Defensive › Module 10 › Lesson 4
Capstone Lab
Execute checklist walk on $LAB — evidence index complete, full teardown documented.
Visual · t16_capstone_lab
Capstone: checklist × $LAB evidence. Original Cyberlium.
Opening
Close the loop on hosts you own — then leave them patched, logged, and backed up.
Walk Topic 16 checklist on YOUR $LAB fleet: verify RoE file, spot-check hardening, sample auth log lines, confirm central forward or honest N/A, open policy lab and backup restore records, run awareness pledge line. Update evidence index. Teardown: revert temp configs, stop collectors if lab-only, verify backup catalog, chmod 600 all notes. No stranger hosts, no phishing, no unauthorized changes.
1. Execute checklist
Check each row; link artifact or N/A with reason.
Screenshot or text evidence redacted.
Command guide
Try these commands — Execute checklist
═══ LINUX / KALI (Penetration Testing & Service Audit) ═══
Port scan and service banner grabbing against authorized target
Command — copy this
nmap -sV -sC -Pn -T4 -p 21,22,80,443,445,3389 ${LAB_HOST:-127.0.0.1}Enumerate web directories and hidden endpoints
Command — copy this
gobuster dir -u http://${LAB_HOST:-127.0.0.1} -w /usr/share/wordlists/dirb/common.txt -q -t 20 2>/dev/null || head -5 /etc/hostsMetasploit framework module inspection (Safe lab syntax)
Command — copy this
msfconsole -q -x "use auxiliary/scanner/portscan/tcp; set RHOSTS 127.0.0.1; set PORTS 80,443; run; exit" 2>/dev/null || echo "Run in Kali msfconsole"
═══ WINDOWS (Audit Target) ═══ Enumerate open listening ports with process mappings
Command — copy this
netstat -ano | findstr /i "LISTENING"
Primary tools to practice this lesson: ss, journalctl, curl, python3. Reference sites: Defensive capstone (https://www.cisecurity.org/controls); MITRE ATT&CK (https://attack.mitre.org/matrices/enterprise/); NIST CSF (https://www.nist.gov/cyberframework). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender paragraph
One paragraph: what your central logs would show if auth failures spiked on $LAB.
Contrast with proper patch/backup discipline.
3. Shutdown
Stop lab collectors/listeners. Secure backups. Sign completion in index.
Lab hosts left in hardened baseline state.
4. What you ship: capstone evidence pack complete
Checked checklist + updated index + teardown proof.
5. What you record before the next lesson
Capstone pack path. Lab quiet.
6. Wrong vs right: stranger hosts vs YOUR lab hosts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Capstone evidence from employer network without authorization.
Right
Capstone complete on $LAB. Next: topic quiz.
Mission: Topic 16 capstone
1) Walk checklist with evidence links. 2) Defender paragraph from your logs. 3) Full teardown documented.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum N/A documentation?”
Knowledge Check
APPLY: Capstone target:
Multiple choice
Knowledge Check
APPLY: True or False: Phishing capstone on classmates is credit.
True or False
Knowledge Check
APPLY: Teardown includes:
Multiple choice