Validation Lab — Secure Coding with AI

Visual · validation_lab

Lab: input validation pack. $MY_REPO only. Original Cyberlium.

Three defenses, one repo, zero sqlmap on strangers.

Module 3 lessons covered trust boundaries, allowlists, and injection shapes. This lab ships combined evidence from $MY_REPO: boundary list, allowlist validator with tests, parameterized query fix. All tests run against localhost $TOY_APP — never stranger SaaS. Next: Quiz — Input Validation.

1. Lab contract: localhost only

Confirm $MY_REPO path. Run unit tests locally. Document three validation artifacts in one note file.

Forbidden: sqlmap, commix, or manual injection against any URL not your lab deploy.

Command guide

Try these commands — Lab contract: localhost only

═══ LINUX / BASH (Network & Reconnaissance Audit) ═══

Scan target host for open ports and service version signatures

Command — copy this

nmap -sS -sV -p 80,443,8080 -Pn ${LAB_HOST:-127.0.0.1}

DNS and WHOIS reconnaissance on authorized domain

Command — copy this

dig +short A target.local
dig +short MX target.local
whois target.local 2>/dev/null | grep -iE "(Registrar|Creation Date|Name Server)" | head -6

Inspect HTTP headers for technology stack fingerprinting

Command — copy this

curl -s -I "http://${LAB_HOST:-127.0.0.1}:8080" | grep -iE "(Server|X-Powered-By|Set-Cookie|Content-Security-Policy)"

Primary tools to practice this lesson: grep, python3. Reference sites: SQL injection (https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html); CWE-78 OS command (https://cwe.mitre.org/data/definitions/78.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Merge module artifacts

Combine boundary list, allowlist tests, and parameterization note from lessons 3-1 through 3-3.

Optional: one git commit on lab branch with all three fixes.

3. Lock the proof

chmod 600. Quiz next — then Output Encoding.

Green local validation tests are the proof defenders want — not sqlmap logs from stranger URLs.

4. What you ship: input validation pack for $MY_REPO

Boundaries, allowlist tests, parameterization proof. Localhost tests only. chmod 600.

5. What you record before the next lesson

Date. Validation pack on $MY_REPO. File t17-m03-l04-validation-lab.txt chmod 600.

6. Wrong vs right: stranger apps vs YOUR repo

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Include sqlmap output from stranger URL. Skip server-side allowlist.
Right: Validation pack on $MY_REPO localhost. Next: Quiz — Input Validation.

Hands-on Exercise

Mission: validation evidence pack

1) Verify $MY_REPO. 2) Merge boundary, allowlist, parameterize sections. 3) Run local tests only. 4) chmod 600. Never sqlmap stranger apps.

Pro Tip

Stuck? Ask Cyberlium AI Mentor

Green unit tests on allowlist rejects beat any sqlmap trophy from strangers.

Practice QuizQuestion 1

Multiple choice

APPLY: Validation Lab tests run against:

Practice QuizQuestion 2

True or False

APPLY: True or False: Parameterized queries belong in the validation lab pack.

Practice QuizQuestion 3

Multiple choice

APPLY: sqlmap on dorm project URL: