Secure › Module 3 › Lesson 4
Validation Lab
Validation pack on $MY_REPO — boundaries, allowlist, parameterize; local tests only.
Visual · validation_lab
Lab: input validation pack. $MY_REPO only. Original Cyberlium.
Opening
Three defenses, one repo, zero sqlmap on strangers.
Module 3 lessons covered trust boundaries, allowlists, and injection shapes. This lab ships combined evidence from $MY_REPO: boundary list, allowlist validator with tests, parameterized query fix. All tests run against localhost $TOY_APP — never stranger SaaS. Next: Quiz — Input Validation.
1. Lab contract: localhost only
Confirm $MY_REPO path. Run unit tests locally. Document three validation artifacts in one note file.
Forbidden: sqlmap, commix, or manual injection against any URL not your lab deploy.
Command guide
Try these commands — Lab contract: localhost only
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
SQL injection — https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html CWE-78 OS command — https://cwe.mitre.org/data/definitions/78.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
grep -n 'password=' "$HOME/cyberlium-lab/t17-toy" 2>/dev/null || true
python3 -c "print('Bind shape: cursor.execute("SELECT id FROM users WHERE email=?", (email,))')"
grep -rE 'subprocess|os.system' "$HOME/cyberlium-lab/t17-toy" 2>/dev/null | head -5 || echo 'Scan MY_REPO for shell invocation'Primary tools to practice this lesson: grep, python3. Reference sites: SQL injection (https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html); CWE-78 OS command (https://cwe.mitre.org/data/definitions/78.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Merge module artifacts
Combine boundary list, allowlist tests, and parameterization note from lessons 3-1 through 3-3.
Optional: one git commit on lab branch with all three fixes.
3. Lock the proof
chmod 600. Quiz next — then Output Encoding.
Green local validation tests are the proof defenders want — not sqlmap logs from stranger URLs.
4. What you ship: input validation pack for $MY_REPO
Boundaries, allowlist tests, parameterization proof. Localhost tests only. chmod 600.
5. What you record before the next lesson
Date. Validation pack on $MY_REPO. File t17-m03-l04-validation-lab.txt chmod 600.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Include sqlmap output from stranger URL. Skip server-side allowlist.
Right
Validation pack on $MY_REPO localhost. Next: Quiz — Input Validation.
Mission: validation evidence pack
1) Verify $MY_REPO. 2) Merge boundary, allowlist, parameterize sections. 3) Run local tests only. 4) chmod 600. Never sqlmap stranger apps.
Stuck? Ask Cyberlium AI Mentor
Green unit tests on allowlist rejects beat any sqlmap trophy from strangers.
Knowledge Check
APPLY: Validation Lab tests run against:
Multiple choice
Knowledge Check
APPLY: True or False: Parameterized queries belong in the validation lab pack.
True or False
Knowledge Check
APPLY: sqlmap on dorm project URL:
Multiple choice