Lab — Verify Integrity Locally
One lab note: CI/update trust, digests, deser refuse — local only.
Visual · integrity_verify_lab
Checklist: CI trust, sha256sum, deser refuse. with curl -I — router STOP. No gadgets. No foreign CI.
Prove integrity habits on files and configs you own — not on the public internet’s package wars.
OWASP Top 10:2025 A08 is practiced as integrity-lab.txt: update/CI trust map, local digest verify of an artifact YOU created, and a deser refuse list for code YOU maintain. with curl -sS -I; No gadget cookbooks. No registry poison. No hydra. No nmap. Fix/report = gaps you found on your pipeline or loaders. Next: quiz.
1. Section A — update and CI trust carry-forward
Fill who can edit workflows, fork-PR secret policy, signature/digest before apply. Owned or hypothetical-owned only.
2. Section B — local digest evidence
Attach expected vs after-tamper digests for toy-artifact under cyberlium-lab. Mismatch must be recorded as refuse-install. sha256sum (or Python hashlib) only on files YOU created.
3. Section C — deser refuse on your code
List loaders you refuse on untrusted input and the replacement. No exploit payloads attached. No foreign targets. No gadget cookbooks.
4. Scope and ethics lock
No live deploy secrets in the file. No malware samples. No ysoserial. Router admin at 192.168.0.1 is OUT OF SCOPE. chmod 600.
5. Wrong vs right
Same word “integrity lab,” opposite ethics.
- Wrong: Gadget PoCs, typosquat publishes, foreign CI attacks, private keys in notes, hydra the router, nmap the LAN.
- Right: Identify DEMO with curl -I; router → STOP. integrity-lab.txt A–C filled; local digests; refuse list; chmod 600. Next: Quiz — Integrity Failures.
6. Hands-on: DEMO HEAD + integrity-lab.txt
Identify with HEAD, re-hash the toy artifact if needed, scaffold the note, complete blanks. Keep artifacts local.
Mission: integrity-lab.txt (mode 600)
1)2) Complete sections A–C for owned/hypothetical-owned scope. Include local digest evidence and deser refuse/replace. 3) chmod 600 $HOME/cyberlium-lab/integrity-lab.txt. No gadgets. No hydra. No nmap. No foreign attacks.
Stuck? Ask Cyberlium AI Mentor
Ask for hints on filling A/B/C — not for gadget chains. Try: "Hint only: what evidence counts for digest mismatch; how to write a refuse list without payloads; why 192.168.0.1 router login is OUT OF SCOPE; where the lab file lives?"
A08 lab complete when trust, digests, and refuse lists are written for systems you own. Original Cyberlium — not official OWASP certification. Next — Quiz — Integrity Failures.
APPLY: Lab asks for a gadget PoC attachment. Correct action?
APPLY: True or False: Digest mismatch should still install if the CI was green.
APPLY: curl -I of http://192.168.0.1/ is TP-Link router admin. Attach that host as A08 evidence?