Web › Module 4 › Lesson 1
Data at Rest vs In Transit
A04:2025 — curl -sv http://192.168.0.1/; rest vs transit on YOUR lab.
Visual · rest_vs_transit
Cryptographic Failures (A04): curl -sv. 0.0.1:8771. No cracking. No MITM kits.
Opening
HTTPS on the wire does not encrypt the database file. Disk encryption does not encrypt the socket.
OWASP Top 10:2025 A04 Cryptographic Failures covers missing, weak, or misapplied crypto: cleartext sensitive data, bad protocols, broken key handling. Attackers want readable secrets — passwords, tokens, PII, keys — by reading disks, backups, or traffic when protection fails. This is ORIGINAL Cyberlium teaching. At rest = stored bytes (DB, disk, backups, logs). In transit = moving bytes (TLS).
1. At rest: storage confidentiality and integrity
Data at rest sits on disk, in object storage, in DB pages, in backups, sometimes in logs. Controls: disk/volume encryption, field encryption where justified, access control to storage, backup encryption, avoid secrets in plaintext configs. Hashing passwords is a rest control of a special kind (Lesson 2) — verifiers, not reversible lockboxes. Failure mode: “We use HTTPS” while the DB dumps passwords in cleartext.
Command guide
A04 Crypto — At rest
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
SAFE="http://127.0.0.1:8771"
Command — copy this
curl -sS -m 3 -I "$SAFE/" | head -n 14 printf "at_rest: disk/backups/queues in_transit: TLS to the peer " >> "$HOME/cyberlium-lab/a04-rest-mid-h1.txt"
2. In transit: TLS and authenticated channels
Data in transit crosses networks. Controls: TLS with modern configurations, certificate validation, no cleartext fallbacks for sensitive routes. Failure modes: HTTP for logins, obsolete TLS versions, verify=False in clients (Lesson 3). Attacker goal: read or modify traffic when validation fails or crypto is absent. curl -sv on YOUR demo shows whether the connection is HTTP or HTTPS. Café Wireshark against others remains out of this course.
Command guide
A04 Crypto — In transit
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
SAFE="http://127.0.0.1:8771"
Command — copy this
curl -sS -m 3 -I "$SAFE/" | head -n 14 curl -sS -m 3 -I "$SAFE/" | head -n 16
3. Why teams mix them up
Marketing says “encrypted” without saying where. A padlock icon is transit to a matching name — not “the site is safe” and not “the database is encrypted.” Write findings with location: rest vs transit. That is A04 literacy.
4. What you ship: classify data, pick the right control
Inventory sensitive fields. For each: protected at rest? in transit? key management story? Avoid homebrew crypto. Prefer platform TLS and vetted libraries. Notes: label three examples you invent for a toy app you own. Record curl -sv identify of DEMO or SAFE.
5. What you record
Date (UTC). Rest vs transit definitions. Three labeled examples. curl -sv banner (DEMO or SAFE 127.0.0.1:8771). Ethics: no MITM, no dump cracking, no hydra/nmap of the LAN. Path: $HOME/cyberlium-lab/a04-rest-transit-notes.txt, chmod 600. Legal: original Cyberlium — not official OWASP certification.
6. Wrong vs right: traffic toys vs correct classification
Worked failure — same word “encrypted,” opposite place.
Wrong
Claim HTTPS encrypts the database. MITM a café. Crack a breach dump. Hydra 192.168.0.1. verify=False at a bank.
Right
curl -sv YOUR demo (STOP if router); label rest vs transit controls; lock a04-rest-transit-notes.txt. Next: Hashing Passwords vs Encrypting Secrets.
Identify DEMO with curl -sv, optionally start SAFE echo, fill notes. No network attacks required.
Mission: a04-rest-transit-notes.txt (mode 600)
1) curl -sv http://192.168.0.1/ —2) Define at rest vs in transit; write three labeled toy examples. 3) Fill $HOME/cyberlium-lab/a04-rest-transit-notes.txt, chmod 600. No MITM, no cracking, no LAN hydra/nmap.
Stuck? Ask Cyberlium AI Mentor
If “encrypted means one switch for everything” still feels true, ask for a hint — not a MITM guide. Try: "Hint only: rest vs transit examples, what curl -sv on MY lab shows, and where locked a04-rest-transit-notes.txt lives?"
You can separate at-rest and in-transit protections under OWASP Top 10:2025 A04 with curl -sv on YOUR demo and locked notes. Original Cyberlium — not official OWASP certification. Next — Hashing Passwords vs Encrypting Secrets.
Knowledge Check
APPLY: Logins use HTTPS but the DB stores plaintext passwords. What failed?
Multiple choice
Knowledge Check
APPLY: True or False: Disk encryption makes café MITM against others ethical homework.
True or False
Knowledge Check
APPLY: curl -sv http://192.168.0.1/ shows a TP-Link Router Admin page. What do you do?
Multiple choice