Vulnerability › Module 8 › Lesson 3
Evidence Hygiene
Redact, label, store — evidence packs from YOUR lab only, chmod 600.
Visual · t18_evidence_hygiene
Evidence hygiene = redact secrets, label synthetic, secure storage. Original Cyberlium.
Opening
Reviewers trust redacted proof — not a zip called passwords_final_v2.
Evidence packs for VA: redact internal IPs if mentor policy requires, remove credentials and tokens from command output, label test accounts, note scan tool and version, timestamp UTC, hash optional for integrity. Store under $HOME/cyberlium-lab chmod 600 — never upload raw scan with live creds to public GitHub. No including stranger infrastructure captures, breach dump paste, or exploit PoC artifacts. Synthetic lab data labeled FAKE is fine; live third-party data is not.
1. Redaction rules
Mask passwords, API keys, session cookies in screenshots and logs.
Replace real hostnames with lab aliases in shared mentor copies if required.
Command guide
Try these commands — Redaction rules
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Evidence handling — redact in reports; lab only Nmap evidence — https://nmap.org/book/man-output.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap
macOS:
Command — copy this
brew install nmap
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ LINUX / macOS ═══
Command — copy this
grep -E '^[0-9]+/' "$HOME/cyberlium-lab/t18-inventory.txt" 2>/dev/null | head -8 source "$HOME/cyberlium-lab/t18-lab.env"; nmap -sV --top-ports 3 "$LAB_HOST" -oN "$HOME/cyberlium-lab/t18-evidence-snippet.txt"
Primary tools to practice this lesson: grep, nmap. Reference sites: Evidence handling; Nmap evidence (https://nmap.org/book/man-output.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Pack contents
RoE one-pager, scan export summary, triage workbook, two finding blocks, redaction log.
Index file: artifact name, date, description, redactions applied.
3. Refusal list
No stranger scan dumps, no exploit binaries in pack, no employer prod without ticket.
Delete disposable evidence after mentor review if policy says — default keep chmod 600.
4. What you ship: evidence hygiene checklist
Redaction rules + pack index template + chmod 600 storage rule.
5. What you record before the next lesson
Evidence hygiene checklist path.
6. Wrong vs right: stranger nets vs YOUR lab assets
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Submit VA pack with unredacted admin password from lab screenshot.
Right
Name evidence hygiene rules. Next: report lab.
Mission: evidence checklist
1) Write five redaction rules. 2) Draft pack index fields. 3) Write NEVER include exploit PoCs/stranger dumps.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “IP redaction policy for lab?”
Knowledge Check
APPLY: Evidence packs should:
Multiple choice
Knowledge Check
APPLY: True or False: Stranger scan dumps belong in mentor pack.
True or False
Knowledge Check
APPLY: Pack index notes:
Multiple choice