Free classes on InfoSec in Tomsk

Partly inspired by this post, I wondered why not do something similar in my city, adding a little subculture and live demonstrations of various attacks.

In total, it was decided to share knowledge by organizing free classes on InfoSec for everyone. Under the cut, the program of studies and details.
For those who are not from Tomsk - you can simply comment on selected topics and perhaps offer your own.

 I. Attacks on web applications and methods of protection
	 1) Cross-Site Scripting
		 What is XSS, types of XSS, their detection; 
		 An example of the implementation of sniffer and hijacking cookies;
		 Little about filters.
		 key words: post, get cookies, html, javascript, web-dev lang (php)

	 2) Cross-site request forgery
		 Explaining the idea of ​​a fake cross-site request;
		 Why POST is as easy as GET, a practical example;
		 CSRF + passive XSS -> hijack cookies again;
		 We defend ourselves with tokens.
		 key words: post, get, cookies, html (frame), javascript, web-dev lang (php)

	 3) Remote / Local File Inclusion
		 Example of vulnerable code
		 LFI through logs / environment variables, etc.
		 Null bytes
		 key words: web-dev lang (php)

	 4) SQL inj
		 SQL injection as a result of insufficient filtering;
		 Sequential analysis of the implementation scheme of an arbitrary request;
		 The difference of injections in different databases;
		 Practice: from injection to arbitrary execution of commands on the server.
		 key words: sql, php, unix

	 5) Denial of Service in web applications
		 Differences DDoS from DoS;
		 DB DoS server through injection, practical example;
		 Web server DoS;
		 DoS using TCP flood'ing (?).
		 key words: sql, tcp, RFC 2616
		
	 6) Software Overview
		 Scanners for breaches in web scripts;
		 Utilities for the "promotion" sql-injection;
		 Debuggers, local proxies;
		 key words: web scanner, debug, proxy, sql
		
 Ii.  Network attacks.  Attacks on the OS

	 1) Network software configuration errors and their use
	 2) Exploits.  Metasploit Framework (use + automatic exploit)
	 3) Increasing privileges in the system
	 4) Sniffing, spoofing.  Man in the middle
	 5) Network worms, botnets.  A bit about Stuxnet

So far, I have written the content of only the first “chapter” of the classes, and indeed, this is still an outline.
Key words are a list of key terms and concepts about which you must have at least an idea, otherwise the lesson will be just some kind of thriller with an incomprehensible plot.
')
By course content: 60% of practice, 40% of theory / 70% of attacks, 30% of defense. Those. each lesson will be a live demonstration of the attack or a detailed screencast.

• University / age / gender / skin color is not important
• No need to register or submit applications
• Don't pay anything to anyone

Next week, the issue of the venue will be resolved, most likely it will be the FET TUSUR building, or the Druzhba public educational institution, in general, one way or another, the South. If “broken off” everywhere (although it is very unlikely), then I think we will ask some company to provide a room. All you need is a spacious room + projector + preferably speakers.

Planned time: somewhere ~ from 5 ~ from 7 pm on Saturdays, I will lead. Of course, if you want to help in this matter - write. If everything goes well, I would also like a chapter on reverse engineering (Olly, IDA, etc.)

UPD1: The first lesson will take place this Saturday, at 15:00 in the audience of 106 Druzhba Institute of Safety and Security (South)
There will be a projector + speakers + in all the SBI, there is wifi with the exterior, which will also be needed for live demonstrations. Perhaps we will connect those who come to real attacks.
Capacity about ~ 80 people. I do not think it will come anymore) it will come more - we will bring chairs :)
PS The issue is also solved with a video recording, I think we will organize it. There is a desire to help - I will be glad.
PPS A little later, here I will publish a link to the site with centralized information and relevant news.

UPD2: Please, having VK accounts, note your presence here: vk.com/event30194153 , to know how many people to expect

UPD3: oisd.sergeybelove.ru