Lab — Inventory Dependencies You Own
DEMO: inventory YOU own + curl -I http://192.168.0.1/ — A03 hands-on.
Visual · inventory_deps_lab
Lab: Inventory deps you own. Optional SAFE No malware. No LAN hydra.
List what you trust. Pin what you ship. Lock the notes. That is the A03 lab.
Lessons 1–3 framed Software Supply Chain Failures (OWASP Top 10:2025 A03): deps as surface, SBOM/pins/trust boundaries, compromise story beats without samples. This lab is inventory you can defend. Prefer a real project YOU own (school app, personal repo). Else use the toy under cyberlium-lab. No typosquats. No malware downloads. No CI attacks. Original Cyberlium — not official OWASP certification. Next: Quiz — Supply Chain Failures.
1. Lab contract: identify DEMO, owned project or toy, inventory file, locked notes
Produce deps-inventory.txt with columns: name, version_or_pin, direct_or_transitive_guess, source. Count rows. SHA-256 of the inventory file. Copy highlights into a03-inventory-lab.txt. If using a real lockfile, redact secrets/tokens — never paste.npmrc auth. Writeups use http://192.168.0.1/ as the demo asset (or note STOP-router).
2. What “good enough” looks like for this course
At least five component lines (toy is fine). One sentence on why floating latest is riskier than pins. One sentence on trust boundary (registry vs CI). Identify curl -I snippet. Ethics refuse line. Empty inventories fail. Inventories of malware package names fail ethics.
3. Stay-outs
Do not install random trending packages to pad the list. Do not scan other students’ private repos. Do not hydra 192.168.0.1. Do not nmap 192.168.0.0/24. Do not exfiltrate company lockfiles to public gists if policy forbids — use a personal toy instead.
4. Artifact rows
Legal line; asset DEMO; identify banner; project path; dep count; pin policy sentence; trust boundary sentence; inventory sha; ethics; chmod 600.
5. Ethics hard stops
Malware samples, typosquat publishes, CI poisoning, maintainer phishing, dumping employer secrets, hydra/nmap of the LAN. A03 literacy is inventory — not becoming the incident.
6. Wrong vs right: attacking the chain vs documenting yours
Worked failure — same word “inventory,” opposite blast radius.
- Wrong: Pad the lab with malware names. Publish a lookalike. Hydra the home router. Gist company tokens. Skip pins.
- Right: curl -I DEMO (STOP if router); inventory a project you own/toy; pin list; a03-inventory-lab.txt chmod 600. Next: Quiz — Supply Chain Failures.
Identify DEMO, generate inventory under cyberlium-lab, lock notes.
Mission: a03-inventory-lab.txt in cyberlium-lab (mode 600)
1) curl -sS -I http://192.168.0.1/ —2) Build deps-inventory.txt for a project you own or the toy (≥5 rows); sha256sum it. 3) Fill $HOME/cyberlium-lab/a03-inventory-lab.txt, chmod 600.
Stuck? Ask Cyberlium AI Mentor
If “inventory is boring without a breach” still feels true, ask for a hint — not a malicious package. Try: "Hint only: what columns the inventory needs, why curl -I of a router means STOP, and where locked a03-inventory-lab.txt lives?"
You produced an A03 inventory artifact for software you own — pins and trust boundaries written down, demo identified, notes locked. Original Cyberlium — not official OWASP certification. Next — Quiz — Supply Chain Failures — then Continue to A04 Cryptographic Failures.
APPLY: Your inventory shows 5 directs and guesses 2 transitives. What did the lab prove?
APPLY: True or False: Gisting an employer .npmrc token with the inventory is fine for “proof.”
APPLY: curl http://192.168.0.1/ is a Netgear router login. What do you do?