Lab — Rewrite a Unsafe Query You Wrote

unsafe_concat_snippet.py is inspect-only fiction. It shows SELECT name FROM catalog_items WHERE sku = '" + sku + "'. It must refuse to run against anything that is not a local path under cyberlium-lab, and this course tells you not to use it as a probe tool at all. Your job is lookup_sku.py: sql = "SELECT name FROM catalog_items WHERE sku = ?" then cur.execute(sql, (sku,)). HOST/path is a Path under Path.home() / "cyberlium-lab" / "catalog.db" — hardcoded, not argv, not a postgres:// URL, not a classmate’s RDS. If the path is anything else, raise SystemExit. That refusal is part of the lab, the same idea as Module 10’s HOST = "127.0.0.1".

You will seed three harmless rows (WID-100, WID-200, WID-300) in a table you created. You will look up WID-100. You will look up a SKU string that includes a quote (for example WID-100' extra) and record that the parameterized call returned no row (or only a literal match) without throwing a SQL syntax error from a broken statement. That is the mechanism proof: the quote did not finish the sentence. It is not an attack against a shop. It is not OR 1=1. Do not add UNION clauses to either file. Windows: py lookup_sku.py in PowerShell after the bash block, or run the block in WSL/Git Bash.

sudo apt install sqlmap
sudo apt install python3

brew install sqlmap
brew install python3

pip install sqlmap

python3 - << 'PY'
from pathlib import Path
import sqlite3
p = Path.home()/'cyberlium-lab'/'catalog-lab.sqlite'
p.parent.mkdir(parents=True, exist_ok=True)
conn = sqlite3.connect(p)
conn.execute('CREATE TABLE IF NOT EXISTS catalog_items(sku TEXT, name TEXT)')
conn.execute('INSERT OR IGNORE INTO catalog_items VALUES (?,?)', ('WIDGET','Demo'))
conn.commit(); conn.close()
print('local_db', p)
print('REFUSE: foreign DSN, sqlmap, UNION cheat sheet')
PY

lookup_sku.py must contain a question-mark placeholder in the SELECT, must call execute with a tuple, must not concatenate sku into the SQL with +, f-strings, .format, or percent-format, and must not import or invoke sqlmap. The checker reads YOUR source. It does not send traffic. If you left execute("SELECT ... '" + sku) in the rewrite, FAIL even if sqlite happened to return a row. If you pointed connect() at a network URL, FAIL. If sqli-fix-lab.txt still has parenthetical placeholders, FAIL. Replace every parenthetical in the notes with YOUR words.

Required notes keys: DISCLAIMER, SNIPPET (what the fictional glue did), REWRITE (placeholder + tuple in your words), PROOF (quoted SKU stayed data on local catalog.db), PATH (cyberlium-lab/catalog.db), NEVER, TOPIC10, ETHICS. DISCLAIMER must say this is original Cyberlium teaching mapped to the CEH v13 SQL-injection domain, not official EC-Council training, not a cert, not exam dumps. NEVER must forbid live foreign DBs, UNION cheat sheets, and sqlmap against strangers. TOPIC10 must say Topic 10 goes deeper.

mkdir -p creates cyberlium-lab. Python creates catalog.db, writes the inspect-only snippet, writes lookup_sku.py, seeds rows, runs two lookups, writes sqli-fix-lab.txt template, then check_sqli_fix_lab.py reads notes plus lookup_sku.py. chmod 600 restricts the notes, the rewrite, the snippet, the checker, and the sqlite file on Unix-like systems. Windows: WSL or Git Bash for chmod, or tighten NTFS permissions on your user profile. There is no requests.get to a shop. There is no sqlmap. If you added those, you left the lab.

Rerun the checker after you edit parentheticals. A PASS that still says “then I sqlmap the café Wi-Fi portal” is an ethics fail you catch with your eyes. The confirmation checkbox is you asserting you used your eyes. Do not gist catalog.db. Do not commit production passwords. Sibling notes (sqli-string, sqli-blind-inband, sqli-parameterized) stay; they are not substitutes for sqli-fix-lab.txt.

Authorized lab only: files under $HOME/cyberlium-lab. Do not attack others. Do not treat this PASS as permission to test a vendor’s search box. Do not title the folder “Official CEH v13 SQLi lab.” If you already sent a quote to a site you do not own, this lab does not launder that. Stop. Delete probe drafts. This file is a forward-looking rewrite, not an indulgence. Module 14’s bug-bounty sentence still requires a policy you actually read; this module’s default remains YOUR local sqlite file.

Keep chmod 600 on the SQLi note set. Empty any file that still contains a connection string you pasted by mistake. Topic 10 is where Cyberlium goes deeper on authorized local web labs — still not strangers, still not sqlmap-against-the-internet.

Run the block on a machine you own. Edit parentheticals in sqli-fix-lab.txt. Re-run python until PASS. Then chmod 600. Do not add network clients. Do not aim anything at a classmate.

ls -l "$HOME/cyberlium-lab/catalog-lab.sqlite" || echo "seed in heading 1 first"; chmod 600 "$NOTES"

You now have a parameterized rewrite this module can point at: local sqlite, locked notes, no practicing on foreign databases, no fake certification claim. Next — Quiz — SQL Injection — ten APPLY items on mechanism and parameterized queries. After the quiz, SSID, Encryption, and Guest Networks begins Module 16, still original Cyberlium, still not a CEH exam dump, still your home lab SSID only.