Web › Module 4 › Lesson 4
Lab — Crypto Hygiene Checklist
DEMO: curl -sv http://192.168.0.1/ + openssl + toy hash — A04 checklist.
Visual · crypto_hygiene_lab
Lab: curl -sv. 0.0.1:8771. Hash YOUR string. openssl example.com. No hashcat. No MITM.
Opening
One checklist file. Rest, transit, password verbs, TLS mistakes. Lock it. That is the A04 lab.
Lessons 1–3 covered Cryptographic Failures (OWASP Top 10:2025 A04): rest vs transit, hashing vs encryption, TLS mistakes. This lab merges them into $HOME/cyberlium-lab/a04-crypto-lab.txt chmod 600. No dumps. No hashcat. No fake CAs. No hydra/nmap of the LAN. Original Cyberlium — not official OWASP certification. Next: Quiz — Cryptographic Failures.
1. Lab contract: checklist rows you actually fill
Required rows: identify curl -sv of DEMO or SAFE; sensitive data at rest control; in transit control; password storage sentence (slow KDF, not “encrypted SHA-256”); secrets-that-return sentence; three TLS mistakes named; toy hash hex; optional example.com subject/issuer; ethics refuse; legal line. Empty templates fail. Router-admin URLs fail ethics.
Command guide
A04 Crypto — Lab contract
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
SAFE="http://127.0.0.1:8771"
Command — copy this
curl -sS -m 3 -I "$SAFE/" | head -n 12
2. Hands: hash YOUR bytes; do not invert
Create a tiny file or string under cyberlium-lab. SHA-256 hexdigest. That proves integrity literacy paired with A04 verbs. Do not point hashcat at it. Do not hash /etc/shadow. Do not hydra the home router.
Command guide
A04 Crypto — Hands
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
python3 - << PY
import hashlib
p = __import__("pathlib").Path.home() / "cyberlium-lab" / "a04-bytes.txt"
p.write_text("local-only-demo
", encoding="utf-8")
print(hashlib.sha256(p.read_bytes()).hexdigest())
print("wrote", p)
PY3. Optional cert recheck
Reuse Lesson 3’s public openssl s_client read on example.com or YOUR domain. Still not an exploit. Still not MITM.
4. Artifact hygiene
chmod 600. No private keys. No dump lines. No verify=False against banks recorded as “success.”
5. Ethics hard stops
hashcat, John, Hydra, HIBP, shadow, mitmproxy, fake CA, sslstrip, café intercepts, nmap of 192.168.0.0/24. Named so you refuse them.
6. Wrong vs right: cracking/intercept vs checklist you own
Worked failure — same crypto words, opposite lab.
Wrong
Crack a dump. MITM a café. Hydra 192.168.0.1. Paste PEM private keys. Skip the checklist.
Right
curl -sv DEMO (STOP if router); fill a04-crypto-lab.txt with rest/transit/KDF/TLS rows + toy hash + openssl fields; chmod 600. Next: Quiz — Cryptographic Failures.
Identify DEMO, generate the checklist and toy hash, optional openssl. Lock everything.
Mission: a04-crypto-lab.txt in cyberlium-lab (mode 600)
1) curl -sv http://192.168.0.1/ —2) Fill rest/transit/KDF/TLS rows; record SHA-256 of a file YOU authored; optional openssl on example.com. 3) Lock $HOME/cyberlium-lab/a04-crypto-lab.txt chmod 600. No hashcat/MITM/LAN hydra.
Stuck? Ask Cyberlium AI Mentor
If “checklist is too soft without cracking” still feels true, ask for a hint — not hashcat. Try: "Hint only: which rows a04-crypto-lab.txt needs, what curl -sv vs openssl s_client each prove, and why hashing ≠ encryption stays on the list?"
You finished an A04 hygiene artifact: rest vs transit, verb hygiene, TLS mistakes, toy hash, DEMO identified, locked notes. Original Cyberlium — not official OWASP certification. Next — Quiz — Cryptographic Failures — then Continue to A05 Injection.
Knowledge Check
APPLY: Your lab file has toy SHA-256 and “password storage = slow KDF.” What did you prove?
Multiple choice
Knowledge Check
APPLY: True or False: mitmproxy against a classmate is allowed if you also filled the checklist.
True or False
Knowledge Check
APPLY: curl -sv http://192.168.0.1/ is a TP-Link router login. What do you do?
Multiple choice