1001900 - Application Security

The assessment consists of a practical exam (duration: 1 hour) and an oral examination, corresponding to the two modules of the course.

During the practical exam, students will be required to identify and exploit vulnerabilities in specially prepared web applications. At the end of the exercise, they must produce a technical report describing the vulnerabilities discovered, the techniques used to exploit them, their impact on system security, and possible mitigation strategies.

The oral examination aims to discuss the report produced during the practical exam and to verify the student’s understanding of the theoretical concepts covered during the course, with particular reference to common web application vulnerabilities, exploitation techniques, and defense mechanisms. During the discussion, students will also be evaluated on their ability to critically analyze the techniques used and justify the adopted solutions.

The final evaluation will consider the technical correctness of the solutions, the understanding of theoretical concepts, the ability to apply the studied techniques, and the clarity and rigor of the presentation and analysis.

Evaluation Criteria

30 – 30 with honors (Excellent)

The student demonstrates a complete and detailed knowledge of the topics covered, using appropriate terminology and accurately explaining the main concepts of web application security and exploitation. The student shows an in-depth understanding of the analyzed vulnerabilities and of attack and mitigation techniques. They are able to confidently apply the acquired knowledge, exploit complex vulnerabilities, critically analyze the obtained results, and justify the technical choices made. The presentation is clear, rigorous, and well structured.

28 – 29 (Very Good)

The student demonstrates a thorough knowledge of the subject and a solid understanding of the main web application vulnerabilities and exploitation techniques. They are able to correctly apply the studied techniques and analyze the results obtained during the practical exam. The presentation is clear and well organized, although minor inaccuracies or limited depth of analysis may be present.

25 – 27 (Good)

The student has a good knowledge of the main topics of the course and is able to apply basic techniques for identifying and exploiting vulnerabilities. Key concepts of web application security are understood, although they may not always be explained with full precision or completeness. The presentation is generally clear, although sometimes schematic or not fully developed.

22 – 24 (Fair)

The student demonstrates an overall adequate knowledge of the topics covered, although with some gaps or uncertainties. They are able to identify and exploit basic vulnerabilities and discuss the obtained results, although with limited autonomy or some technical inaccuracies. The presentation is correct but not always fully structured.

18 – 21 (Satisfactory)

The student demonstrates an essential knowledge of the fundamental concepts of web application security and the exploitation techniques covered during the course. They are able to address basic exercises related to the identification of web vulnerabilities or simple buffer overflow scenarios, although with some difficulties in applying the techniques and presenting the results.

Fail

The student does not demonstrate an adequate knowledge of the fundamental topics of the course. The practical and/or oral exam reveal significant errors, major gaps, or an inability to correctly apply vulnerability analysis and exploitation techniques, and therefore the minimum requirements to pass the exam are not met.