Advanced › Module 7 › Lesson 4
Lab — TLS
TLS literacy lab — handshake card, cipher table, pin hygiene, openssl example.com read; no MITM or bypass.
Visual · t28_tls_lab
Lab: TLS hygiene pack on example.com read and $CRYPTO_LAB. Original Cyberlium.
Opening
Ship TLS literacy from example.com chain read and YOUR lab notes — handshake, ciphers, pin hygiene — zero production intercept.
On YOUR $CRYPTO_LAB per brief: (1) scope proof — example.com public read labeled or lab capture ID; (2) handshake literacy card six messages; (3) cipher suite hygiene table with negotiated suite from openssl s_client; (4) cert pin hygiene card — defender rotation focus, no bypass steps; (5) saved redacted openssl transcript (protocol, cipher, cert subject, OCSP status if shown); (6) integrity — no prod MITM, no pinning bypass cookbooks, no downgrade attacks on live targets; (7) chmod 600 pack. example.com:443 read-only OK. Cross-link Module 6 PKI chain table.
1. Lab deliverables
Handshake + cipher + pin hygiene + openssl transcript — single source cross-index.
Link Module 6 OCSP row if stapling visible in output.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Optional command
OpenSSL s_client — https://www.openssl.org/docs/manmaster/man1/openssl-s_client.html
Certificate Transparency — https://certificate.transparency.dev/ NIST SP 800-52 — https://csrc.nist.gov/publications/detail/sp/800-52/rev-2/final (TLS guidelines)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install openssl
macOS: Built-in
Windows:
Command — copy this
choco install openssl
═══ LINUX / macOS ═══
Command — copy this
export CRYPTO_LAB=${CRYPTO_LAB:-$HOME/cyberlium-lab/t28-crypto}
echo | openssl s_client -connect example.com:443 -servername example.com -tls1_2 2>/dev/null | grep -E 'Protocol|Cipher' | head -3
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | grep -E 'Protocol|Cipher' | head -3
grep -E 'TLS handshake|never' "$CRYPTO_LAB/notes/tls-handshake-literacy.txt"═══ WINDOWS ═══
TLS literacy to public example.com only
Command — copy this
openssl s_client -connect example.com:443 -servername example.com < $null 2>$null | Select-String 'subject='
Primary tools to practice this lesson: openssl, grep. Reference sites: OpenSSL s_client (https://www.openssl.org/docs/manmaster/man1/openssl-s_client.html); Certificate Transparency (https://certificate.transparency.dev/); NIST SP 800-52 (https://csrc.nist.gov/publications/detail/sp/800-52/rev-2/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Quality bar
Negotiated TLS version and cipher quoted from observed output — not guessed.
Pin section has zero bypass steps — hygiene only.
3. Integrity
MITM or unpinning on unauthorized app = zero credit.
Share-safe export redacts session IDs — mentor pack chmod 600.
4. What you ship: TLS lab pack
Handshake + cipher + pin + transcript + integrity — chmod 600.
5. What you record before the next lesson
TLS lab pack path.
6. Wrong vs right: prod crypto oracles vs CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
TLS lab includes banking app pinning bypass walkthrough.
Right
TLS lab pack on example.com read and $CRYPTO_LAB. Next: quiz.
Mission: TLS lab
1) Scope proof. 2) Handshake and cipher rows. 3) Pin hygiene card without bypass. 4) Redacted transcript; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum openssl flags for cipher line?”
Knowledge Check
APPLY: TLS lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Pinning bypass steps belong in TLS lab.
True or False
Knowledge Check
APPLY: Negotiated cipher should be:
Multiple choice