Advanced › Module 1 › Lesson 2
Lab Toys Only
Lab toys only means YOUR CTF ciphertext, openssl demo keys, and course crackmes — document sample IDs in $CRYPTO_LAB notes before any crypto tool run.
Visual · t28_lab_toys_only
Lab toy literacy. $CRYPTO_LAB only. Original Cyberlium.
Opening
The ciphertext is part of scope — Cyberlium refuses crypto attacks on systems and keys you do not own or lack written permission to test.
A lab toy is ciphertext you authored, a course crackme labeled for training, an openssl-generated demo keypair with tiny educational primes, or a CTF flag file from YOUR enrolled competition scope. Intentional vulnerable samples live in $CRYPTO_LAB only — never copied from production traffic without authorization. Cyberlium maps allowed toys on YOUR $CRYPTO_LAB inventory — sample name, source, plaintext owner — never 'borrowed' API endpoints or scraped wallet keys. Next: No Prod Oracles.
1. Allowed lab surfaces (named)
Self-authored plaintext and ciphertext files. Course crackmes and Cyberlium CTF toys with explicit training labels. openssl demos with generated demo keys — not keys from live TLS captures. Classic cipher exercises on text YOU wrote.
On $CRYPTO_LAB, list toy type, source, and owner — fictional sample names OK if labeled training.
Command guide
Try these commands — Allowed lab surfaces (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Optional command
OpenSSL docs — https://www.openssl.org/docs/manmaster/man1/openssl.html
NIST crypto — https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines Certificate Transparency — https://certificate.transparency.dev/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
mkdir -p "$HOME/cyberlium-lab/t28-crypto/notes" "$HOME/cyberlium-lab/t28-crypto/keys" "$HOME/cyberlium-lab/t28-crypto/certs" "$HOME/cyberlium-lab/t28-crypto/data" "$HOME/cyberlium-lab/t28-crypto/report" cat > "$HOME/cyberlium-lab/t28-crypto/lab.env" <<'EOF' export CRYPTO_LAB=$HOME/cyberlium-lab/t28-crypto export CRYPTO_LAB_DATA=$HOME/cyberlium-lab/t28-crypto/data export CRYPTO_LAB_KEYS=$HOME/cyberlium-lab/t28-crypto/keys EOF
Command — copy this
chmod 600 "$HOME/cyberlium-lab/t28-crypto/lab.env" grep -E 'CRYPTO_LAB' "$HOME/cyberlium-lab/t28-crypto/lab.env" curl -sS https://certificate.transparency.dev/ | head -5
Primary tools to practice this lesson: grep, curl. Reference sites: OpenSSL docs (https://www.openssl.org/docs/manmaster/man1/openssl.html); NIST crypto (https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines); Certificate Transparency (https://certificate.transparency.dev/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why toy scope matters before tools
openssl, Python crypto libraries, and CTF solvers are powerful on any target — scope is what keeps practice legal and ethical. Production APIs, stranger HTTPS endpoints, and scraped session tokens are out of scope.
If you cannot answer 'who owns this plaintext and who approved testing?', pause and fix scope notes before running solvers.
3. Toy inventory habit
Forbidden: using a trending API ciphertext dump because it 'looks like a CTF.' Allowed: toy card — type, source, owner, allowed operations (decrypt YOUR Caesar, openssl demo encrypt only).
Ship: toy inventory row for one $CRYPTO_LAB sample. Next: No Prod Oracles.
4. What you ship: lab toy inventory row for $CRYPTO_LAB
Toy type, source, owner, allowed ops. $CRYPTO_LAB named. NEVER production targets. chmod 600.
5. What you record before the next lesson
Date. Toy inventory row. $CRYPTO_LAB named. File t28-m01-l02-lab-toys-only.txt chmod 600.
6. Wrong vs right: prod crypto oracles vs CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Use leaked API ciphertext because lab toys are boring. Skip toy log because 'it's just openssl.'
Right
Write toy inventory row for YOUR $CRYPTO_LAB sample. Next: No Prod Oracles.
Mission: document YOUR crypto lab toy
1) Name one self-authored or course toy sample. 2) Record source and owner. 3) List two allowed operations on that toy. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Self-authored plaintext beats irreversible mistakes on production ciphertext.
Knowledge Check
APPLY: Lab toys only on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Classic cipher CTF on plaintext YOU wrote is acceptable lab practice.
True or False
Knowledge Check
APPLY: Before running a crypto solver you should:
Multiple choice