powstik
Prove
LiveProof-of-Work · Oct–Nov: every verified proof counts. 35 days leftAll outcomes
Skills

Find Security Holes in C Programs

6 weeks · 2 milestones

Identifying Security Vulnerabilities in C/C++ Programming (Exploit Education: Phoenix), then one project of your own. Part of the Varsity Curriculum: Computer Science.

Milestone map

Milestone map

2 milestones

Do the course work in public

2–4 weeks (5 hrs/week)

Take Identifying Security Vulnerabilities in C/C++ Programming for free and do Phoenix levels on memory bugs (stack, format string, heap), each with a write-up. Keep everything in one public repo or notebook as you go. OSSU lists a Coursera course. We use the free Exploit Education Phoenix levels.

Proof required

Link your public repo or notebook with Phoenix levels on memory bugs (stack, format string, heap), each with a write-up, and a screenshot or log showing the self-check passed.

What gets checked

  • Each level's goal message is shown.
  • Write-ups explain the memory bug.
  • Each names how the code should have been written.

Common mistakes

  • Copying posted answers: verifiers read the history.
  • Skipping the self-check, then asking for review too early.

Powstik Guide

A public repo or notebook with Phoenix levels on memory bugs (stack, format string, heap), each with a write-up.

Steps

  1. Make a public repo or notebook first.
  2. Do one unit at a time and commit after each.
  3. Run the self-check: Run the Phoenix virtual machine and solve each level; a level is done when its goal message prints.
  4. Write a short README: what is here and how to run it.
  5. Ask three people who know the topic to check it.

Template

README
Course: Identifying Security Vulnerabilities in C/C++ Programming (Exploit Education: Phoenix)
What is here:
How to run it:
Self-check result:
What was hardest:

What gets sent back

  • No history, just one big upload.
  • Self-check not shown.
  • Code that does not run from the README.

Resources

Foundationstart here

Depthgo deeper

What a verifier looks for

  • Each level's goal message is shown.
  • Write-ups explain the memory bug.
  • Each names how the code should have been written.
  • Ask one question about a choice in the code; the answer should be clear.

You'll sign in first, then come straight back here.

Fix a memory bug in C code

1–3 weeks (5–8 hrs/week)

Use what you learned. Make a small C program with a memory bug you found (by a fuzzer or sanitizer), and the fix. Keep it small enough to finish in about two weeks.

Proof required

Link a small C program with a memory bug you found (by a fuzzer or sanitizer), and the fix, with a README that says how to run or read it.

What gets checked

  • The bug is shown by a tool's output.
  • The fix removes it (tool output after).
  • The write-up is clear.

Common mistakes

  • A project too big to finish.
  • A demo that only works on your machine.

Powstik Guide

A small C program with a memory bug you found (by a fuzzer or sanitizer), and the fix.

Steps

  1. Write one line: what it does and for whom.
  2. Build the smallest version that works.
  3. Test it on someone else's machine or with someone else reading it.
  4. Write the README.
  5. Ask three people to check it.

Template

README
What it does:
Who it is for:
How to run it:
What I would do next:

What gets sent back

  • Does not run from the README.
  • Not clearly the person's own work.
  • Claims more than it does.

Resources

Foundationstart here

Depthgo deeper

What a verifier looks for

  • The bug is shown by a tool's output.
  • The fix removes it (tool output after).
  • The write-up is clear.
  • Check that the work is the person's own.

You'll sign in first, then come straight back here.

Part of