Appendix K: Course Materials, Coverage Map, and Sample Assignments

This appendix is a resource for instructors. It maps common lecture topics to the chapters that cover them, gives three ready-to-adapt lecture-module outlines, and lists sample assignments and group projects. It complements Appendix H (capstone and group-project ideas) and Appendix F (companion code); where the material overlaps, this appendix cross-references rather than repeats. The outlines and projects are written to be institution-neutral, so they can be dropped into a syllabus and adjusted to local constraints.

K.1 Source-Materials Coverage Map

A typical undergraduate ethical-hacking or computer-security course is taught from a sequence of topic lectures. The table below maps those standard topics to the chapters of this book, so an instructor moving from an existing slide deck can find the corresponding reading, worked examples, exercises, and labs. It doubles as a coverage check: every topic in a conventional sequence is treated somewhere in the text.

Lecture topic	Book chapter(s)
Introduction to ethical hacking; penetration-testing methodology; rules of engagement; PTES and NIST testing	6
Professional ethics; the legal system; proper and responsible disclosure	1, 6, 18
Cryptography: classical ciphers, symmetric and public-key, hashing, signatures, HTTPS and TLS	2
The OSI model, ports, ARP, DHCP, the TCP handshake; sniffing, Wireshark, session hijacking	3
Reconnaissance and intelligence gathering; OSINT; Google dorking; log and SIEM review	7
Port scanning and network mapping; enumeration; OS fingerprinting; vulnerability scanning (Nessus, NSE)	8
Exploitation, Kali and Metasploit; Linux and Windows exploitation; shellcode; passive analysis and reversing	9, 15
Password cracking; Windows security (SAM, SID/RID, LM/NTLM, Active Directory, LDAP, NetBIOS, SMB); rootkits	9, 15
Programming survival skills: C, assembly, gdb, Python for security	9, 15
Web application attacks: the OWASP Top 10, SQL injection, XSS, Nikto, session flaws	10
Mobile, wireless, and IoT attacks (WEP/WPA/WPA2/WPA3, evil twin, deauthentication)	3, 17, 20
Malware: viruses, worms, trojans, RATs; antivirus and antimalware; detection methods	12, 15
Firewalls and their types; intrusion detection and prevention; honeypots and deception	11, 12
Physical security and social engineering	4, 11, 20
Incident response: before, during, and after the attack; “attacks are inevitable”	14
Virtualization and its security	17
Capture-the-flag competitions: platforms and tooling	16
Formal adversary and threat models	Appendix J
Companion source code (cryptography, networking, exploitation)	Appendix F, code/

K.1.1 Software Reverse Engineering: A Malware-Analysis Course Map

A common Software Reverse Engineering course is organized around a hands-on malware-analysis textbook and a fifteen-week laboratory sequence. The mapping below aligns that standard progression to the chapters and sections of this book, so an instructor using such a syllabus can assign the corresponding reading. It also serves as a coverage check for the reverse-engineering track (Chapters 9 and 15, with networking analysis from Chapter 3).

Weekly topic (typical SRE sequence)	Book section(s)
Basic static techniques	15.3, 15.4
Malware analysis in virtual machines (safe lab)	15.21, 15.2
Basic dynamic analysis	15.25, 15.4
x86 assembly and IDA Pro	9.27, 15.22, 15.35
C code in assembly; malicious Windows programs	15.22, 15.23
Debugging and OllyDbg/x64dbg	9.28, 15.25, 15.35
Malware behavior	15.13 to 15.17
Covert launching and data encoding	15.33, 15.24
Network signatures and anti-disassembly	15.34, 15.30
Anti-debugging	15.30, 15.35
Anti-virtual-machine techniques	15.30
Packers and unpacking; shellcode analysis	15.5, 15.25, 9.25
C++ analysis	15.32
64-bit malware	15.22, 15.27
Final project: analyze real-world malware	15.11, 15.19, 15.29, 15.31

The standard reference for such a course is Sikorski and Honig’s Practical Malware Analysis (No Starch Press, 2012), and a concise scholarly overview is Cipresso and Stamp’s “Software Reverse Engineering” chapter in the Handbook of Information and Communication Security (Springer, 2010).

K.2 Sample Lecture Modules

The three outlines below are complete single-topic modules distilled to their teaching structure. Each can be delivered as one or two lectures and pairs with the chapter noted.

K.2.1 Social Engineering and the Human Attack Surface (pairs with Chapter 4)

A module on why humans, not technology, remain the most consistently exploited attack surface.

1. The unpatchable vulnerability. Modern attackers increasingly log in with stolen credentials and manipulated approvals rather than breaking in; the user becomes the attack vector, and one click or approval can nullify expensive technical defenses.

2. The cognitive science of the attack. Humans rely on mental shortcuts (heuristics) to function; social engineering is engineered to exploit them. Introduce dual-process thinking (fast, automatic System 1 versus slow, analytical System 2) and how attackers keep victims in System 1 through urgency and emotion.

