Advanced › Module 10 › Lesson 3
Evidence Pack
Bundle Topic 28 literacy evidence from $CRYPTO_LAB — PKI/TLS, keys, crypto report; no prod attacks.
Visual · t28_evidence_pack
Evidence pack = mentor handoff from $CRYPTO_LAB literacy. Original Cyberlium.
Opening
One indexed pack beats scattered CTF notes — and never includes oracle cookbooks or prod key dumps.
Assemble evidence pack: $CRYPTO_LAB RoE, lab setup proof, PKI lab, TLS lab, keys lab, crypto report lab, classic/modern CTF artifacts if brief assigned, integrity statement (authorized practice only, findings evidenced, no prod attacks, libraries-not-DIY, limitations documented). Directory chmod 600 — index.md lists contents UTC redactions. Mentor copy: report + diagrams + finding table, not live exploit scripts on USB. Gap paragraph for Topic 29 SOC Level 1 — separate authorized track. Scan folder for oracle cookbooks, forged CA, key dumps, MITM steps — zero tolerance.
1. Pack contents
Minimum: RoE, PKI/TLS labs, keys lab, report, integrity index.
Optional: CTF module labs — no refused technique files.
Command guide
Try these commands — Pack contents
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Evidence documentation — https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines
Optional command
OpenSSL — https://www.openssl.org/
CWE — https://cwe.mitre.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export CRYPTO_LAB=${CRYPTO_LAB:-$HOME/cyberlium-lab/t28-crypto}
python3 - <<'PY'
import os
lab = os.environ.get('CRYPTO_LAB', os.path.expanduser('~/cyberlium-lab/t28-crypto'))
idx = os.path.join(lab, 'report', 'evidence-index.txt')
notes = sorted(f for f in os.listdir(os.path.join(lab, 'notes')) if f.endswith('.txt')) if os.path.isdir(os.path.join(lab, 'notes')) else []
reports = sorted(f for f in os.listdir(os.path.join(lab, 'report')) if f.endswith(('.txt', '.md'))) if os.path.isdir(os.path.join(lab, 'report')) else []
open(idx, 'w').write('
'.join(['EVIDENCE PACK — YOUR lab only', 'Data:', ' - data/demo.txt, demo.enc, demo.dec', 'Keys (NEVER publish):', ' - keys/lab-toy-2048.pem, lab-random-32.hex', 'Certs:', ' - certs/lab-selfsigned.crt', 'Notes:'] + [f' - notes/{n}' for n in notes] + ['Reports:'] + [f' - report/{r}' for r in reports] + ['Refusals: no padding-oracle live / no production RSA / no JWT abuse']))
print(f'Wrote {idx}')
PYCommand — copy this
grep -E 'EVIDENCE|Refusals|NEVER publish' "$CRYPTO_LAB/report/evidence-index.txt"
Primary tools to practice this lesson: grep, python3. Reference sites: Evidence documentation (https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines); OpenSSL (https://www.openssl.org/); CWE (https://cwe.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Index fields
Artifact name, module lesson, path, UTC date, description, redactions applied.
Checklist row ↔ index row accountability.
3. Integrity
$CRYPTO_LAB only, libraries-not-DIY discipline, no prod attacks, share-safe export.
Scan before seal — remove accidental keys or oracle scripts.
4. What you ship: advanced crypto evidence pack
Bundled deliverables + index + integrity — chmod 600, report not prod attacks default.
5. What you record before the next lesson
Evidence pack path.
6. Wrong vs right: prod crypto oracles vs CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Evidence pack includes prod padding-oracle script and scraped API keys.
Right
Evidence pack assembled. Next: Capstone Lab.
Mission: assemble evidence pack
1) Bundle PKI TLS keys report index. 2) Integrity statements. 3) Confirm zero refused technique files. 4) Gap note for Topic 29 SOC Level 1.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum index rows for capstone?”
Knowledge Check
APPLY: Evidence pack includes:
Multiple choice
Knowledge Check
APPLY: True or False: Oracle cookbooks OK in pack.
True or False
Knowledge Check
APPLY: Integrity line states:
Multiple choice