Web › Module 2 › Lesson 4
Lab — Harden Config on Loopback
DEMO: harden http://192.168.0.1/ — broken vs hard on
Visual · harden_config_lab
Lab: 0.0.1:8769. Broken vs hardened headers. Lock notes.
Opening
Flip one process from soft to hard. Record curl -I before and after. That is the A02 lab.
Lessons 1–3 named Security Misconfiguration (OWASP Top 10:2025 A02): defaults/debug/open surfaces, security headers/CSP, clickjacking frame defenses. This lab is the checklist in motion against No stranger scans. No BeEF. No hydra/nmap of the LAN. Original Cyberlium — not official OWASP certification. Next: Quiz — Security Misconfiguration.
1. Lab contract: identify DEMO, two modes, one notes file
HOST="127.0.0.1" hardcoded, PORT 8769. Query ?mode=broken vs ?mode=hard. Broken: X-Debug: on, no CSP, no frame header. Hard: CSP, nosniff, X-Frame-Options DENY, no debug header. curl -I both on SAFE (or DEMO if YOUR app already serves this). Write every header line that differs. That proves A02 as configuration, not mythology.
Command guide
A02 Misconfig — Lab contract
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
SAFE="http://127.0.0.1:8769"
Command — copy this
curl -sS -m 3 -I "$SAFE/" | head -n 16
2. What “hard” must include for this course
Minimum: Content-Security-Policy default-src \'self\'; X-Content-Type-Options nosniff; X-Frame-Options DENY (or CSP frame-ancestors \'none\'); absence of a debug banner header. Optional: Referrer-Policy. HSTS only if you also terminate TLS on a host you own — do not fake HSTS on plain HTTP and call it done; write the caveat in notes instead.
Command guide
A02 Misconfig — What “hard” must include for this course
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
SAFE="http://127.0.0.1:8769"
Command — copy this
curl -sS -m 3 -D - "$SAFE/broken" | head -n 22 curl -sS -m 3 -D - "$SAFE/hard" | head -n 22
3. Stay-outs: scanners, kits, 0.0.0.0, LAN hydra
Do not point nikto/dirb at strangers “for A02.” Do not bind 0.0.0.0 for the dorm. Do not hydra the home router. Do not add XSS payloads to “test CSP.” Observation of headers is enough. If CSP blocks something in your own toy, tighten the policy carefully — still no payload packs.
4. Artifact rows
Legal line; asset DEMO or SAFE; broken headers; hard headers; debug on/off; frame defense present; ethics refuse; chmod 600 path. Empty templates fail. World-readable 777 fails. Router-admin URLs fail ethics.
5. Ethics hard stops
Named: foreign misconfig scanning, BeEF, UI-redress kits, hydra/nmap of the LAN, cloud bucket hunting on tenants you do not own, argv HOST rewrite, dorm binds. A02 being common is not consent.
6. Wrong vs right: internet hunting vs loopback harden contrast
Worked failure — same curl -I, opposite target. Right never needs a second host you do not own.
Wrong
Scan stranger hosts for missing headers. Hydra 192.168.0.1. BeEF to “prove CSP.” Bind 0.0.0.0. Skip notes.
Right
Identify DEMO; broken vs hard on 127.0.0.1:8769; fill a02-harden-lab.txt, chmod 600. Next: Quiz — Security Misconfiguration.
Run the server, curl identify then both modes, stop, lock notes.
Mission: a02-harden-lab.txt in cyberlium-lab (mode 600)
1) 0.0.1:8769.2) curl -I broken vs hard; fill $HOME/cyberlium-lab/a02-harden-lab.txt; chmod 600. 3) Ethics: no stranger scans, no BeEF, no hydra/nmap of the LAN, no dorm binds.
Stuck? Ask Cyberlium AI Mentor
If “hardening is fake without scanning the internet” still feels true, ask for a hint — not a target list. Try: "Hint only: which headers must appear in hard mode on 127.0.0.1:8769, and where locked a02-harden-lab.txt lives?"
You hardened a loopback toy: debug off, CSP/nosniff/frame deny on — A02 as configuration with identified demo asset and locked notes. Original Cyberlium — not official OWASP certification. Next — Quiz — Security Misconfiguration — then Continue to A03 Software Supply Chain Failures.
Knowledge Check
APPLY: hard mode shows CSP, nosniff, DENY; broken shows X-Debug. What did you prove?
Multiple choice
Knowledge Check
APPLY: True or False: Binding the harden lab on 0.0.0.0 for roommates is still “loopback practice.”
True or False
Knowledge Check
APPLY: curl http://192.168.0.1/ is a TP-Link router login. What do you do?
Multiple choice