3. The levers of influence. Authority, urgency, scarcity, social proof, reciprocity, and fear, with a worked example of each in a phishing or pretexting lure.

4. Attack forms. Phishing and spear phishing, vishing and smishing, pretexting, baiting, and business email compromise (Section 4 and Section 14 for the incident-response side).

5. Building resilient systems. Because human error is inevitable, design for it: verification workflows, out-of-band approval for high-risk actions, least privilege, and phishing-resistant multi-factor authentication, plus a culture in which reporting a mistake is safe.

K.2.2 Ethical Hacking Foundations (pairs with Chapters 1, 5, and 6)

An opening module that establishes vocabulary and mindset before any hands-on work.

1. The CIA triad. Confidentiality, integrity, and availability as the goals every control ultimately serves, each with a concrete breach example.

2. The DAD triad. Disclosure, alteration, and destruction as the attacker’s mirror image of CIA, defining what a malicious actor is trying to achieve.

3. The anatomy of an attack. Vulnerability (the weakness), threat (the danger), and exploit (the mechanism), the vocabulary used throughout the book, tied to the risk material of Chapter 5.

4. Authorization and ethics first. Rules of engagement, scope, written authorization, and responsible disclosure, so that every later technique is practiced legally (Chapter 6).

5. The attacker’s process. A preview of the reconnaissance, scanning, exploitation, and post-exploitation sequence developed in Chapters 7 through 9.

K.2.3 Intrusion Detection and Prevention Systems (pairs with Chapters 11 and 12)

A module on the security-monitoring stack and where each component fits.

1. Why dedicated security devices exist, and how they fit a defense-in-depth strategy.

2. The monitoring stack. Distinguish SIEM, SOAR, XDR, and EDR and place each in the workflow of a security operations center (Section 12).

3. The kill chain. Walk the seven stages of the Lockheed Martin Cyber Kill Chain and identify a defensive opportunity at each, connecting to MITRE ATT&CK (Section 12).

4. IDS versus IPS. Detection versus prevention, and passive (out-of-band) versus inline deployment and its tradeoffs.

5. Sensor placement. Network-based (NIDPS) versus host-based (HIDPS) sensors, and centralized versus distributed control strategies.

6. Detection methods. Signature-based, anomaly-based, stateful-protocol, and log-file analysis, with their respective strengths and blind spots, plus trap-and-trace and deception (honeypots).

K.3 Sample Assignments and Group Projects

The projects below are build-oriented and suit teams of two to four students over several weeks. They deliberately span offense and defense and map to specific chapters; Appendix H offers additional capstone ideas. Each should be performed only against systems the team owns or is explicitly authorized to test, in an isolated lab (Chapter 6).

1. Modern phishing simulation and human-risk analysis. Run a multi-stage, controlled phishing campaign against a consenting test population: gather OSINT to craft believable lures (Chapter 7), host email templates and a spoofed landing page in a contained environment, capture interactions, then compute a phish rate and correlate lure sophistication with susceptibility. Tools: an open-source simulation platform (for example GoPhish), theHarvester or Maltego. Pairs with Chapters 4 and 14.

2. Mobile or web API vulnerability scanner. Focus on broken access control, especially insecure direct object references: intercept client-server traffic with a proxy, then script the systematic modification of object identifiers (for example incrementing a user id) to test for horizontal and vertical privilege escalation. Deliver a Python tool that automates the parameter injection and reports findings. Pairs with Chapter 10.

3. Automated web-application fuzzer. Build a tool that sends malformed and boundary-case input to a target application, monitors responses for errors and crashes, and logs candidate vulnerabilities. Cover mutation and generation fuzzing and boundary-value analysis. Tools: Python (requests, a fuzzing library), optionally an intercepting proxy. Pairs with Chapters 9 and 10.

4. Network protocol analyzer and sniffer. Develop a capture-and-decode tool that reads live traffic and parses packet structure, then extracts security-relevant indicators (credentials in the clear, suspicious destinations). Tools: Python (Scapy, libpcap) or C/C++ (libpcap). Pairs with Chapters 3 and 12.

5. Host-based intrusion-detection prototype. Instrument a host to collect process, file, and registry events and apply simple signature and anomaly rules to flag suspicious behavior, then measure the true- and false-positive rates on benign and malicious activity (Section 12). Pairs with Chapters 12 and 13.

K.4 Adapting These Materials

The modules and projects are starting points, not prescriptions. Scale them to the term: an introductory course might use only the foundations module and the phishing or protocol-analyzer project, while an advanced course can combine the exploitation labs of Chapter 9 with the fuzzer and the intrusion-detection prototype. The guidance in the introduction on trimming the longer chapters from the back applies here too, keep the hands-on projects and the case studies when time is short, because those are what students remember. All companion source code referenced by these assignments is indexed in Appendix F and bundled in the repository’s code/ directory.