Lab — Auth Hardening on Loopback
Loopback checklist: MFA/secrets, cookies, JWT verify — HOST=127.0.0.1 only.
Visual · auth_hardening_lab
Clipboard: login, session, JWT. — router STOP — SAFE Accounts YOU own. No sprays, no steal kits.
The lab hardens proofs you control — it does not hunt other people’s logins.
OWASP Top 10:2025 A07 Authentication Failures is practiced here as an auth-hardening checklist against a loopback app YOU run, or account hygiene on services YOU own, recorded in auth-hardening-lab.txt. Pull Lessons 1–3: weak auth patterns, session flags/lifecycle, JWT verify rules. Identify Fix/report = ticks with evidence lines (header names, config keys) — not stolen sessions. Next: module quiz.
1. Scope lock: DEMO you own, HOST="127.0.0.1:8774", accounts you own
Teaching processes bind HOST="127.0.0.1" only. Do not accept CLI URLs. If 192.168.0.1 shows router admin, that host is OUT OF SCOPE — no hydra. If you have no local app, complete the account-hygiene section (MFA, unique passwords, recovery review) for accounts YOU control — still no secrets in the file. Campus SSO sprays fail the lab.
2. Section A — authentication patterns
Tick: unique passwords/manager, MFA where available, generic login errors or conscious tradeoff, rate limit/lockout plan, reset token properties. Write config locations on YOUR app if applicable.
Command guide
A07 Authn — Section A - authentication patterns
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
SAFE="http://127.0.0.1:8774"
Command — copy this
curl -sS -m 3 -I "$SAFE/" | head -n 12
3. Section B — session and cookies
Tick: Secure/HttpOnly/SameSite, rotate on login, server revoke on logout, timeouts. curl -sS -D - only to DEMO if it is YOUR app, else SAFE 8774. No cookie-steal tooling.
Command guide
A07 Authn — Section B - session and cookies
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
SAFE="http://127.0.0.1:8774"
Command — copy this
curl -sS -m 3 -D - "$SAFE/" | grep -i set-cookie
4. Section C — JWT (if used) or N/A
Tick: alg allowlist, verify not decode-only, exp/iss/aud, secrets in env. If your app has no JWT, write N/A and why. Do not forge against foreign IdPs or live APIs.
5. Wrong vs right: foreign spray vs locked loopback checklist
Same word “lab,” opposite ethics.
- Wrong: Hydra campus SSO or 192.168.0.1 router. BeEF. Paste live JWT secrets. nmap the LAN. Bind 0.0.0.0. Forge against cloud metadata.
- Right: Identify DEMO; router → SAFE. Complete auth-hardening-lab.txt on owned/loopback scope; chmod 600. Next: Quiz — Authentication Failures.
6. Hands-on: identify + auth-hardening-lab.txt
Run identify curls. Optionally start a07_cookie_toy.py on 8774 from Lesson 2. Fill every section. Empty ethics fail.
Command guide
auth_hardening_lab.sh — DEMO identify + A07 loopback checklist
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap sudo apt install python3
macOS:
Command — copy this
brew install nmap brew install python3
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
cd "$HOME/cyberlium-lab"
Command — copy this
cat > a07_lab_practical_commands.sh << 'SH' SH
Command — copy this
{Mission: auth-hardening-lab.txt (mode 600)
1) 0.0.1:8774.2) Choose loopback app and/or accounts you own. Fill sections A–C with evidence lines (no live secrets). 3) chmod 600 $HOME/cyberlium-lab/auth-hardening-lab.txt. No hydra. No nmap. No steal kits.
Stuck? Ask Cyberlium AI Mentor
If you lack a local app, ask how to finish via account hygiene — not for a target URL. Try: "Hint only: how to complete A/B/C with accounts I own and N/A for JWT; why 192.168.0.1 router login is OUT OF SCOPE; where the locked note lives?"
A07 hardening is evidence on systems you own — DEMO identify plus SAFE 8774. Original Cyberlium — not official OWASP certification. Next — Quiz — Authentication Failures.
APPLY: No local app. Ethical completion?
APPLY: True or False: Pasting a production JWT HMAC secret into the lab file is fine for “evidence.”
APPLY: curl of http://192.168.0.1/ is router admin. Lab HOST becomes the router?