Capstone Lab
Execute checklist on $REPO — evidence index complete, pipeline verified, full teardown.
Visual · t17_capstone_lab
Capstone: checklist × $REPO evidence. Original Cyberlium.
Close the loop on code you own — then leave CI green, secrets rotated, and notes secured.
Walk Topic 17 checklist on YOUR $REPO and $LAB_URL: verify RoE file, spot-check validation/encoding/auth patterns, confirm session/CSRF config, run SAST + gitleaks clean, deps audit current, DAST baseline or honest N/A, rotation runbook linked. Update review index. Teardown: revoke lab OAuth test apps, delete synthetic secret branches, stop scanners, chmod 600 all notes. No stranger apps, no phishing, no unauthorized DAST.
1. Execute checklist
Check each row; link artifact or N/A with reason.
CI run screenshot or log summary redacted.
Command guide
Try these commands — Execute checklist
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Secure coding capstone — https://cheatsheetseries.owasp.org/ OWASP ASVS — https://owasp.org/www-project-application-security-verification-standard/ Gitleaks — https://github.com/gitleaks/gitleaks
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
brew install gitleaks # or go install sudo apt install openssl
macOS:
Command — copy this
brew install gitleaks
Windows:
Command — copy this
choco install gitleaks choco install openssl
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t17-lab.env" 2>/dev/null || MY_REPO=$HOME/cyberlium-lab/t17-toy
ls -la "$HOME/cyberlium-lab"/t17-*.txt 2>/dev/null
gitleaks detect --source "${MY_REPO:-$HOME/cyberlium-lab/t17-toy}" --no-git || true
grep -h . "$HOME/cyberlium-lab/t17-capstone-checklist.txt" 2>/dev/null | head -5
openssl dgst -sha256 "$HOME/cyberlium-lab/t17-capstone-checklist.txt" 2>/dev/null || openssl dgst -sha256 "$HOME/cyberlium-lab/t17-roe.txt"Primary tools to practice this lesson: gitleaks, openssl, grep. Reference sites: Secure coding capstone (https://cheatsheetseries.owasp.org/); OWASP ASVS (https://owasp.org/www-project-application-security-verification-standard/); Gitleaks (https://github.com/gitleaks/gitleaks). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender paragraph
One paragraph: what your pipeline would catch if someone committed gitleaks-visible secret today.
Contrast with session fixation if CSRF/session skipped.
3. Shutdown
Revoke disposable creds. Confirm gitleaks clean on main. Sign completion in index.
Repo left with security controls enabled — not disabled for green builds.
4. What you ship: capstone evidence pack complete
Checked checklist + updated index + teardown proof.
5. What you record before the next lesson
Capstone pack path. Pipeline quiet.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Capstone evidence from unauthorized prod scan.
- Right: Capstone complete on $REPO. Next: topic quiz.
Mission: Topic 17 capstone
1) Walk checklist with evidence links. 2) Defender paragraph from your pipeline. 3) Full teardown documented.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum N/A documentation?”
APPLY: Capstone target:
APPLY: True or False: OAuth phishing capstone is credit.
APPLY: Teardown includes: