Web › Module 5 › Lesson 4
Lab — Parameterize and Escape Locally
DEMO: ; SQLite binds + html.escape on 8772.
Visual · inject_lab_local
Lab: 0.0.1:8772. Parameterize SQLite and escape HTML. No sqlmap. No BeEF.
Opening
Bind the query. Escape the HTML. Lock the notes. That is the A05 lab.
Lessons 1–3 covered Injection (OWASP Top 10:2025 A05): SQLi mechanism and binds, XSS and encoding, other interpreter families. This lab combines SQL parameterization and HTML escaping on artifacts YOU create under $HOME/cyberlium-lab. No foreign hosts. No sqlmap. No BeEF/cookie kits. No hydra/nmap of the LAN. Original Cyberlium — not official OWASP certification. Next: Quiz — Injection.
1. Lab contract: identify DEMO, two proofs, one notes file
Proof A: SQLite fixed_lookup with ? placeholder; show odd input does not add rows unexpectedly. Proof B: html.escape of a string with <>&. Curl SAFE /escaped on 127.0.0.1:8772 to capture headers + body. Write both outputs into a05-inject-lab.txt. Optional: one sentence naming command/LDAP/template as other families.
Command guide
A05 Injection — Lab contract
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
SAFE="http://127.0.0.1:8772"
Command — copy this
curl -sS -m 3 -I "$SAFE/" | head -n 12
2. What “pass” looks like
Both proofs run. Identify banner recorded (or STOP-router). Notes include mechanism sentences for SQLi and XSS. Ethics refuse line. chmod 600. Empty templates fail. Foreign scanner output fails ethics.
Command guide
A05 Injection — What “pass” looks like
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install sqlmap sudo apt install python3
macOS:
Command — copy this
brew install sqlmap brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
pip install sqlmap
Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
SAFE="http://127.0.0.1:8772"
Command — copy this
python3 - << PY
import html
print(html.escape("<script>x</script> & y", quote=True))
PYCommand — copy this
curl -sS -m 3 -D - "$SAFE/escaped" | head -n 16
3. Stay-outs
Do not attach a remote DB URL. Do not “upgrade” the lab with payload packs. Do not open BeEF. Do not sqlmap 192.168.0.1. Do not shell out to demonstrate command injection on a classmate machine.
4. Artifact rows
Legal line; asset DEMO or SAFE; identify banner; SQLi fix observation; XSS escape observation; other families one-liner; ethics; path. World-writable 777 fails.
5. Ethics hard stops
sqlmap/DVWA against strangers, BeEF, cookie-steal kits, foreign SSTI/command packs, hydra/nmap of the LAN. Named so you refuse them.
6. Wrong vs right: exploit homework vs local bind+escape
Worked failure — same A05 words, opposite blast radius.
Wrong
sqlmap a shop. sqlmap the home router. BeEF a classmate. Skip binds/escapes. Paste payload packs into notes as trophies.
Right
Identify DEMO; local SQLite binds + html.escape + curl SAFE; a05-inject-lab.txt chmod 600. Next: Quiz — Injection.
Identify DEMO, run the combined lab script, curl SAFE, lock notes.
Mission: a05-inject-lab.txt in cyberlium-lab (mode 600)
1) 0.0.1:8772.2) Run local SQL bind + HTML escape proofs; curl SAFE; name other families in one line. 3) Fill $HOME/cyberlium-lab/a05-inject-lab.txt, chmod 600. No sqlmap/BeEF/LAN hydra.
Stuck? Ask Cyberlium AI Mentor
If “lab is incomplete without sqlmap” still feels true, ask for a hint — not a scanner line. Try: "Hint only: what two proofs a05-inject-lab.txt needs, which curl hits 127.0.0.1:8772, and why binds+escape are enough?"
You proved A05 fixes locally: SQL placeholders and HTML escaping, demo identified, locked notes, no foreign exploit tooling. Original Cyberlium — not official OWASP certification. Next — Quiz — Injection — then Continue to A06 Insecure Design.
Knowledge Check
APPLY: Your lab shows odd SQL input returning no extra rows with binds, plus escaped HTML. What did you prove?
Multiple choice
Knowledge Check
APPLY: True or False: Adding a remote production DB URL makes the lab more “real” and therefore required.
True or False
Knowledge Check
APPLY: curl http://192.168.0.1/ is a TP-Link router login. What do you do?
Multiple choice