due Sep 29

(Optional) Lab #3: SQL 101

Sep 22Tue

Lab #5Advanced SQL InjectionLab Homepage

Sep 24Thu

No class (Chuseok holiday)

Sep 29Tue

HTTPSSlides

Oct 1Thu

Same Origin Policy & CookieSlides

Assignment 2 due Oct 13

Oct 6Tue

Reflected XSS, Stored XSSSlides

Oct 8Thu

Lab #6Reflected XSS, Stored XSSLab Homepage

Oct 13Tue

Client-side XSS, Universal XSSSlides

Oct 15Thu

Lab #7Client-side XSSLab Homepage

Oct 20Tue

No class (Midterm week)

Oct 22Thu

No class (Midterm week)

Oct 27Tue

Cross-site Request ForgerySlides

Assignment 3 due Nov 5

Oct 29Thu

Lab #8Cross-site Request ForgeryLab Homepage

Nov 3Tue

Shell Code Injection and File InclusionSlides

Nov 5Thu

Lab #9Shell Code Injection and File InclusionLab Homepage

Nov 10Tue

Property-Oriented ProgrammingSlides

Nov 12Thu

Lab #10Property-Oriented ProgrammingLab Homepage

Nov 17Tue

Content Security PolicySlides

Nov 19Thu

Lab #11Content Security PolicyLab Homepage

Assignment 4 due Dec 1

Nov 24Tue

Unrestricted File UploadSlides

Nov 26Thu

Lab #12Unrestricted File UploadLab Homepage

Dec 1Tue

Tracking, PhishingSlides

Dec 3Thu

XS-Leaks, 2nd Factor AuthenticationSlides

Dec 8Tue

AI SecuritySlides

Dec 10Thu

Guest Lecture

Dec 15Tue

No class (Final week)

Dec 17Thu

Final ExamExam