CSE480 Web Security

CSE480  Special Topic in CSE I  Fall 2026

Web Security

Learn real web attacks by conducting them yourself in weekly hands-on labs. Tuesdays & Thursdays 2:30–3:45 pm, Room 106-T205.

This course introduces various web attacks that trigger various vulnerabilities in target web services. The course also provides a lab session for each week, which helps students practice real attacks in simulated web environments. The goal of the course is to let students learn and understand various web threats via conducting the attacks by themselves.

TimeTuesdays & Thursdays
2:30–3:45 pm
LocationRoom T205, Building 106
Offline course
TextbookAndrew Hoffman,
Web Application Security
Grading (Letter Grade)
Class Participation 10% Lab Sessions 30% Assignments 30% Final Exam 30%
Late Submission Policy

Late submission will be assessed a penalty of 10% per day (we will only accept late submissions of up to 3 days).

Attendance

Attendance is taken at every session through the UNIST Mobile Attendance System. There is no separate attendance score. However, in accordance with UNIST academic regulations, nine or more absences result in an F. Attendance may also be manually re-checked at random; leaving after checking in (a.k.a., 출튀) counts as an immediate F.

If you are unable to attend a class due to unavoidable circumstances (something beyond your control, e.g., reserve forces training or hospital visits), provide supporting documents to Prof. Wi and the absence will be counted as attendance.

Class Participation

We keep a participation score, which accounts for 10% of your final grade. You earn points when (1) you ask a question during class, or (2) the professor acknowledges your contribution. If you did either of these, after the class, claim your points.

Course Staff

Seongil Wi

Instructor

Seongil Wi

Assistant Professor, WebSec Lab

Room 301-8, Building 106

seongil.wi@unist.ac.kr

Mingi Jung

Teaching Assistant

Mingi Jung

Master’s Student, WebSec Lab

wjdaslrl4475@unist.ac.kr

Jaeho Bae

Teaching Assistant

Jaeho Bae

Master’s Student, WebSec Lab

bjho@unist.ac.kr

Lab Sessions

The course has a weekly hands-on lab session where you practice web hacking on what you learned that week. You must solve the challenges within each lab session, and scores are given accordingly.

Lab Homepage

https://10.20.18.55:2070/

  • Log in with the account your TA sent you by email. To access the site from outside UNIST, turn on the UNIST VPN.
  • Do not attack the CTF environments, including web services!
  • If you think the services are not working properly or have any question, please post your question on the Blackboard.

Schedule

Subject to change
Sep 1Tue

IntroductionSlides

Sep 3Thu

Lab #0PreparationLab Homepage

Sep 8Tue

Security & Web Programming BasicSlides

Sep 10Thu

Lab #1HTML, JavaScript, and PHPLab Homepage

Sep 15Tue

SQL InjectionOnlineSlides

No offline class

A recorded lecture video will be provided

Sep 17Thu

Lab #2SQL InjectionLab Homepage

Assignment 1 out

(Optional) Lab #3: SQL 101

Sep 22Tue

Lab #4Advanced SQL InjectionLab Homepage

Sep 24Thu

No class (Chuseok holiday)

Sep 29Tue

HTTPSSlides

Assignment 1 due at 11:59 pm

Oct 1Thu

Same Origin Policy & CookieSlides

Oct 6Tue

Reflected XSS, Stored XSSSlides

Assignment 2 out

Oct 8Thu

Lab #5Reflected XSS, Stored XSSLab Homepage

Oct 13Tue

Client-side XSS, Universal XSSSlides

Oct 15Thu

Lab #6Client-side XSSLab Homepage

Assignment 2 due at 11:59 pm

Oct 20Tue

No class (Midterm week)

Oct 22Thu

No class (Midterm week)

Oct 27Tue

Cross-site Request ForgerySlides

Assignment 3 out

Oct 29Thu

Lab #7Cross-site Request ForgeryLab Homepage

Nov 3Tue

Shell Code Injection and File InclusionSlides

Nov 5Thu

Lab #8Shell Code Injection and File InclusionLab Homepage

Assignment 3 due at 11:59 pm

Nov 10Tue

Property-Oriented ProgrammingSlides

Nov 12Thu

Lab #9Property-Oriented ProgrammingLab Homepage

Nov 17Tue

Content Security PolicySlides

Nov 19Thu

Lab #10Content Security PolicyLab Homepage

Assignment 4 out

Nov 24Tue

Unrestricted File UploadSlides

Nov 26Thu

Lab #11Unrestricted File UploadLab Homepage

Dec 1Tue

Tracking, PhishingSlides

Assignment 4 due at 11:59 pm

Dec 3Thu

XS-Leaks, 2nd Factor AuthenticationSlides

Dec 8Tue

AI SecuritySlides

Dec 10Thu

Guest Lecture

Dec 15Tue

No class (Final week)

Dec 17Thu

Final ExamExam