Home Lab Setup SEED Labs Books Lectures Workshops

Morris Worm Attack Lab


The Morris worm (November 1988) was one of the oldest computer worms distributed via the Internet. While it is old, the techniques used by most worms today are still the same. They involve two main parts: attack and self-duplication. The attack part exploits a vulnerability (or a few of them), so a worm can get an entry to another computer. The self-duplication part is to send a copy of itself to the compromised machine, and then launch the attack from there.

To help students gain a better understanding of the behavior of worms, we have developed this lab for students to write a simplified worm. We have broken down the technique into several tasks, so students can build the worm incrementally. For testing, we built two emulated Internets, a small one and a larger one. Students can release their worms in each of these Internets, and see how their worms spread across the entire emulated Internet.

Tasks (PDF)

Time (Suggested)

  • Supervised (closely-guided lab session): 2-3 hours
  • Unsupervised (take-home project): 1 week

SEED Videos

Additional Reading

Feedback and Help

Please give us your feedback on this lab using this feedback form.
The SEED Labs project is open source. If you are interested in contributing to this project, please check out our Github page: https://github.com/seed-labs/seed-labs.