Mobile › Module 5 › Lesson 4
Lab — TLS
Pack proxy, pinning literacy, and bypass refusal cards — network/TLS file from $MOB_LAB only.
Visual · t27_tls_lab
Lab: TLS pack. $MOB_LAB only. Original Cyberlium.
Opening
TLS pack merges transport literacy with explicit bypass refusal — paperwork closing M5 before iOS module.
Lessons 5-1–5-3 named proxy setup, TLS pinning as defender control, and no bypass cookbook refusal. This lab merges proxy card, pinning literacy card, and bypass refusal card with $MOB_LAB lab app and dynamic pack cross-reference. Optional: capture one sanitized lab-app request line in notes — no tokens, no production hosts. Next: Quiz — Network and TLS Literacy.
1. Lab contract: TLS pack
Create $HOME/cyberlium-lab/t27-m05-l04-tls-lab.txt merging proxy literacy, pinning defender card, and bypass refusal sections with $MOB_LAB package from M3/M4.
Optional: one redacted log line METHOD host/path from lab app only — no Authorization headers saved.
Command guide
Try these commands — Lab contract: TLS pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Optional command
OpenSSL s_client — https://www.openssl.org/docs/manmaster/man1/openssl-s_client.html (TLS handshake literacy)
OWASP MASTG network — https://mas.owasp.org/MASTG/0x04f-Testing-Network-Communication/ MASVS network — https://mas.owasp.org/MASVS/0x03-MASVS-NETWORK/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install openssl sudo apt install curl
macOS: Built-in
Windows:
Command — copy this
choco install openssl
Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export MOB_LAB=${MOB_LAB:-$HOME/cyberlium-lab/t27-mob}
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -subject -issuer -dates
grep ALLOWED "$MOB_LAB/notes/no-bypass-cookbook.txt"
curl -sS https://mas.owasp.org/MASVS/0x03-MASVS-NETWORK/ | head -8═══ WINDOWS ═══
TLS literacy to public host only — not app bypass
Command — copy this
openssl s_client -connect example.com:443 -servername example.com < $null 2>$null | Select-String 'subject='
Primary tools to practice this lesson: openssl, curl. Reference sites: OpenSSL s_client (https://www.openssl.org/docs/manmaster/man1/openssl-s_client.html); OWASP MASTG network (https://mas.owasp.org/MASTG/0x04f-Testing-Network-Communication/); MASVS network (https://mas.owasp.org/MASVS/0x03-MASVS-NETWORK/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check ethics
Grep for unpinning, objection, ssl-kill-switch, bank hostnames — remove bypass steps if pasted from forums. Pack must contain refusal language.
Confirm zero production finance domains in notes.
3. Lock the proof
chmod 600 on the pack. Quiz next — then iOS Literacy in M6.
Network/TLS literacy completes Android-side transport module on $MOB_LAB.
4. What you ship: network/TLS pack for $MOB_LAB
Merged proxy, pinning, refusal sections. $MOB_LAB named. NO bypass cookbooks. chmod 600.
5. What you record before the next lesson
Date. TLS pack path. $MOB_LAB named. File t27-m05-l04-tls-lab.txt chmod 600.
6. Wrong vs right: stranger phones vs lab emulator apps
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Include ssl-unpinning script in pack. Save live session cookies in notes.
Right
Write YOUR TLS pack for $MOB_LAB. chmod 600. Next: Quiz — Network and TLS Literacy.
Mission: freeze YOUR TLS pack
1) Merge M5 literacy sections. 2) Confirm bypass refusal present. 3) Redact any tokens from optional log line. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
If your pack contains 'step 1 inject' for pinning on production — delete and rewrite refusal.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: TLS pack must include bypass refusal language.
True or False
Knowledge Check
APPLY: Pinning section in TLS pack should:
Multiple choice