Lab — Capstone

Execute capstone on $CRYPTO_LAB — checklist, lab path, evidence pack sealed; zero prod attacks.

Lab — Capstone• Audio Walkthrough

00:00/02:57

Visual · t28_capstone_lab

Capstone: checklist × $CRYPTO_LAB literacy evidence. Original Cyberlium.

Close the advanced crypto literacy loop — PKI read, TLS hygiene, report shipped, RoE signed — without prod oracle exploits.

Walk Topic 28 checklist on YOUR $CRYPTO_LAB: verify RoE, lab path current, PKI/TLS and keys labs complete, crypto report with disclosure block, evidence pack indexed, scan for oracle cookbooks and key dumps (must be zero). Update index with capstone UTC completion. Integrity paragraph: libraries-not-DIY and responsible disclosure key insight from YOUR path. No prod padding-oracle, no forged CA, no unauthorized MITM, no DIY ciphers. Optional mentor review — three clarity questions. Revert lab toy state after if brief requires.

1. Execute checklist

Check each row; link artifact or N/A; confirm zero refused techniques in any file.

Scan sealed pack for oracle scripts and key dumps — remove before handoff.

Command guide

Try these commands — Execute checklist

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

Crypto capstone — https://www.openssl.org/docs/ NIST SP 800-57 — https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final Certificate Transparency — https://certificate.transparency.dev/ CWE — https://cwe.mitre.org/

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install openssl
sudo apt install python3

macOS:

Command — copy this

brew install python3

Windows:

Command — copy this

choco install openssl

Download https://python.org/downloads/

═══ LINUX / macOS ═══

Command — copy this

export CRYPTO_LAB=${CRYPTO_LAB:-$HOME/cyberlium-lab/t28-crypto}
grep NEVER "$CRYPTO_LAB/notes/no-live-attacks.txt"
grep 'HARD BAN' "$CRYPTO_LAB/notes/named-attacks-literacy.txt" 2>/dev/null || grep NEVER "$CRYPTO_LAB/notes/named-attacks-literacy.txt" | head -2
openssl dgst -sha256 "$CRYPTO_LAB/data/demo.txt" 2>/dev/null || echo 'Run 2-1 first to create demo.txt'
openssl enc -d -aes-256-cbc -pbkdf2 -in "$CRYPTO_LAB/data/demo.enc" -pass pass:LabOnlyPassphrase2026 2>/dev/null | head -2
openssl x509 -in "$CRYPTO_LAB/certs/lab-selfsigned.crt" -noout -subject 2>/dev/null | head -1
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -subject 2>/dev/null | head -1
python3 - <<'PY'
import os
lab = os.environ.get('CRYPTO_LAB', os.path.expanduser('~/cyberlium-lab/t28-crypto'))
path = os.path.join(lab, 'report', 'capstone-summary.txt')
open(path, 'w').write('
'.join([
  'Advanced Cryptography Literacy Capstone',
  'scope: YOUR $HOME/cyberlium-lab/t28-crypto/ only',
  'hash: openssl dgst + sha256sum on demo.txt',
  'encrypt: aes-256-cbc -pbkdf2 round-trip on YOUR demo file',
  'classical: Caesar/Vigenere/XOR python on YOUR strings',
  'asymmetric: TOY RSA (p=61,q=53) + genrsa 2048 lab key — never publish',
  'pki: self-signed lab cert + CT/crt.sh literacy',
  'tls: s_client example.com — no MITM stranger traffic',
  'report: finding-draft + CWE matrix + evidence index',
  'never: padding-oracle live / production RSA factoring / JWT alg=none abuse',
]))
print(f'Wrote {path}')
PY

Command — copy this

grep -E 'scope|never|encrypt' "$CRYPTO_LAB/report/capstone-summary.txt"
chmod 600 "$CRYPTO_LAB/keys/"*.pem "$CRYPTO_LAB/keys/"*.hex 2>/dev/null || true

═══ WINDOWS ═══

Capstone on YOUR lab Windows VM only

Command — copy this

Get-Content $HOME/cyberlium-lab/t28-crypto/notes/no-live-attacks.txt | Select-String NEVER
Get-Content $HOME/cyberlium-lab/t28-crypto/report/capstone-summary.txt | Select-String never
openssl dgst -sha256 $HOME/cyberlium-lab/t28-crypto/data/demo.txt

Primary tools to practice this lesson: grep, openssl, python3. Reference sites: Crypto capstone (https://www.openssl.org/docs/); NIST SP 800-57 (https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final); Certificate Transparency (https://certificate.transparency.dev/); CWE (https://cwe.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Integrity paragraph

RoE + libraries-not-DIY key → professional handoff idea from YOUR lab path.

Name what breaks if you skip scope or run prod attacks — ethics tie-in.

3. Shutdown

Notes secured chmod 600; index signed complete UTC.

Ready for Topic 29 SOC Level 1 on separate authorized track.

4. What you ship: capstone evidence pack complete

Checked checklist + sealed literacy pack + integrity paragraph + zero refused scan.

5. What you record before the next lesson

Capstone pack path. $CRYPTO_LAB quiet.

6. Wrong vs right: prod crypto oracles vs CTF toys

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Capstone includes prod RSA oracle exploit as bonus exhibit.
Right: Capstone complete on $CRYPTO_LAB with full teardown. Next: topic quiz.

Hands-on Exercise